The first infections came slightly before 05:30 UTC on Saturday 25 January 2003: half past midnight in New York, and half past nine on Friday evening in Redmond. The worm was 376 bytes; with its headers it travelled in a single 404-byte UDP packet to port 1434, where the Resolution Service of SQL Server 2000 told clients which port each database instance was using. The same service ran in Microsoft's Desktop Engine, MSDE 2000, which shipped inside other Microsoft products, Visual Studio among them. The worm deleted nothing and carried no payload. On every machine it reached it did one thing: sent itself to random addresses, as fast as the machine could transmit.
The speed was new. David Moore of CAIDA, at the University of California, San Diego, with Vern Paxson, Stefan Savage, Colleen Shannon, Stuart Staniford and Nicholas Weaver, found that the infected population doubled about every 8.5 seconds at first. Within about three minutes the worm was making more than 55 million scans a second, and within ten it had infected more than 90 per cent of vulnerable hosts. Their monitors saw some 75,000 infected addresses in the first half-hour, a floor rather than a total, and the true number, they wrote, was undoubtedly larger. At 07:11 UTC a subscriber wrote to Bugtraq: “MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!”
The damage came from the traffic. Bank of America said most of its 13,000 cash machines could not process customer transactions for part of the day, and customers of some large Canadian banks could not withdraw cash. Continental Airlines' ticketing systems and check-in kiosks were overwhelmed, delaying and cancelling flights. Outside Seattle, police and fire dispatchers worked with paper and pencil for hours after the worm disrupted a 911 centre serving two suburban police departments and at least 14 fire departments; the researchers' paper records the failure of Bellevue's 911 data-entry terminals. South Korea lost almost all its internet service. Most of the disruption, its analysts found, came from networks flooded from inside by their own infected machines, and routers and switches crashed under the load.
David Litchfield, of Next Generation Security Software, had found the flaw; Microsoft fixed it in bulletin MS02-039 on 24 July, and that August he showed proof-of-concept code at Black Hat in Las Vegas. On 29 January he wrote on Bugtraq that “my code was used as its template”, though it had probably saved whoever wrote it only twenty minutes or so. Microsoft pointed out that its patch had been available for six months, but news soon leaked that its own internal network had been badly hit, because the patch had not been applied there. No one claimed the worm, and its author was never caught. What it did inside Ohio's Davis-Besse nuclear plant came out only in August.
Here Is That Sample
On Thursday 9 January 2003, by F-Secure's dating, a new mass-mailing worm was found in the wild. The mail came from big@boss.com, under subject lines such as “Re: Here is that sample” and “Re: Movies”, with a .pif attachment. Opened, Sobig installed itself as winmgm32.exe, mailed itself through its own SMTP engine to addresses found in files on the disk, and copied itself into the start-up folders of network shares it could reach. It also fetched a text file from a GeoCities page and treated its contents as the address of a program to download and run; when F-Secure first described it the address led nowhere, but on 23 April, F-Secure later reported, the page was changed to point to a backdoor. That hook ran through the family to Sobig.F in August. On 21 January, at Southwark Crown Court in London, Simon Vallor, a 22-year-old web designer from Llandudno, was jailed for two years over three mass-mailing viruses he had written and released, Gokar, Redesi and Admirer.
Back on the Web
Kevin Mitnick's supervised release expired at midnight on 20 January 2003. Arrested by the FBI in Raleigh, North Carolina, in February 1995, he had pleaded guilty in 1999 to wire fraud, computer fraud and intercepting a wire communication; his sentences came to 68 months in all, a term December 2004 sets beside a longer one. Released in January 2000, he was at first forbidden any communications technology but a landline telephone. On the afternoon of Tuesday 21 January he went back on the web, live on TechTV's The Screen Savers; Steve Wozniak had given him a new laptop to mark the occasion. The first site he opened, by press accounts, was his girlfriend's weblog, to see what she had written about him. He went on to make his living advising companies on security, latterly as chief hacking officer at KnowBe4, and died of pancreatic cancer on 16 July 2023, aged 59.
A Hard-Coded Target
The year opened with a worm that carried the subcontinent's hacking feud into other people's mail. A new strain of Yaha, called Yaha.K by some vendors and Yaha.M by others, had been found on Sunday 22 December, by F-Secure's dating, and by the 30th reports of it had come in from several countries. It mailed itself to addresses taken from the Windows Address Book and the folders of instant-messaging programs, and tried to shut down anti-virus and firewall software, ZoneAlarm among them. Hard-coded into it was a target in Pakistan: infected machines were set to flood a government site, infopak.gov.pk. Its authors had left a message inside it that F-Secure declined to reproduce for its language.
The feud ran both ways. Pakistani groups such as G-Force Pakistan defaced Indian websites; in early March another variant, Yaha.P to F-Secure, appeared under the banner of a group calling itself the Indian Snakes, set to flood five Pakistani sites, the Karachi Stock Exchange's among them. CERT-In issued its first numbered advisory only in June, as January 2004 recounts. We found no record that anyone was charged over the Yaha worms.
Latent Dirichlet allocation; spam filters at MIT
In January 2003 the Journal of Machine Learning Research published latent Dirichlet allocation, by David Blei and Michael Jordan of the University of California, Berkeley, and Andrew Ng of Stanford. Their model treated each document as a mixture of topics and each topic as a distribution over words, inferred from word counts alone. Fitted with 100 topics to 16,000 Associated Press stories, it read an unseen article on a foundation's grants to Lincoln Center, the Metropolitan Opera, the New York Philharmonic and the Juilliard School as a blend of four topics the authors named arts, budgets, children and education, though, blind to word order, it split the foundation's name among several. On 17 January some 500 people, by Macworld's count, came to MIT for a conference on spam filters organised by Paul Graham, whose statistical filter had let through 4 of about 1,750 spams in the month to 10 January. LDA became one of the most common topic models; Blei and Jordan later helped build one that inferred the number of topics rather than fixing it (December 2004).
Cisco buys Okena; Palladium loses its name
On Friday 24 January 2003, hours before Slammer, Cisco agreed to buy Okena, a 52-person company in Waltham, Massachusetts, for Cisco stock worth about $154 million. Its software protected desktops and servers, “also known as ‘endpoints’”, in Cisco's words; rather than looking for the signatures of known attacks, its agents, sold as StormWatch, intercepted the requests programs made to the operating system, file system, registry and network and refused whatever a customer's policy forbade. Renamed Cisco Security Agent, it was withdrawn from sale at the end of 2010, with no replacement offered. The same week Palladium, Microsoft's plan to build walled-off memory and sealed storage into Windows PCs, became the Next-Generation Secure Computing Base; Microsoft cited another company's claim to the old name and denied that criticism had prompted the change. Scaled back in 2005, the plan reached users chiefly as BitLocker in Windows Vista. Signatures still paid: on 15 January Symantec had reported quarterly revenue of $376 million, up 29 per cent, with anti-virus sales up by a quarter.
⏳ Time capsule — January 2003
- On 9 January Prime Minister Atal Bihari Vajpayee opened the first Pravasi Bharatiya Divas in New Delhi, a gathering of people of Indian origin from around the world, held on the anniversary of Gandhi's return from South Africa to Bombay on 9 January 1915, and said the government would allow dual citizenship for people of Indian origin in certain countries.
- On 23 January Nature published Xu Xing and colleagues' description of Microraptor gui, a feathered dinosaur from Liaoning, in north-eastern China, with wings on its legs as well as its arms; the team, from the Chinese Academy of Sciences, called it four-winged and suggested that it glided from tree to tree.
- On 26 January, at Qualcomm Stadium in San Diego, the Tampa Bay Buccaneers beat the Oakland Raiders 48–21 in Super Bowl XXXVII under Jon Gruden, who had coached the Raiders through the 2001 season; Oakland's quarterback, Rich Gannon, threw a Super Bowl record five interceptions, three of them returned for touchdowns.
- On 29 January AOL Time Warner reported a net loss of $98.7 billion for 2002, the largest in American corporate history, after writing down the value of America Online and other assets, and said at the same time that Ted Turner would step down as vice-chairman.
Still Knocking at 1434
Slammer set the benchmark. It had spread nearly two orders of magnitude faster than Code Red, its analysts wrote, and worms like it ruled out any human response, so defences would have to be automatic. Blaster arrived that August; Witty, also carried in a single UDP packet, reached most of its 12,000 victims within about 45 minutes in March 2004; and Sasser sent Britain's coastguards back to paper charts in May 2004. In August 2004 Microsoft made protection the default, switching on Windows XP's firewall. Litchfield, wondering on Bugtraq whether publishing working exploit code was worth it, found one good thing in the outbreak: more SQL servers had been patched since.
The worm itself never quite went away. Unpatched machines kept sending its probes to port 1434 for years, and Check Point recorded a burst of attempts against networks in 172 countries between 28 November and 4 December 2016, more than three years after Microsoft's extended support for SQL Server 2000 ended on 9 April 2013. On every record we found, Slammer's author has never been identified. For now, this is where the archive begins: 2002 and the years before it are still to be restored.