SQL slammer analysed
16th February 2003
Robert Graham’s analysis of SQL Slammer cleared up quite a few things I had been wondering about the worm. It confirms that the majority of the infections were caused not by SQL Server (as reported widely by the press) but by the embedded MSDE component, which is far less likely to be patched (or firewalled off from the public internet) than SQL Server.
Incidentally, Curious Yellow is a fascinating explanation of a theoretical “co-ordinated super-worm” capable of adapting to attempts to combat it using advanced peeer to peer techniques. It is an extension of the Warhol worm concept where a worm that pre-scans the internet for targets could infect all susceptile hots world-wide in less than 30 seconds. Scary stuff.
More recent articles
- My Lethal Trifecta talk at the Bay Area AI Security Meetup - 9th August 2025
- The surprise deprecation of GPT-4o for ChatGPT consumers - 8th August 2025
- GPT-5: Key characteristics, pricing and model card - 7th August 2025