As you may have already heard, over the weekend the Internet was hit by one of the fastest spreading worms since the original Morris worm. The name of this nasty piece of code? “MS-SQL Slammer”- so called because it uses a 6-month old exploit in unpatched Microsoft SQL servers as its method of spreading- but spreads so quickly that it caused major problems across the ‘net.
Actually, to call it a nasty piece of work is doing a disservice to the author (who is, at this moment of time, still unknown). It’s a lovely piece of optimised assembly code which does “it’s job” in just 376 bytes in length (to put that in perspective – that is exactly the length, in letters, spaces and punctuation, of the first paragraph of this entry).
When the code infects an unpatched Microsoft SQL Server 2000 or Microsoft Desktop Engine (MSDE – which is included in Visual Studio.net, Asp.net Web Matrix Tool, Office XP Developer Edition, MSDN Universal and Enterprise, Microsoft Access and Microsoft Applicaiton 2000), it first loads the “modules” Kernel32.dll and WS2_32.dll. It then calls the routine “GetTickCount” to generate random IP (internet protocol) address which it then targets for propagation and exploitation over the UDP (User Datagram Protocol) protocol port 1434. It repeats the exploit code (using a method called a stack buffer overflow) until either the SQL server is shut down or the machine is rebooted.