"At the time of the patch, no one realized that every vulnerable SQL installation was also listening on a UDP (User Datagram Protocol) port that they could be exploited over," Manzuik explains. "Many administrators simply locked down access to the SQL TCP ports while forgetting about UDP."

A postmortem by the Cooperative Association for Internet Data Analysis revealed that the worm was a model of efficiency, doubling the number of infected systems every 8.5 seconds, and flooding the Internet with so many infection attempts that routers shut down. When restarted, so many routers attempted to update their routing tables simultaneously that normal Internet traffic simply couldn't get through the gridlock.

Upshot: SQL Slammer demonstrated the power of a vulnerability that could fit within a single data packet, and brought home the lesson that a single application weakness could cause the entire Internet to grind to a standstill. And it's still out there, drifting around on a few old systems, looking for new hosts to infect.

Billy Gates, stop making money! Make malware instead.
Bug identifier: MS03-026
Description: Buffer overrun in RPC interface could allow code execution
Alias: The Blaster Worm bug
Date published: July 16, 2003

The DCOM RPC interface is a common component of NT-based Windows OSes, including NT, 2000, XP, and Server 2003. In the summer of 2003, it became the subject of intense scrutiny.

As Microsoft described in the bulletin that accompanied the patch, a successful exploit only required the attacker to send a "specially formed request" to a vulnerable PC—a bit like dangling candy in front of a ravenously hungry baby.

By Aug. 11, the Blaster worm arrived, and though it spread rapidly, it was fairly easy to block with a firewall.

Unfortunately, protecting home systems with firewalls wasn't common practice at the time. Home users' PCs—connected directly to the Internet—got whomped by the worm. When the worm's code crashed the infected computer's RPC service, the computer would display a message warning of imminent shutdown, and unceremoniously reboot itself.

The worm had another message, this one to Microsoft's founder, and embedded within its code: "billy gates why do you make this possible? Stop making money and fix your software!!"

But it was fixed. Or at least it would have been if people had patched their systems.

At the end of the summer, Microsoft released a second set of updates in MS03-039 that blocked additional ports that attackers could use to mess with the RPC service.

Upshot: We're all in better shape thanks to the wide adoption of firewalls in the home. Thanks in part to Blaster and its ilk, most broadband modems have one built in.