1. Taking Down the Internet
Dmitry O. Gryaznov, Sr. Research Architect

2. Date: Sat, 25 Jan 2003 05:34:07 GMT South Korea “disappears”
Troubles with U.S. ATMs and flights ticketing
General Internet slowdown: up to 20% of IP packets lost
11/22/2018

3. W32/SQLSlammer Only 376 bytes long
Exploits a buffer overflow in MS SQL Server
Spreads by sending itself to UDP port 1434 at random IP addresses
11/22/2018

4. Mass-mailing viruses Send thousands of copies by E-mail
Can affect mailservers badly
Need to connect to a mailserver and follow a mail protocol
Require a user
11/22/2018

5. Sample SMTP session Client Server
(connects to TCP port 25) SMTP ready
HELO mydomain.net Welcome
MAIL Sender OK
RCPT Recipient OK
DATA Send the data
(message content) Accepted for delivery
QUIT Bye
11/22/2018

6. Typical daily @mm chart
11/22/2018

7. CodeRed and likes
Exploit vulnerabilities in TCP servers (e.g. a buffer overflow in MS IIS)
Need to connect to a server and follow a protocol (e.g. HTTP)
Do NOT require a user
Do not affect the Internet noticeably
11/22/2018

8. Sample HTTP session Client Server
(connects to TCP port 80)
GET /us/index.asp HTTP/1.0 Host:
HTTP/ OK Server: Microsoft-IIS/ Last-Modified: Tue, 23 Sep :41:05 GMT Content-Length: Content-Type: text/html Connection: close (43585 bytes of data)
11/22/2018

9. CodeRed.c (aka CodeRed II)
11/22/2018

10. Slammer Connectionless UDP, “shoot and forget”
A single infected PC exhausts 100Mbps bandwidth – over 30,000 “shots” per second; could attack each and every computer on the Internet in less than a day
Much faster in reality – “chain reaction”; took minutes to reach its saturation level at thousand infected computers worldwide
11/22/2018

11. Slammer hits per hour
11/22/2018

12. Slammer hits per minute
11/22/2018

13. Slammer hits per 10 seconds
11/22/2018

14. Slammer: First 5 minutes
11/22/2018

15. Slammer: First 5 minutes
11/22/2018

16. Is it possible to take down the Internet?
thousand Slammer-infected computers – 20% IP packets lost
1,000,000 computers - ?
580,000,000 Internet users worldwide
Over 14,000 different “backdoors” in Usenet in May-June 2003; millions of readers
IRC, P2P, etc.
11/22/2018

17. Slammer: First 5 minutes
11/22/2018

18. The WildList Asia
Source: WildList Org.
11/22/2018

19. The WildList Israel
Source: WildList Org.
11/22/2018

20. The WildList India
Source: WildList Org.
11/22/2018

21. The WildList Japan - Seiji Murakami (IPA)
Source: WildList Org.
11/22/2018

22. The WildList Korea
Source: WildList Org.
11/22/2018

23. The WildList Australia
The interesting thing about Australia's reports are that things are "rotating" in and out (viruses older than a year fall off the list). But also that Australia tends to report viruses earlier than other countries, and then the other countries confirm the presence of the viruses in the wild.
Source: WildList Org.
11/22/2018

24. The WildList Asia
Source: WildList Org.
11/22/2018