Follow-Up: Weekend Debut Likely Hurt Spread Rates
For some of the most spin-free and interesting semi-technical coverage of virus incidents, I highly recommend F-Secure's Developers Web Log, an ingenious and frequently updated project that started during the MyDoom pandemic.
Today, F-Secure's Mikko Hyppönen posted an interesting comment about why W32/Sasser.worm isn't spreading like it should. Some highlights:
”You would expect an automatic network worm like Sasser to hit even harder than it seems to be hitting right now. Of course, it's weekend time, but most infected machines would be home computers, many of which are turned on and online anyways...Sasser can be compared to the Blaster/Lovsan outbreak in last August in many ways...Blaster [was] a massive case, partly because the patch was only available for 32 days before the outbreak started - and that was during [the biggest] holiday season. With Sasser, the time difference between the patch and the worm was just 18 days...But the bottom line is that although Sasser starts several threads which constantly scan random addresses with minimal time delay, we aren't seeing massive amounts of infection. Not yet anyway.”
The “not yet anyway” part is an interesting point. The fact is, come Monday, no one can predict very well how W32/Sasser.worm will spread. There simply aren't many worms like this that we can look at for help. Here is a history of the times that various viruses were isolated that used exploits and achieved at least MEDIUM risk:
Sasser: Friday late PM
Blaster: Monday late AM
SQLSlammer: Sunday late PM
Code Red: Friday AM
Timing alone cannot account for Sasser's lower-than-expected spread. The question is, what can? That is difficult to say. Perhaps higher user education, more updated machines, or something like that. Blaster was the wake-up alarm, and hopefully Sasser will be the second alarm for those who have foolishly hit the snooze button on security. We'll find out Monday just how prepared the corporate world is for this threat.
Posted
May 01 2004, 09:41 AM
by
trafton