How did a 376-byte worm infect the internet in ten minutes?
In January 2003 a program of 376 bytes doubled its victims every 8.5 seconds, faster than any worm before it.
Guess first
?
Which one is it?
It spread so fast because each infected computer immediately started firing copies of the at random addresses, and every new victim did the same. The worm known as Slammer or Sapphire began to infect hosts slightly before 05:30 UTC on Saturday, 25 January 2003. As it began spreading, it doubled in size every 8.5 seconds, and it infected more than 90 percent of vulnerable hosts within 10 minutes.
That is exponential growth in action. Doubling is a patient trick that looks like nothing at first: one machine, two, four, eight. But after sixteen doublings, a little over two minutes at that pace, the count is in the tens of thousands. In total the infected at least 75,000 hosts.
Try it
A worm that doubles every few seconds
y = 1 · 1.09ˣ
Challenge · A growth of about 1.085 times per second doubles the count about every 8.5 seconds. At that setting, roughly when does the count pass 50,000?
The remarkable part is how little code it took. The was only 376 bytes, so with headers it fitted in a single 404-byte packet. It did little other than generate random addresses and send itself to them. The infected machine did not wait for a reply: each one simply 'fired and forgot' packets as fast as it could.
Nothing in the was designed to destroy anything, yet the harm was real. It carried no malicious , but it overloaded networks and took database servers out of operation. The consequences included outages, cancelled airline flights, interference with elections and ATM failures. And the hole it used was no secret: a had been available for six months, but many installations had not been patched.
Quiz me
0/3
Recap
When something doubles every few seconds, most of the damage happens before anyone can react.
💡 A trick to remember it · Tiny seed, quick echo: every victim shouts the same message to strangers, so the crowd grows faster than a person can speak.
Surprising fact · A patch had been available for six months, but many installations, including many at Microsoft, had not applied it.
Connects to
- ☁️ Why does one cloud outage take down banks, apps and government sites at once?
- 🩹 Why doesn't everyone just install the patch the day it comes out?
- 🪱 How did one student's experiment slow down the early internet?
- 🪷 Why does something that doubles daily look harmless until the last moment?
- 📦 How does the internet deliver your data without ever giving you a line of your own?
Sources (2)
No source, no claim. Every fact in this lesson (17 claims) cites at least one of these.