Internet worm took 10 minutes to create global chaos

The "SQL Slammer" computer worm that brought much of the internet to a halt last week spread worldwide in 10 minutes, making it the fastest such infection seen, security experts said yesterday.

In its early stages the number of machines infected by the worm was doubling in size every 8.5 seconds, according to a team led by David Moore of the University of California at San Diego.

"At its peak, achieved approximately three minutes after it was released, the worm scanned 55 million internet hosts per second. It infected at least 75,000 victims, and probably considerably more," said a member of the team.

The worm first appeared on the Net at about 0530 GMT on 25 January. Initially it affected Web servers but home computers were unscathed.

Among the companies affected was Microsoft – whose own SQL Server software was the target of the attack. The weakness the tiny program exploited had been identified last July, and Microsoft had released a "patch" that should have prevented it. But more patches to deal with other software flaws were released by Microsoft afterwards and some negated the fix, allowing SQL Slammer to take hold. Many other companies had never updated their systems.

Among the effects of the worm, which generated huge amounts of network traffic as it tried to spread copies of itself, were delays to airline reservation systems and flights, and problems with bank cash machine networks.

Nobody has been identified as the author of the worm, which was only the third of its type seen on the Net. Code Red also attacked Microsoft servers 18 months ago. SQL Slammer spread nearly 100 times faster.