A new paper by well-regarded networking researchers analyzes the spread of the recent Slammer/Sapphire worm. The worm spread at astonishing speed, doubling the number of infected hosts every 8.5 seconds, and infecting 90% of the susceptible machines on the Net within ten minutes. Researchers had predicted that such fast-spreading worms could exist, but this is the first one seen in the wild.
The clear lesson is that a network attack can cause very widespread damage before human network operators can react. Only a widely implemented, automated shutdown procedure can hope to slam the door on a worm like this. Fortunately, Slammer/Sapphire did not carry a malicious payload. The next time we may not be so fortunate.
[Thanks to Sue Ferrara for the link.]
