The shape of the decade

Between 1999 and 2008 a particular kind of event happened repeatedly: a self-propagating program spread across the internet faster than people could respond, and the world found out what was connected to what. Read in order, the seven best-known outbreaks show two things moving at once. The infection route travels down the stack - from a document a person opens, to an email a person opens, to a web server nobody touched, to a database port, to any reachable Windows machine. And the window between the fix and the outbreak stays open the whole time.

1999: Melissa, and the feature that was the vulnerability

On 26 March 1999 David L. Smith posted an infected Word document to a newsgroup, claiming it held passwords for adult websites. Opening it caused Microsoft Word to use Outlook to mail copies to the first fifty addresses in the victim's address book, arriving as an "important message" from a known colleague. Fifty times fifty times fifty: it disrupted around a million accounts and some organisations shut off email entirely. The Department of Justice put the damage above 80 million dollars. Smith was arrested within a week, pleaded guilty, and was sentenced to twenty months - among the first people ever imprisoned for writing a virus.

There was no vulnerability. Word macros running automatically and Outlook being scriptable were both features, working as designed. That is the uncomfortable starting point for the decade: the first mass outbreak exploited nothing but the intended behaviour of two products, and the fix was to change what the products were willing to do.

2000: ILOVEYOU, and the missing law

On 4 May 2000 an email with the subject and an attachment named LOVE-LETTER-FOR-YOU.txt.vbs reached tens of millions of machines. Windows hid the final extension, so the file looked like a text file and was a script. Like Melissa it mailed itself onward; unlike Melissa it overwrote files. Damage estimates ran into billions.

The interesting part is the aftermath. Investigators traced it to Onel de Guzman, a 24-year-old student in Manila. All charges were dropped, because the Philippines had no law against computer crime - the charges brought under a credit-card-fraud statute did not fit, and a computer crime law was signed only weeks later. In 2020 de Guzman told journalists he had written it to steal dial-up passwords because he could not afford internet access, and had not anticipated what it would do. A global outbreak, a known author, and no offence on the books: the case is one of the reasons cybercrime legislation exists in the form it now does in most countries.

2001: Code Red and Nimda, and the end of user involvement

changed the model. Released on 13 July 2001, it needed no user at all: it sent a single HTTP request to a web server, overflowing a buffer in an indexing extension of Microsoft's Internet Information Services, and the server ran it. On 19 July the number of infected hosts reached 359,000. Infected pages were defaced with "Hacked By Chinese!", and the worm was programmed to launch a denial-of-service attack on the White House website.

Three details from the researchers' own announcement are worth keeping. The team at eEye that analysed it named it after the soft drink that kept them awake through the night doing so. The worm checked for a file called c:\notworm and, if it existed, did not spread - an off switch left in by the author. And the White House attack targeted an IP address rather than a name, so the definitive remedy was to move the site to a different address. The flaw had been published by eEye on 18 June and patched by Microsoft in bulletin MS01-033 about a month before the worm appeared.

followed on 18 September, a week after the September 11 attacks, and its innovation was breadth: it spread by email, by open network shares, by infecting web pages that visitors then downloaded, by scanning for Code Red's leftover backdoors, and by attacking directly. A defender who blocked one route found the others still open.

2003: Slammer, the fastest thing that ever happened

At around half past five in the morning on Saturday 25 January 2003, a worm of 376 bytes - small enough to fit in one UDP packet, sent to port 1434 with no handshake and no waiting for a reply - began scanning the internet. It doubled every eight and a half seconds. Within ten minutes it had reached ninety per cent of the vulnerable machines on the internet, roughly 75,000 servers running Microsoft Server or the desktop engine embedded in dozens of other products, which many administrators did not know they had installed.

It carried no malicious payload. The damage was purely the traffic: 13,000 Bank of America cash machines went offline, South Korea lost internet and mobile service for 27 million people, flights were cancelled, and emergency call services were disrupted. The memory safety article explains the class of bug underneath.

Microsoft had published the patch, MS02-039, on 24 July 2002. Six months.

Blaster arrived in August of the same year through a different door - a buffer overflow in the DCOM remote procedure call service on TCP port 135 - rebooting machines in a loop and attacking Microsoft's own update site. The patch, MS03-026, had shipped about a month earlier. By now the pattern is not a pattern; it is the definition of the era.

2008: Conficker, and a bulletin that said so

Then a gap, and then the last one. On 23 October 2008 Microsoft issued an emergency out-of-band update, MS08-067, for a flaw in the Windows Server service, and wrote in the bulletin that it was possible the vulnerability could be used in the crafting of a wormable exploit. That is the predicting the worm in the document announcing the fix.

The first variant appeared around 21 November. Later variants spread over local networks, through removable drives, and by guessing weak administrator passwords on network shares. Its command channel was the innovation that outlived it: rather than a fixed server that could be seized, it generated 250 domain names a day from an algorithm seeded with the date, so defenders had to register or block a moving target - which produced the Conficker Working Group, an unprecedented coordination between security companies, registries and country domain operators, several of whom blocked thousands of names in advance. Microsoft offered a 250,000 dollar reward. Infection estimates ran into the millions; the counts varied by vendor and method and should be read as approximations.

As late as January 2009, an estimated thirty per cent of Windows machines were still unpatched. The botnet was enormous, resilient, and, so far as the public record shows, never used for much.

What ended it, and what did not

The outbreaks stopped being routine for reasons that were mostly not clever. Windows XP Service Pack 2 turned the firewall on by default, which removed the reachable ports the network worms depended on. Automatic updates became the default rather than an option, which closed the window between patch and installation for consumers. Macros stopped running without asking. The vendor reorganised around the problem. Those changes, unglamorous every one, did more than any product.

What did not end is the gap. Nine years of outbreaks all had a fix available first: a month for Code Red, a month for Blaster, six months for Slammer, four weeks and an explicit warning for Conficker. Fourteen years after Slammer, WannaCry and NotPetya spread through a flaw patched fifty-nine days earlier - and one of the Microsoft responders who worked on Conficker made exactly that comparison when the 2017 attacks landed. Patching hygiene, he noted, remains poor in the places least able to fix it: hospitals, public bodies, old machines nobody owns.

For a practitioner the transferable lesson is not "patch faster", which everyone already knows and few can do. It is the three questions this decade keeps asking. What is reachable? - Slammer found database engines embedded in products whose owners did not know they were running one. What is exposed by default? - the firewall change ended more worms than any signature. And what is the actual gap between a fix existing and a fix being installed, in your estimate, measured? That last number is the one every entry above was decided by, and it is the one most organisations still cannot state.

Sources