SQL Slammer
loresecuritynetworking
The 376-byte worm that fit in a single UDP packet and infected most of its 75,000 victims within ten minutes on January 25, 2003.
Slammer lived only in memory and network packets, never touching disk: one hand-optimized 376-byte payload fired at UDP port 1434, doubling its footprint roughly every 8.5 seconds at the peak. Bank ATMs failed, much of South Korea lost connectivity, and routers collapsed under the scanning load, all from a hole Microsoft had patched six months earlier. It remains the canonical proof that patch latency, not attacker brilliance, is what burns the Internet down.
SQL Slammer, in January 2003, was 376 bytes, fitted in a single UDP packet, required no connection, and doubled its infected population roughly every eight seconds. It reached essentially every vulnerable machine on the internet within about ten minutes, faster than any human response was possible.
The speed came from the design. Because it used a connectionless protocol and needed no handshake, each infected host could spray packets as fast as its network interface allowed, with no waiting. The damage was mostly collateral: the traffic volume saturated links and took down networks, including bank cash machines and at least one emergency call system, for organizations that were not running the vulnerable database at all.
Two lessons stuck. A patch had been available for six months, so the exposure was a patching problem rather than an unknown vulnerability, which is the same finding that most breach statistics still produce. And it demonstrated that automated propagation can outrun human incident response entirely, which is the argument for defences that act at machine speed and for network segmentation that limits how far something can get.
Also known as: Sapphire worm