Reading (For Dummies)

Measuring the verocity of a worm

Today's MS-SQL worm attack has made me wonder about doing an analysis on internet susceptibility to such virii.

Like a normal human-born disease, a worm needs to have proper timing if it is to do the most damage to a network. Today's worm did a pretty good job of wrecking the 'net, with 5 of the root nameservers buckling. But it could have done better.

The problem with it was that it moved too quickly. While speed is a good way to infect the maximum number of hosts on the internet (like in real life), it has the problem that it draws too much attention to itself, especially when the cure is as easy as pennicilin. What the virus writer should have done was made it work a little more slowly for the first, say, 30-40 hours. Then on Sunday it should have started sending random UDP connections (ie to random ports, on random servers, with a big old chunky payload). That would have _really_ crippled the 'net.