Scourge · August 11 2003

The Scourge of Blaster, the Rebooter

Chronicle

On 11 August 2003 Blaster began exploiting the Windows DCOM RPC buffer overflow that bulletin MS03-026 had fixed a month earlier. Infected machines showed a countdown and rebooted endlessly, while the worm got ready to SYN-flood windowsupdate.com, the very site the cure came from. Its code carried a message telling Bill Gates to stop making money and fix his software. Infections peaked on 13 August.

Lesson learned

It helped push Microsoft towards the on-by-default firewall of Windows XP SP2 and towards more insistent automatic updates.

Prayer of reparation

O Blaster, who granted us sixty seconds to save our work, teach us to keep the firewall on and never to put off the update until tomorrow. Amen.

How it is remembered

Remembered with the firewall on, port 135 closed to the outside and automatic updates left free to do their job.