Scourge · September 18 2001

The Scourge of Nimda, Admin Backwards

Chronicle

On 18 September 2001, a week after 9/11, Nimda appeared, its name 'admin' spelled backwards. It spread every way it could: by email, through open network shares, from compromised websites to their visitors, via an IIS directory traversal and through the backdoors left by Code Red II. Within hours it became one of the fastest worms of its time, and the traffic from its scanning and mailing caused outages around the world.

Lesson learned

It showed that an attack can use many doors at once and that closing just one is not enough: defence has to be layered, and compromised machines must be truly cleaned.

Prayer of reparation

O Nimda, who turned the admin and his day upside down, close our open shares and the backdoors of earlier worms, so that no evil enters through five doors at once. Amen.

How it is remembered

Remembered by closing world-writable shares, rebuilding compromised machines from scratch and not trusting a website just because you know it.