Scourge · April 30 2004

The Scourge of Sasser

Chronicle

On 30 April 2004 Sasser appeared, a worm that didn't even need a click: being online with a copy of Windows lacking MS04-011, released seventeen days earlier for a buffer overflow in LSASS, was enough. Infected machines crashed and rebooted over and over. Airlines, coastguards, railways and businesses around the world were disrupted. Its author, young German Sven Jaschan, was caught thanks to informants drawn by a reward offered by Microsoft.

Lesson learned

It confirmed that the gap between patch and worm was shrinking to days, and that a reward can persuade those who know the author to talk.

Prayer of reparation

O Sasser, who came in without knocking, shorten the time between a patch and its installation and watch over the computers left online without defences. Amen.

How it is remembered

Remembered by applying critical patches within days and never connecting a freshly installed system to the Internet before updating it.