[IP] Every data packet is a fully contained worm

[Dave Farber <dave@farber.net>]

------ Forwarded Message
From: Oliver Schmelzle <os@schmelzle.net>
Date: Tue, 28 Jan 2003 11:32:14 -0600
To: dave@farber.net
Subject: [for IP] Every data packet is a fully contained worm

David,

In the talk about SQLSlammer not much was said on the nature of the worm
which is quite groundbreaking. According to several reports [1][2], it
is only 376 bytes in size and can send a full copy of itself
encapsulated in a single UDP package.

You cannot beat the efficiency. No expensive three-way TCP handshake or
other high-level protocol overhead. This is a whole different ball game
than Code Red or Nimda. Each and every data packet is a fully contained
worm. We have seen the implications of this design.

Oliver

[1]http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21824
[2]http://www.techie.hopto.org/sqlworm.html


------ End of Forwarded Message

-------------------------------------
To unsubscribe or update your address, click
  http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/