Sasser worms slowing the Internet
Connecting state and local government leaders
The Sasser family of worms appears to be slowing down Internet traffic, making some destinations unavailable.
The Sasser family of worms appears to be slowing down Internet traffic and making some destinations unavailable, according to observations by Keynote Systems Inc., a Web performance management company.
'Reachability has crept down and we saw a spike in that at [8 p.m. Eastern Time, Tuesday], accompanied by an upward spike in packet loss,' said Kirsten Husak, a consulting manager in the San Mateo, Calif., company's professional services division. 'It is definitely more than normal Internet variability.'
But the worms' impact is not as severe as some past outbreaks, such as last year's Slammer. 'This doesn't seem to be affecting Web sites nearly as much.'
Sasser, which exploits a Microsoft vulnerability announced with the release of a patch in mid-April, first appeared May 1 and began spreading rapidly. It is believed to be the first self-executing worm and does not require any recipient action to propagate. It instructs vulnerable systems to download and execute the viral code. By May 3, four variants of the worm were in the wild, and thousands of computers had been infected. The number of infected computers has since been estimated at more than 1 million.
Ken Dunham, director of malicious code for iDefense Inc. of Reston, Va., said the timing of the worm's release was not arbitrary.
'A troubling trend is the release of new network attack worms on a Friday night and Saturday morning,' Dunham said. 'It's the end of the workweek for mainstream security professionals. It's the perfect time to strike, and the bad guys know it.'
Slammer also was released over a weekend, as was a more recent worm, Witty.A.
Since May 2, Keynote has seen a slow but steady increase in latency. Latency can be caused by network congestion and by the unavailability of some Domain Name Service servers and routers. The number of key reachable destinations (DNS servers, international connection points, exchange points and other key servers) has stabilized, but still was below normal this afternoon.
'My prediction is that we are going to be seeing this at some level for quite a while,' Husak said. 'I do expect it to smooth out in a matter of weeks.'