A worm is malware that spreads on its own, with no user clicking anything. Such outbreaks are uncommon, but three of them are documented in detail by credible sources: the Morris worm (1988), SQL Slammer (2003) and WannaCry (2017). This post reads those records for lessons. It does not claim a new worm is coming.
What the records say
Morris, November 1988. A GAO report dated 12 June 1989 says the program infected up to 6,000 computers and disrupted most of the nation's major research centers within hours. University experts removed it at most sites within 2 days. It caused lost processing and staff time but no permanent damage, and GAO noted that minor changes to the program could have caused widespread damage. GAO found no Internet focal point for security issues and difficulty distributing fixes, and agencies went on to create computer emergency response centers.
Slammer (Sapphire), January 2003. CAIDA's analysis found at least 74,856 distinct infected addresses in the first 30 minutes, a lower bound. Early on the infected population doubled every 8.5 seconds, and it infected more than 90 percent of vulnerable hosts within 10 minutes. CAIDA concluded that human response is too slow for a worm like this, so defences must be automatic, and that filtering on the worm's port came too late to limit the spread.
WannaCry, 12 May 2017. CISA's alert, last revised 7 June 2018, says the dropper spreads using the MS17-010 (EternalBlue) SMBv1 exploit. After installing, it scans local network ranges and, if port 445 answers, exploits the SMBv1 flaw (CVE-2017-0144 is the EternalBlue vulnerability). Microsoft had released the MS17-010 update on 14 March 2017, two months earlier.
What the three have in common
Each used a flaw that already had a fix or a known weakness. Each moved faster than humans could react. Each was slowed by basic hygiene: patching, closing unneeded network services, and segmentation.
How to check if you are exposed
Look for the services that worms favour: old file sharing and remote service protocols reachable from untrusted networks.
nmap -p 445,139 --open 10.0.0.0/24
Run this only on networks you own. On Windows, CISA's alert advises disabling SMBv1 where patching is not possible.
What to do now
- Patch internet and internal facing services by exposure and exploitation status. Gold lists known exploited vulnerabilities on its KEV page.
- Disable SMBv1 and block TCP 445 and 139 and UDP 137 and 138 at network boundaries, as CISA advises, weighing the effect on file sharing.
- Segment networks so an infected host cannot scan the whole estate.
- Apply least privilege: CISA says no users should have administrative access unless absolutely needed.
- Test backups. CISA's advice is to test them "to ensure they work correctly upon use."
- Practise isolating a segment quickly. Slammer shows that minutes matter.
How this could have been avoided
WannaCry exploited a flaw patched two months before. Faster patching of exposed SMB, disabling SMBv1 and internal segmentation each break the chain. For Slammer and Morris, the lessons were the same: unpatched services and a flat network.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What did CAIDA find about how fast Slammer spread?
It infected more than 90 percent of vulnerable hosts within 10 minutes, and early on the infected population doubled every 8.5 seconds.
How long before WannaCry had the MS17-010 fix been released?
Microsoft released it on 14 March 2017, about two months before 12 May 2017.
