Warhol worm
|
|
A Warhol worm is an extremely rapidly propagating computer worm that spreads as fast as physically possible, infecting all vulnerable machines on the entire Internet in 15 minutes or less. The term is based on Andy Warhol's remark that "In the future, everybody will have 15 minutes of fame".
The SQL slammer worm was the first observed example of a Warhol worm. The mechanism of SQL Slammer's spread used a pseudo-random number generator seeded from a system variable to determine which IP addresses to attack next. In spite of deficiencies in the implementation of the PRNG, the randomized attack was highly effective.
According to a CAIDA-coordinated analysis of the SQL Slammer outbreak, its growth followed an exponential curve with a doubling time of 8.5 seconds in the early phases of the attack, which was only slowed by the collapse of many networks because of the denial of service caused by SQL Slammer's traffic. 90% of all vulnerable machines were infected within 10 minutes, showing that the original estimate for infection speed was roughly correct.
External links
- Warhol Worms: The Potential for Very Fast Internet Plagues (http://www.cs.berkeley.edu/~nweaver/warhol.html) by Nicholas C. Weaver
- report of CAIDA-coordinated study of SQL Slammer/Sapphire (http://www.caida.org/analysis/security/sapphire/)