The SQL Slammer is a computer virus that began in January 2003 and caused a denial of service on some Internet hosts, significantly slowing general Internet traffic. It spread rapidly and within 10 minutes he infected most of his 75,000 victims. Although the program is called the “SQL Slammer Worm”, it does not use the SQL language. His two buffer overflows exploited his bug in SQL Server, Microsoft’s flagship database product. The worm was based on proof-of-concept code demonstrated at a Black Hat briefing by David Litchfield, who first discovered the buffer overflow vulnerability that the worm exploits. This is a small code that just generates random IP addresses and sends itself to those addresses. The main symptom of a SQL Slammer infection is increased outbound traffic to UDP 1434. Worms fit in a single packet, so a worm can spread quickly when a computer launches an infected packet.
Working:
SQL Slammer Virus follows steps for infecting the system:
- It goes to computer memory without saving itself in the memory and without creating or modifying, any files in the system.
- Then load a small piece of malicious code to generate IP addresses and infect other computers.
- It starts sending multiple packets containing the worm’s code and causes a DDoS attack on the port.
Functions and Effects:
Below are some Functions and Effects of the SQL Slammer Virus:
- It generates a lot of network packets, which leads to the overloading of servers and slowing down network traffic.
- It goes to computer memory without saving itself in the memory and without creating or modifying, any files in the system.
- It infects a large percentage of victims’ computers within ten minutes.
- Microsoft SQL Server 2000 is mostly impacted by the SQL Slammer virus.
- SQL slammer Virus can make the email service Fail.
- SQL slammer Virus is able to block the network.
Preventive Measures:
Below are some preventive measures to protect the system from the SQL Slammer Virus:
- It can be removed by rebooting an infected system.
- Use powerful updated antivirus and another security suite for protecting the system from SQL slammer virus because Antivirus programs and firewalls can detect and remove it easily.
- Always up-to-date with your software, and operating system.
- Back up your files regularly to reduce data loss in case of formatting.
