The top speed of flash worms

Flash worms follow a precomputed spread tree using prior knowledge of all systems vulnerable to the worm's exploit. In previous work we suggested that a flash worm could saturate one million vulnerable hosts on the Internet in under 30 seconds [18]. We grossly over-estimated. In this paper, we revisit the problem in the context of single packet UDP worms (inspired by Slammer and Witty). Simulating a flash version of Slammer, calibrated by current Internet latency measurements and observed worm packet delivery rates, we show that a worm could saturate 95% of one million vulnerable hosts on the Internet in 510 milliseconds. A similar worm using a TCP based

• Type: Conference
• Year: 2004
• Where: WORM
• Authors: Stuart Staniford, David Moore, Vern Paxson, Nicholas Weaver
• Keywords: Flash Worm, Security Privacy, Vulnerable Hosts, Worm, WORM 2004