Blaster (computer worm)

Blaster (computer worm)
source
Name	Blaster
Type	Computer worm
Author	Jeffrey Lee Parson
Platforms	Microsoft Windows
Date	August 2003

Blaster (computer worm). Also known as Lovsan or MSBlast, Blaster was a notable computer worm that targeted a vulnerability in Microsoft Windows operating systems in August 2003. Its rapid spread caused significant network disruption and highlighted critical flaws in software security practices. The worm's payload included a denial-of-service attack against the Windows Update website.

Overview

The Blaster worm emerged in early August 2003, exploiting a critical buffer overflow vulnerability in the Remote Procedure Call (RPC) service on Windows XP and Windows 2000 systems. This security flaw, documented in Microsoft Security Bulletin MS03-026, had been publicly disclosed weeks earlier. The worm's author, later identified as Jeffrey Lee Parson, created a variant that incorporated a backdoor. The rapid propagation of Blaster coincided with increased public awareness of cybersecurity threats following earlier incidents like the SQL Slammer worm.

Spread and impact

Blaster spread with remarkable speed across the Internet, infecting hundreds of thousands of computers within days. Its impact was felt globally, disrupting operations for corporations, government agencies, and individual users. Major institutions like Air Canada and the Maryland Department of Motor Vehicles experienced significant network outages. The worm's built-in denial-of-service attack targeted the windowsupdate.com domain, though it was largely ineffective due to Microsoft redirecting traffic. The economic impact was estimated in the hundreds of millions of dollars due to lost productivity and remediation costs.

Technical details

The worm exploited the DCOM RPC vulnerability on TCP port 135. Upon infection, it would attempt to propagate to other vulnerable machines and also open a backdoor on port 4444, allowing for remote control. A notable feature of its code was a message embedded in the executable directed at Bill Gates: "I just want to say LOVE YOU SAN!!" The worm also contained logic to launch a SYN flood against the Windows Update servers on specific dates. Analysis by organizations like the SANS Institute and CERT Coordination Center detailed its replication and payload mechanisms.

Removal and mitigation

Microsoft responded by re-issuring patches and providing a dedicated removal tool. System administrators were urged to apply the patch from MS03-026 and block ports 135 and 4444 at firewall perimeters. The United States Department of Homeland Security and the FBI issued alerts advising on containment procedures. Antivirus companies such as Symantec and McAfee quickly updated their signature-based detection databases. Manual removal involved terminating specific processes and deleting registry entries, steps widely disseminated by tech media like CNET.

Aftermath and legacy

The arrest and subsequent guilty plea of Jeffrey Lee Parson brought significant attention to the legal consequences of malware creation. The Blaster outbreak served as a catalyst for improving patch management strategies across the software industry. It directly influenced the development of more automated update services like Windows Server Update Services. The worm is frequently studied alongside Code Red and Nimda in computer science curricula as a classic example of a network worm. Its legacy persists in shaping modern incident response protocols and international cooperation on cybercrime.

Category:Computer worms Category:2003 software Category:Microsoft Windows security