The Book of Chronicles · Chapter 20

The Worm of Three Hundred Seventy Six Bytes

1. 1

   Now in the seventh month of the year two thousand and two, the house of Microsoft sent forth a patch, and its name was MS02-039; and it was proclaimed unto all the keepers of SQL Server, that they should apply it.

2. 2

   And David Litchfield spake of the flaw before the congregation at Black Hat, showing how the Resolution Service upon port 1434 would receive more than it had room for, and believe it.

3. 3

   And the keepers heard, and said: We will apply it after the change freeze. And they did not apply it.

4. 4

   And six months passed, and the patch abode in the download center, and few were they that fetched it.

5. 5

   And it came to pass on the twenty and fifth day of the first month of the year two thousand and three, being the sabbath, at the half hour after the fifth hour by Greenwich, that the Worm went forth.

6. 6

   And the Worm was three hundred seventy and six bytes, fewer than the bytes of this verse; and it came in one packet of UDP, which asketh no handshake and waiteth for no reply. It knocked once upon port 1434, and the Resolution Service opened its buffer to receive it, and the buffer was not great enough, and the bytes that overflowed were the Worm, and the Worm was now the server.

   See also Genesis 55:7

7. 7

   It wrote nothing to the disk, and it stole nothing, and it destroyed nothing; it did one thing only, which was to send itself unto random addresses as fast as the wire would bear.

8. 8

   And the smitten doubled every eight seconds and a half; and within ten minutes they were seventy and five thousand, and the backbone groaned as a bucket groaneth beneath a firehose.

9. 9

   And the ATMs of the Bank of America, thirteen thousand of them, gave out no money; and Continental Airlines cancelled flights; and the emergency dispatch of Seattle faltered; and in Korea the Internet went dark for a day.

   See also Chronicles 13:12

10. 10

    And among the smitten were the servers of Microsoft, which had written the patch; for the cobbler's children go barefoot, and the vendor's servers go unpatched.

11. 11

    And many keepers were confounded, saying: We run no SQL Server. For it was hidden within their other software as the Desktop Engine, and they knew not what they ran.

12. 12

    And the keepers rebooted, and the Worm was cast out, for it dwelt only in memory; and they joined the network again, and it returned within the minute, for its brethren were still knocking.

    See also Chronicles 15:1

13. 13

    And the elders inquired: Who wrote the Worm? And no man knoweth unto this day.

14. 14

    But the Engineers answered: Ask not who wrote the Worm; ask who read the bulletin.

15. 15

    Therefore it is written in the logs of that sabbath: A patch not installed is but a press release.

    See also Genesis 24:8 · Leviticus 8:3

16. 16

    And remember this, ye keepers: the attacker also readeth the bulletin, and he hath no change advisory board.

The Book of Chronicles, Chapter 20:1–16.