HomeIncident library
Incident library

INCIDENT REPLAY · 2003-01-25

SQL Slammer enterprise disruption (Bank of America ATMs, Continental, Seattle 911)

A 376-byte UDP worm against SQL Server saturated networks worldwide within minutes; reported effects included most of Bank of America's ATMs going offline, airline check-in delays and a 911 dispatch centre reverting to paper.

Required flowACL / firewall ruleCatalog confidence: low

A reconstruction, not the operator's network. Hammerhead's authors rebuilt the change from the public record as a small network of their own. No configuration here is the operator's. What follows is what the tool reported on that reconstruction; it is not a claim that the tool would have prevented the outage.

What happened

Who: Many; reported victims include Bank of America, Continental Airlines, Washington State 911 and the Davis-Besse nuclear plant

The summary at the top is paraphrased from the sources below. Hammerhead's catalog rates its confidence in this account low.

Sources

What the public record says

  • A 376-byte UDP worm against SQL Server saturated networks worldwide within minutes; reported effects included most of Bank of America's ATMs going offline, airline check-in delays and a 911 dispatch centre reverting to paper.
  • Who: Many; reported victims include Bank of America, Continental Airlines, Washington State 911 and the Davis-Besse nuclear plant

What the reconstruction assumed

Decided by Hammerhead's authors to build a network that runs. None of it describes the operator's network.

Everything below is ours.

  • The family template (tools/replays/gen_family_policy.py): UNTRUSTED-1 (the untrusted zone) reaches DB-TIER-1 (the database tier) through DMZ-FW-1 (the firewall between the untrusted zone and the database tier), which filters inbound on its outside interface. The intent file names the flow: SQL resolution is not reachable from untrusted zones on udp/1434.
  • Not a change. UDP 1434 reachable from an untrusted zone is written as an isolation rule and run against the healthy configuration; the ACL permits it, which is what let the worm in.
  • Cisco IOS syntax and stand-in address space throughout. A reconstruction, not any operator's configuration.

What Hammerhead said

Each run below is pinned by Hammerhead's replay tests at commit 0ee9732: the verdict and the quoted text are checked against the tool's output, and a run that disagrees fails the test. Reason lines are copied verbatim; a pinned line can be part of a longer reason. Every preflight run uses --max-blast-radius 100, so a change is never counted as caught merely because it touched many devices of a small network.

no change: the isolation rule against the healthy configuration

now: fail

On the reconstruction, hammerhead preflight on a before and an after snapshot with --policy @slammer_2003/policy.yaml returned fail, for the reasons below.

Reason text pinned (some reason contains each line)

  • policy gate: high/critical failure(s) on the 'after' network: SQL resolution is not reachable from untrusted zones
  • IS reachable (expected isolation)

First run, before the fixes this batch prompted

first: pass

Pinned in tests/gauntlet/replays-policy.yaml.

What changed in Hammerhead because of it

From the “What was fixed” table in Hammerhead's replay notes, where each fix landed after a failing test. “Found by” is copied as written; a family name means the batch this incident belongs to.

A flow rule names its protocol and port

Every reachability rule probed TCP/80, so an intent about SIP could not tell the push from the intended change: 7 of 11 intended changes failed on main and the one that dropped only the named port passed. protocol: and dst_port: on the rule; the policy gate's reason now carries the violation, not only the policy's name.

Found by: Required-flow family

Limits

  • The configurations are a reconstruction. Where the record is silent, the assumptions above fill the gap; if one is wrong, the replay is wrong in that respect.
  • A verdict describes the reconstructed network's converged state. Timing, traffic load, and anything a device does that no configuration states, such as software reacting to a health check or a firmware bug, are outside it.
  • A pass is reported as a pass. A fail says a gate fired on the reconstruction, nothing more.
  • Why the catalog counts this outage as partly in scope: Not a change-caused outage, but 'UDP 1434 reachable from untrusted zones, or via a path that bypasses the firewall' is a standing ACL-audit and segmentation finding.

Imported from docs/replays/slammer-2003/FACTS.md and the replay manifests in the Hammerhead repository at commit 0ee9732.