Nimda worms slows, some see continued spread

Despite a splashy entrance and a comprehensive set of attacks, the Nimda worm that spread quickly across the Internet Tuesday has slowed its pace Wednesday and is no longer substantially affecting network traffic, according to a number of Internet monitoring firms. Not all groups monitoring Nimda's spread, however, are so ready to write it off.

Data from network monitoring companies Matrix.net Inc. and Internet Traffic Report.com indicate that while Nimda had a serious effect on the Internet Tuesday, its impact has lessened substantially Wednesday. Nimda caused a drop in availability of about 2.5 percent among the nearly 1,300 Web sites Matrix.net regularly monitors for its data. While these sites are generally about 96 percent available and the average for the week since the terrorist attacks has been about 94 percent, the monitored sites were only about 91 percent to 92 percent available from early Tuesday until early Wednesday.

Internet Traffic Report.com's data also bears out Nimda's impact. Among other things, the site measures the average response time of Web servers to requests for information. Over the past week, the average response time has been 223 milliseconds. Beginning Tuesday morning, the time that Nimda appeared on the Web, response times shot up beyond that average, hitting as high as 700 milliseconds. Response times are back around 200 milliseconds midday Wednesday.

This data indicates that "this one is done for" unless the worm has left behind "zombies" -- agents to take over PCs in the future, according to Peter Salus, chief knowledge officer at Matrix.net. Rather than inflicting a major hit on Internet performance, "it looks much more like ... an annoyance," he said. Salus did, however, caution that variants of the worm could arise at any time, with possibly more success or severity.

Not everyone who has been monitoring the worm's outbreak is sure that it has ceased to be a threat.

"As far as we can tell it's still propagating," said Roman Danyliw, an Internet security analyst at the government-funded computer security group CERT/CC (Computer Emergency Response Team/Coordination Center). Nimda is still spreading and is still a threat according to CERT/CC's data, Danyliw said.

Danyliw also warned against the possibility of variants of the worm.

"At any point in the future, variants are very possible," he said.

Even if the spread of Nimda is slowing, the worm still poses a real threat to the Internet because so many systems continue to be unpatched, Danyliw said. Nimda spreads by exploiting security holes in Microsoft Corp.'s Internet Information Server (IIS), Outlook e-mail client and Internet Explorer Web browser. Like the Code Red worm that caused havoc on the Internet in July and August, Nimda exploits vulnerabilities that have long been known and have long had patches available to fix them.

Getting the information about patches and how to apply them to the proper people is a difficult task, Danyliw said, and CERT/CC is "definitely grappling with that problem."

The worm was first identified in the United States around 9 a.m. ET Tuesday. The coincidence of that time and day with last Tuesday's terrorist attacks initially led some to believe that the worm might be part of a cyberattack against the United States. That notion was dispelled by Attorney General John Ashcroft at a news conference held midafternoon Tuesday in which he said there was no reason at the time to believe that the two events were related.

Though Nimda's origin is not yet known, "it's the sort of thing you get from a group of crazed teenagers," not terrorists, according to Matrix.net's Salus. That the worm targeted the newest versions of software from only one vendor indicates that it was not designed as a terrorist tool, he said. The apparent quick end to Nimda's work may drive the worm's writers to create a new worm, or alternately may cause them to lose interest, he said.

The Internet, however, survived Code Red and has, it seems, survived Nimda, as well, Salus said.

"These are nuisances rather than debilitating events," he said.

Join the PC World newsletter!

Error: Please check your email address.

Struggling for Christmas presents this year? Check out our Christmas Gift Guide for some top tech suggestions and more.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Sam Costello

Computerworld

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?