Nimda worms slows, some see continued spread

Despite a splashy entrance and a comprehensive set of attacks, the Nimda worm that spread quickly across the Internet Tuesday has slowed its pace Wednesday and is no longer substantially affecting network traffic, according to a number of Internet monitoring firms. Not all groups monitoring Nimda's spread, however, are so ready to write it off.

Data from network monitoring companies Matrix.net Inc. and Internet Traffic Report.com indicate that while Nimda had a serious effect on the Internet Tuesday, its impact has lessened substantially Wednesday. Nimda caused a drop in availability of about 2.5 percent among the nearly 1,300 Web sites Matrix.net regularly monitors for its data. While these sites are generally about 96 percent available and the average for the week since the terrorist attacks has been about 94 percent, the monitored sites were only about 91 percent to 92 percent available from early Tuesday until early Wednesday.

Internet Traffic Report.com's data also bears out Nimda's impact. Among other things, the site measures the average response time of Web servers to requests for information. Over the past week, the average response time has been 223 milliseconds. Beginning Tuesday morning, the time that Nimda appeared on the Web, response times shot up beyond that average, hitting as high as 700 milliseconds. Response times are back around 200 milliseconds midday Wednesday.

This data indicates that "this one is done for" unless the worm has left behind "zombies" -- agents to take over PCs in the future, according to Peter Salus, chief knowledge officer at Matrix.net. Rather than inflicting a major hit on Internet performance, "it looks much more like ... an annoyance," he said. Salus did, however, caution that variants of the worm could arise at any time, with possibly more success or severity.

Not everyone who has been monitoring the worm's outbreak is sure that it has ceased to be a threat.

"As far as we can tell it's still propagating," said Roman Danyliw, an Internet security analyst at the government-funded computer security group CERT/CC (Computer Emergency Response Team/Coordination Center). Nimda is still spreading and is still a threat according to CERT/CC's data, Danyliw said.

Danyliw also warned against the possibility of variants of the worm.

"At any point in the future, variants are very possible," he said.

Even if the spread of Nimda is slowing, the worm still poses a real threat to the Internet because so many systems continue to be unpatched, Danyliw said. Nimda spreads by exploiting security holes in Microsoft Corp.'s Internet Information Server (IIS), Outlook e-mail client and Internet Explorer Web browser. Like the Code Red worm that caused havoc on the Internet in July and August, Nimda exploits vulnerabilities that have long been known and have long had patches available to fix them.

Getting the information about patches and how to apply them to the proper people is a difficult task, Danyliw said, and CERT/CC is "definitely grappling with that problem."

The worm was first identified in the United States around 9 a.m. ET Tuesday. The coincidence of that time and day with last Tuesday's terrorist attacks initially led some to believe that the worm might be part of a cyberattack against the United States. That notion was dispelled by Attorney General John Ashcroft at a news conference held midafternoon Tuesday in which he said there was no reason at the time to believe that the two events were related.

Though Nimda's origin is not yet known, "it's the sort of thing you get from a group of crazed teenagers," not terrorists, according to Matrix.net's Salus. That the worm targeted the newest versions of software from only one vendor indicates that it was not designed as a terrorist tool, he said. The apparent quick end to Nimda's work may drive the worm's writers to create a new worm, or alternately may cause them to lose interest, he said.

The Internet, however, survived Code Red and has, it seems, survived Nimda, as well, Salus said.

"These are nuisances rather than debilitating events," he said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Sam Costello

Computerworld
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?