Sasser Worm: Creation History and Global Consequences

22 years ago, a German schoolboy named Sven Jaschan created the Sasser network worm, which triggered a massive epidemic of malicious software. The virus caused colossal financial damage, although it did not initially aim for economic destruction.

Infection Mechanism

The worm exploited a vulnerability in Microsoft Windows' LSASS service, spreading automatically without user interaction. To transfer files, it created an FTP server on port 5554 and generated a cmd.ftp script to download the virus from infected machines.

The target selection algorithm used 128 threads, significantly reducing system performance. IP addresses of recent infection attempts were saved in win.log, with new addresses generated using random offsets.

Global Consequences

The paralysis of millions of computers affected airlines, banks, government agencies, and hospitals worldwide. British Airways and Delta Air Lines canceled flights, while the Finnish bank Samp temporarily closed all its branches.

• Constant reboots due to lsass.exe errors made normal infrastructure operation impossible
• Taiwan's Computex exhibition and one-third of post offices were shut down
• Government hospitals in Hong Kong lost connectivity, and railways in Australia halted operations

The total damage caused by the worm is estimated at approximately $18 billion USD.

Creator's Fate

The author was 17 years old when he was arrested in May 2004 with the help of informants. Microsoft paid a reward of $250,000 for assistance in capturing the hacker.

In July 2005, the court in Verden found Jaschan guilty of computer sabotage. He received a suspended sentence of 1 year and 9 months with a probation period of 3 years and community service.

The court determined that profit motive was not proven, considering the teenager's actions as a form of self-expression.