Sasser 2004: The Worm That Needed No Click and a Teenager Behind It
In April 2004 Sasser crashed computers worldwide with no user action. An 18-year-old German who wrote it at 17 was caught after a bounty tip. The story of a self-spreading worm.
On 30 April 2004, a worm began to spread that did not arrive in an email and did not ask anyone to open anything. Computers that were connected to the internet and missing one specific Windows update were found and infected automatically. Infected machines crashed and restarted in a loop. The worm was called Sasser, and within days, its author was in custody. He had just turned 18, and had written the worm while still 17.
A flaw patched a few weeks earlier
Sasser exploited a vulnerability in the Local Security Authority Subsystem Service, or LSASS, a core component of Windows. A buffer overflow in the way it handled certain requests allowed an attacker to run code remotely. Microsoft released a fix on 13 April 2004, in security bulletin MS04-011, and described it as critical. The worm appeared a little more than two weeks later.
That interval was short, and it carried a message. Attackers could now study a patch, work out what it fixed, and build an exploit quickly, a process called patch reverse engineering. The old habit of installing updates at leisure was becoming dangerous.
How Sasser worked
Unlike the email worms that preceded it, Sasser required no human action. An infected computer generated random internet addresses and tried to connect to each one on TCP port 445, which Windows used for file sharing. If it found a vulnerable machine, it sent the exploit, then told the victim to download a copy of the worm from the infected computer.
The side effect was the one users noticed. The exploit often crashed the LSASS service, and Windows responded with a message that it would shut down in 60 seconds. After a reboot, the cycle started again. People could not even stay connected long enough to download the fix.
Reports of disruption came from many places. Airlines, banks, and public bodies were among the organisations that said they had been affected, with accounts of some flights being cancelled and offices closing for a time. As with other worms of this period, estimates of total costs varied widely and are not reliable enough to repeat as facts. What is clear is that a large number of unpatched home and business computers went down, and the fixes were slow to reach them.
The reward program and the arrest
In November 2003, after Blaster and other outbreaks, Microsoft had announced the Anti-Virus Reward Program, which offered 250,000 dollars for information leading to the arrest and conviction of the authors of certain viruses and worms. Sasser was the first major test.
Within a week, people who knew the author contacted Microsoft. German police arrested Sven Jaschan on 7 May 2004. He was a student from a village in Lower Saxony, and he confessed to writing Sasser. He also admitted to authorship of the Netsky worm family, which had been spreading by email in the preceding months. The informants, who were reported to be acquaintances of his, shared the reward.
Because Jaschan was under 18 when he wrote the worms, he was tried under juvenile rules. In July 2005, a German court gave him a suspended sentence of 21 months, with 30 hours of community service. Many observers thought it light, given the scale of the damage. Others noted that the law at the time had limits, and that Jaschan was a very young offender with no gain from the attack.
The case also raised a question that courts and lawmakers still wrestle with: how to treat young offenders whose code causes global harm. Jaschan had no apparent financial motive, and he was a minor when he wrote the worms, so the juvenile system applied. The episode left a mixed impression: a clear demonstration that teenagers can cause enormous disruption, and an equally clear one that the usual tools of criminal law were not designed for the scale of such harm.
Why it mattered
- Zero-click spread. The user no longer had to make a mistake. A machine with an open port and a missing patch was enough.
- Shrinking time to exploit. The path from patch to exploit was getting shorter every year.
- Safe defaults. Windows XP Service Pack 2, released in August 2004, turned on the built-in firewall by default, which blocked many inbound connections that worms had used.
- Bounties work. The reward drew out informants quickly, a concept later reused in security bounty programmes for vulnerabilities.
Two teenagers, one lesson
Blaster in 2003 and Sasser in 2004 were both associated with teenage authors, and both did far more damage than the people behind them probably imagined. It is a pattern that repeats in cybercrime. Simple tools, public exploit details and a global audience can turn an experiment into an international incident.
The lesson for site owners today
If a service on your server is reachable, a worm-like scanner will find it. Automation changed the question from "will an attacker target me?" to "will my server be found while it is vulnerable?". The answer depends on how fast you patch and how little you expose.
- Install critical security updates quickly, ideally within days.
- Close ports and disable services that you do not use.
- Turn on automatic updates for the CMS, plugins and operating system where appropriate.
- Keep a recent backup, so that a bad update or compromise can be undone.
For heavier workloads, a dedicated server gives you the whole machine.
Practical support
Our VPS and dedicated servers are delivered by the team within 24 hours, and you can configure the firewall and updates to match your needs. For managed plans, the security page explains how we think about keeping servers current.
