Nimda attack seems to slow

Despite a splashy entrance and a comprehensive set of attacks, the Nimda worm that spread quickly across the Internet Tuesday has slowed its pace Wednesday and is no longer substantially affecting network traffic, according to a number of Internet monitoring firms. Not all groups monitoring Nimda's spread, however, are so ready to write it off.

Data from network monitoring companies Matrix.net and Internet Traffic Report indicate that while Nimda had a serious effect on the Internet Tuesday, its impact has lessened substantially Wednesday. Nimda caused a drop in availability of about 2.5 percent among the nearly 1,300 Web sites Matrix.net regularly monitors for its data. While these sites are generally about 96 percent available and the average for the week since the terrorist attacks has been about 94 percent, the monitored sites were only about 91 percent to 92 percent available from early Tuesday until early Wednesday.

Internet Traffic Report's data also bears out Nimda's impact. Among other things, the site measures the average response time of Web servers to requests for information. Over the past week, the average response time has been 223 milliseconds. Beginning Tuesday morning, the time that Nimda appeared on the Web, response times shot up beyond that average, hitting as high as 700 milliseconds. Response times are back around 200 milliseconds midday Wednesday.

This data indicates that "this one is done for" unless the worm has left behind "zombies" -- agents to take over PCs in the future, according to Peter Salus, chief knowledge officer at Matrix.net. Rather than inflicting a major hit on Internet performance, "it looks much more like ... an annoyance," he said. Salus did, however, caution that variants of the worm could arise at any time, with possibly more success or severity.

Not everyone who has been monitoring the worm's outbreak is sure that it has ceased to be a threat.

"As far as we can tell it's still propagating," said Roman Danyliw, an Internet security analyst at the government-funded computer security group CERT/CC (Computer Emergency Response Team/Coordination Center). Nimda is still spreading and is still a threat according to CERT/CC's data, Danyliw said.

Danyliw also warned against the possibility of variants of the worm.

"At any point in the future, variants are very possible," he said.

Even if the spread of Nimda is slowing, the worm still poses a real threat to the Internet because so many systems continue to be unpatched, Danyliw said. Nimda spreads by exploiting security holes in Microsoft Corp.'s Internet Information Server (IIS), Outlook e-mail client and Internet Explorer Web browser [See "Major new worm poses serious threat," Sept. 18]. Like the Code Red worm that caused havoc on the Internet in July and August, Nimda exploits vulnerabilities that have long been known and have long had patches available to fix them.

Getting the information about patches and how to apply them to the proper people is a difficult task, Danyliw said, and CERT/CC is "definitely grappling with that problem."

The worm was first identified in the United States around 9 a.m. ET Tuesday. The coincidence of that time and day with last Tuesday's terrorist attacks initially led some to believe that the worm might be part of a cyberattack against the United States. That notion was dispelled by Attorney General John Ashcroft at a news conference held midafternoon Tuesday in which he said there was no reason at the time to believe that the two events were related.

Though Nimda's origin is not yet known, "it's the sort of thing you get from a group of crazed teenagers," not terrorists, according to Matrix.net's Salus. That the worm targeted the newest versions of software from only one vendor indicates that it was not designed as a terrorist tool, he said. The apparent quick end to Nimda's work may drive the worm's writers to create a new worm, or alternately may cause them to lose interest, he said.

The Internet, however, survived Code Red and has, it seems, survived Nimda, as well, Salus said.

"These are nuisances rather than debilitating events," he said.

The IDG News Service is a Network World affiliate.