11:55 AM -- Among other things, Andy Warhol is known for uttering, "In the future, everyone will be world-famous for 15 minutes." The point is not lost on virus writers.
They often think about the scalability of an attack, given the three primary focal points of a large-scale worm. First is its ability to propagate quickly. The second is how long it stays in existence. The last crucial point is how much damage it does. A number of years back a paper was written on the concept of a Warhol worm. Its major finding: A worm could spread across the accessible Internet in less than 15 minutes.
The major incentive for writing a Warhol worm, or Flash worm as its sometimes called, is to help with the first two points (the latter issue depending on the payload, not the attack vector itself).
It's also obvious from the graph that Samy was still on a growth cycle. Had the machine it resided on stayed up and the worm been allowed to propagate naturally, it would have continued to grow well beyond where it ended. That means not only does it hold the record for most infections in the history of any Internet worm, but it also solves the first critical issue: the speed of the worm as it traverses the Internet.
The second issue centers on how long the worm stays in existence. From start to finish, the worm lasted around 20 hours, nowhere near the one of the other Warhol worms, SQL Slammer. Still, 20 hours was enough time for Samy to spread globally, and to make good on its fast-propagation intentions.
That's some serious fame we're talking, and it will likely last longer than 20 hours (in this post-Warhol era). You can bet the aftermath of such an infection will be quite a bit more damaging.
RSnake is a red-blooded lumberjack whose rants can also be found at Ha.ckers and F*the.net. Special to Dark Reading