Slammer Source Code Provides Clues

Signatures within the worm's source code indicate a Chinese cracking group may be responsible for writing the code.

As corporate IT departments go about the business of cleaning up their networks, there are strong indications that the SQL Slammer worm that brought down portions of the Internet over the weekend is based on the work of an obscure Chinese cracking group.

Signatures within the worms source code indicate that a group known as the Honker Union of China—also known as the Hacker Union of China—may be responsible for writing the code, according to security experts who have analyzed the code. However, experts caution that although they are certain of the codes origins, someone else may have actually loosed the worm on the Internet.

"Were 100 percent certain this was based on the CNHonker code," said Chris Rouland, director of the X-Force research team at Internet Security Systems Inc., in Atlanta. "But that doesnt mean they released it."

Although the Honker Union has not yet claimed responsibility for the worm, it has posted on its Web site in the past several versions of an exploit for the vulnerability used by Slammer. The group has been quite active in pro-Chinese and anti-American hacking activity in the past and was involved in a U.S.-Chinese cyber-skirmish that erupted in early 2001.

The worm did most of its damage in Asia, particularly South Korea, which was effectively taken off the Internet for several hours Saturday. And some experts have pointed out that the Slammer worm was released on the anniversary of a major offensive in the Korean War that began pushing back Communist Chinese forces that had penetrated South Korea.

Despite the possible political motivations behind the worms release, White House security officials downplayed the idea that this was an act of terrorism.

"Wed rather characterize terrorism as something that physically kills people," said Marcus Sachs, director of communications infrastructure protection in the Office of Cyberspace Security in Washington. "There was no lasting damage done to the infrastructure. Wed like to see the term cyber-terror dropped."