60 seconds to reboot: how Blaster and Sasser exposed the risks of a disabled Windows firewall

In August 2003 the Blaster worm exploited an unpatched DCOM RPC vulnerability in Windows XP and 2000, forcing systems to reboot after 60 seconds. Nine months later Sasser used a similar LSASS flaw released only 17 days earlier, again triggering automatic reboots. Both worms spread through port 135 or direct network exposure because the built-in firewall remained off by default. The attacks affected hundreds of thousands of machines and disrupted banks, airlines and government networks worldwide. Microsoft responded with Windows XP Service Pack 2, which enabled the firewall at boot time. The two teenage authors were later identified and received light sentences. The incidents highlighted how quickly unpatched systems could be compromised when default network protections were absent.

HabrOctober 31, 2026Translated from Russian

Read at source

Sitting at a computer with no files opened or downloads started, users in August 2003 suddenly saw a window announcing that Windows would shut down in 60 seconds. The machine rebooted, and the cycle repeated minutes after restart. The same screen appeared again in April 2004, this time caused by a different worm. Blaster and Sasser were separated by nine months yet produced identical symptoms on Windows XP and Windows 2000.

Blaster emerged on 11 August 2003. Within days roughly 423 000 computers were believed infected. The worm targeted the DCOM RPC service through port 135, a port most users never knew existed. Microsoft had issued a patch for the flaw on 16 July, 25 days before the worm appeared. Once inside, Blaster crashed the RPC service; Windows itself then scheduled the 60-second reboot. The worm carried two messages in its code: a declaration of love that earned it the name Lovsan and a direct address to Bill Gates demanding he stop making money and fix the software.

Nine months later Sasser appeared on 30 April 2004. Its patch had been released only 17 days earlier. The worm struck the LSASS service, again causing Windows to initiate an automatic reboot. Organisations hit included Agence France-Presse, Finnish bank Sampo, Australian bank Westpac, Taiwan’s postal service, the UK coastguard and Delta Airlines. In many cases the worm arrived before administrators finished deploying the patch.

Both worms succeeded because the Windows firewall was disabled by default for compatibility reasons. The interval between patch release and worm appearance had been shrinking for years; Blaster arrived after 25 days, Sasser after 17. Microsoft eventually shipped Windows XP Service Pack 2 in August 2004, turning the firewall on at boot and protecting all network interfaces by default. Subsequent analysis showed systems running SP2 were almost never infected by either worm.

The authors were two teenagers. German student Sven Jaschan wrote Sasser and was sentenced to 21 months’ probation plus community service. American Jeffrey Lee Parson released a variant of Blaster and received 18 months in prison. Neither sought financial gain.

The 60-second reboot window disappeared not because users became more vigilant, but because the network door the worms used was closed by default from the moment the operating system started.

Blaster Sasser Windows XP Sven Jaschan Jeffrey Lee Parson Windows XP SP2

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Malware & Botnets

Malware & Botnets

Fake GitHub Repositories Mimicking PS5 Game Launchers Infect Windows PCs with Trojans

Researchers at NordVPN have uncovered a malware campaign using fake GitHub repositories that impersonate tools for running PlayStation 5 games on Windows computers. The repositories, named AnyPS5 and Kyttyps5, distribute ZIP archives containing executable files that initiate a multi-stage infection process. Upon execution, the loader checks system memory size, detects virtual machines or cloud servers, and verifies the presence of a physical GPU before proceeding. If the environment appears legitimate, it adds exclusions to Microsoft Defender and decrypts the main payload, believed to be an infostealer targeting passwords and sensitive data. A cleanup script also runs after approximately two minutes to delete components, though traces may remain detectable. NordVPN shared its findings with Tom’s Hardware, emphasizing the need to verify repository owners before running such tools.

AntiMalwareOct 30, 2026Translated from Russian

Malware & Botnets

Yoba Campaign Uses Signed ChatGPT and Claude Binaries for DLL Sideloading and XMRig Deployment

Researchers at Check Point Research have uncovered the Yoba malware campaign that distributes fake desktop clients for ChatGPT and Claude through GitHub repositories. The attackers bundle legitimate signed executables from OpenAI and Anthropic with a malicious DLL that gets loaded via classic sideloading. Once executed, the loader establishes persistence using the Windows Task Scheduler and retrieves additional payloads through Telegram, DNS over HTTPS, and the Catbox file hosting service. The campaign ultimately deploys the XMRig cryptominer, which pauses mining activity when user interaction is detected to avoid detection. No compromise of OpenAI or Anthropic infrastructure was found; the attackers simply repurpose the companies' signed binaries and reputation. The operation primarily targets home users and small-to-medium businesses with Windows systems.

AntiMalwareOct 28, 2026Translated from Russian

Malware & Botnets

uCreator Spyware Infiltrates Modified Telegram, WeChat and GCash Builds on Android

Security researcher Ovi has published a detailed analysis of uCreator, also known as YingGai, a commercial Android spyware platform designed for surveillance and remote app control. The malware intercepts messages, verification codes and account data directly inside legitimate applications without requiring root privileges. Infection vectors include tampered Telegram, WeChat and GCash APKs distributed through unofficial sources, as well as the Onion Box container that launches the target app inside a controlled environment. Once active, uCreator hooks into the host process, reads Telegram’s local message database through client interfaces, captures two-factor authentication passwords and hides its own session from the user. The operation is supported by cloud-based command panels and exposed GitLab repositories that revealed server-side code and development history. Compatibility problems have been noted on Android 17, and the total number of victims remains unknown.

AntiMalwareOct 26, 2026Translated from Russian