60 seconds to reboot: how Blaster and Sasser exposed the risks of a disabled Windows firewall
In August 2003 the Blaster worm exploited an unpatched DCOM RPC vulnerability in Windows XP and 2000, forcing systems to reboot after 60 seconds. Nine months later Sasser used a similar LSASS flaw released only 17 days earlier, again triggering automatic reboots. Both worms spread through port 135 or direct network exposure because the built-in firewall remained off by default. The attacks affected hundreds of thousands of machines and disrupted banks, airlines and government networks worldwide. Microsoft responded with Windows XP Service Pack 2, which enabled the firewall at boot time. The two teenage authors were later identified and received light sentences. The incidents highlighted how quickly unpatched systems could be compromised when default network protections were absent.
HabrOct 31, 2026Translated from Russian