Sasser is fastest written Windows worm
The "Sasser" computer worm now plaguing computers around the world was based on a critical software flaw revealed by Microsoft just 17 days before the worm's release.
Microsoft revealed a total of 20 software bugs in a bulletin issued on 13 April and the first version of Sasser appeared on 30 April. Over the next few days this and three variants - tweaked to improve the speed of infection - succeeded in infecting many hundreds of thousands of computers worldwide.
Previously, the Blaster worm held the record for the fastest written Windows worm. It was unleashed on 11 August 2003, using a vulnerability revealed 25 days before it started to spread itself.
Yet, despite the shrinking gap between the disclosure of a bug and the appearance of a worm or virus, experts say trying keeping flaws secret would be more dangerous. A worm could cause far more damage if it were based on a vulnerability that was not widely known about, they say, as very few people would have a patch in place.
"There's a false notion that secrecy equals security," says computer security expert Bruce Schneier. "What you end up with is very fragile security - as soon as you lose your secrecy you're insecure."
