Saturday's Slammer worm was based on sample code published to help explain the threat posed by the security vulnerability that Slammer exploited, according to David Litchfield, the security expert who discovered the vulnerability.

The stunning success of the worm in spreading itself across the Internet had Litchfield questioning whether he will publish proof-of-concept (or "exploit") code in the future. Litchfield expressed his opinion that the Slammer worm was based on his proof-of-concept code in an e-mail message to the widely read bugtraq mailing list.

"On analysis of the code of the Slammer worm it is apparent that my code was used as its template," Litchfield wrote.

Many parts of the worm's code were identical to the published proof of concept code, but the worm was not simply a copy of the published example, Litchfield said.

"It (is) apparent that whoever authored the worm knew how to write buffer overflow exploits and would have been capable of doing this without using my shellcode as a template," Litchfield wrote.

The code taken from Litchfield's published exploit saved the worm's real writer "about 20 or so minutes," Litchfield wrote.

The e-mail message from Litchfield was a response to questions raised on the bugtraq list after an article was published Wednesday in the Washington Post. In that article, Litchfield suggested that, after seeing the damage wrought by Slammer, he would probably no longer publish exploit code.

Writing later Wednesday, Litchfield backtracked on his statement to the Post.

Exploit code serves an educational role in forums of computer security experts like the Blackhat Security Briefings, where Litchfield presented the SQL Server exploit and sample code in August 2002, he said.

"People who attend such conferences go with the expectation that they will get 'up to the minute' and pertinent lectures."

Providing as much information as possible about new vulnerabilities ensures that "both attendees and organizers get what they want," Litchfield wrote.

More often than not, the benefits of publishing proof-of-concept code outweighs any "bad" that comes out of it, according to Litchfield.

That position seemed to be supported by other security experts.

Writing to bugtraq Saturday, when Slammer was still spreading rapidly, Marc Maiffret, chief hacking officer of eEye Digital Security thanked Litchfield's company, Next Generation Security Software (NGSS) for discovering the worm and publishing a detailed technical write-up of it.

The IDG News Service is a Network World affiliate.