Open Source: A false sense of security
eWeek | at | by Mike
In late July, researchers found several flaws in the OpenSSL tool kit, which is commonly used for secure transmissions on Apache servers. About six weeks later, someone released a worm called Slapper that exploited the vulnerability and not only installed a back door on each infected server but also turned machines using OpenSSL into a waiting army of zombies by dropping in a DDoS (distributed-denial-of-service) tool kit as well.
The infected machines can communicate with one another via a private, peer-to-peer network. Security experts predicted that it was only a matter of time before someone used the thousands of compromised servers to launch a devastating DDoS attack.