Update: Slammer worm slugs Internet, slows Web traffic
IDG News Service - A new worm that has been attacking a known vulnerability in Microsoft SQL 2000 Web servers and that has been slowing down or halting Internet traffic worldwide could prove as tricky a nemesis as security foes Code Red and Nimda, according to firms tracking the outbreak.
Half a dozen security outlets have issued bulletins describing worm W32/SQL Slammer, dubbed "Slammer." Using a buffer overflow to take over a server, the worm sends out a flood of packets, an effect similar to a denial-of-service attack.
Network Associates Inc.'s Anti-Virus Emergency Response Team (AVERT) estimates that 150,000 to 200,000 servers worldwide have already been infected.
When the attack began around 12:30 a.m. EST, packet loss across the Internet approached 20%, according to monitoring firm Matrix NetSystems Inc., in Austin, Texas. Packet loss rates are usually less than 1%.
One of the countries worst affected was South Korea, where most of the nation's fixed-line and mobile Internet users were unable to access Web sites for nearly half of the day.
"The networks of Internet service providers in South Korea were partially down from about 2:30 p.m. today," said Lee Kin Tae, a technical assistant at the Korean Computer Emergency Response Team (CERT) in Seoul. "From around that time, most people in South Korea cannot use the Internet."
Ten hours after the attack began, traffic flow was picking up, with packet loss down to around 5% by Matrix NetSystems' readings.
Recovering from the worm is easy, security firms agree: Installing Microsoft Corp.'s recently released SQL Server 2000 Service Pack 3 solves the problem. Some also recommend that systems administrators consider blocking traffic on port 1434 from unknown machines.
Firms disagree, though, on the severity of the threat posed by Slammer. Trend Micro Inc. labels the worm "destructive" and "high risk," while Symantec Corp. assesses its damage potential as "low." Network Associates Inc. and eEye Digital Security Inc., one of the first to spot and dissect the worm, both issued high-risk alerts on the worm.
While the worm may be easy to defend against, a vast number of systems remain unprotected.
"It's probably worse than it was three or four hours ago," said AVERT Vice President Vincent Gullotto, about 12 hours after the attack began. "This is not going to be cleaned up any time soon."
"[Slammer] doesn't destroy, remove, hack or extract any data," said Tom Ohlsson, Matrix NetSystems' vice president of marketing and business development. "But it's a very, very aggressive worm about self-replication."
Slammer's speed in spreading itself recalls another worm that rampaged through the Net: Code Red, a scourge that appeared in mid-2001 and infected hundreds of thousands of servers.
Despite the availability of a patch, Code Red caused $2 billion in damage, according to one research firm's estimates. New infections continued spreading more than a year after the worm's discovery, according to several vendors, as some vulnerable systems remained unprotected.
Slammer is "similar in terms of speed, but nowhere near as destructive" as Code Red, Ohlsson said.
The worm is "certainly on the same level" as Code Red in terms of the threat it poses, said AVERT's Gullotto.
A representative of the U.S. National Infrastructure Protection Center (NIPC) confirmed that the center was investigating the problems. The NIPC hasn't posted any alerts on its Web site concerning the worm or vulnerability since Microsoft first identified the weakness in July 2002.
A spokesman for the U.S. Federal Bureau of Investigation declined to comment in detail on the Internet problems, but said, "The bureau is aware a worm was attacking the Internet overnight and we are monitoring it."
The worm hit a day after South Korea's Ministry of Information and Communication (MIC) issued an emergency alert on the possibility of denial-of-service attacks, according to local media. The MIC received reports that South Korean computers were to be used as a springboard for attacks, said the country's Yonhap News Agency.
- Top 12 Laptop Bags for Mobile Pros
- Think Deleted Text Messages Are Gone Forever? Think Again
- 7 New Faces of the C-suite
- 5 Ways CIOs Can Rationalize Application Portfolios
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Five Cloud Security Concerns You Must Address Security for the cloud era should be information centric, built in, adaptive, and proactive. How can you respond to the new threat landscape...
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Alert Logic for PCI DSS Compliance To achieve PCI DSS compliance, you must identify and remediate all critical vulnerabilities detected during PCI scans. Threat Manager streamlines this process by...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts