Subject: RE: [Ieprep] FYI: Virus-Like Infection Slows Internet Traffic

From: "Nguyen, An" <[email-masked]>
Date: Mon, 27 Jan 2003 15:03:26 -0500

More info on ...

MS-SQL Server Worm (also called Sapphire, SQL Slammer, SQL Hell)

A SPECIAL REPORT FROM THE SANS RESEARCH OFFICE

A worm launched Saturday morning January 25, about 12:30 AM (EST),
takes advantage of a buffer overflow vulnerability in Microsoft SQL
Server 2000.  The SQL vulnerability was initially reported in July
of 2002.  The worm is also being called Sapphire, SQL Slammer, and
SQL Hell.

Microsoft reports that the worm also infects MSDE 2000 systems,
typically used by software developers.

The worm attempts to infect systems at (approximately) randomly
generated IP addresses. The worm has no back doors or code for
flooding like other worms (Code Red). However, by using UDP packets
for infection, the worm allows infected machines to generate huge
amounts of traffic;  even greater than that produced by most code
written specifically for flooding. Thus, in attempting to infect
other systems, the worm has powerful denial of service capabilities.

The worm resides in memory, and not on disk, so it can be eliminated
using a system reboot. However, if the defensive perimeter is not
upgraded to block offending udp packets or the system is not patched,
it will be quickly reinfected.

The worm uses UDP port 1434, so the impact of the worm can be 
reduced by blocking inbound and outbound traffic destined for UDP 
port 1434. Sites should use caution when blocking all traffic to this 
port, since it is legitimately used by Microsoft SQL services.  Some 
sites have reported high levels of UDP traffic to port 1433 as well.

A CERT Advisory said the worm has caused various levels of network
degradation across the Internet. One news story reported that
ATMs of Bank of America were impacted by the worm. According to the
various reports, about 35,000 hosts had been infected as of Saturday.
Incidents.Org reports 120,000 IP addresses infected by Sunday at 10 AM
(EST).

Incidents.org preliminary analysis of worm (includes a packet trace):
http://isc.incidents.org/analysis.html?id=180

Original Vulnerability Analysis by David Litchfield:
http://www.nextgenss.com/advisories/mssql-udp.txt

CERT Advisory:
http://www.cert.org/advisories/CA-2003-04.html

Microsoft Advisory:
http://www.microsoft.com/security/slammer.asp

Cisco Security Notice (Recommendations):
http://www.cisco.com/warp/public/707/cisco-sn-20030125-worm.shtml

Cisco Security Advisory:
http://www.cisco.com/warp/public/707/cisco-sa-20030126-ms02-061.shtml

Microsoft Security Bulletin (originally posted July 24, 2002):
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
bulletin/MS02-039.asp

-----Original Message-----
From: Barry Raveendran Greene [mailto:[email-masked]]
Sent: Saturday, January 25, 2003 12:07 PM
To: 'King, Kimberly S.'; [email-masked]
Subject: RE: [Ieprep] FYI: Virus-Like Infection Slows Internet Traffic

What isn't being said is that inter-ISP Security communication systems
worked
and this worm was roughly contained within hours of the discovery. We're
currently in the phase of more tightly containing the infected servers. 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
King,
> Kimberly S.
> Sent: Saturday, January 25, 2003 8:41 AM
> To: [email-masked]'
> Subject: [Ieprep] FYI: Virus-Like Infection Slows Internet Traffic
> 
> http://www.washingtonpost.com/wp-dyn/articles/A41673-2003Jan25.html
> 
> 
> "The attack sought to take advantage of a software flaw discovered by
> researchers in July 2002 that permits hackers to seize control of
corporate
> database servers. Microsoft deemed the problem "critical" and offered a
free
> repairing patch, but it was impossible to know how many computer
> administrators applied the fix.
> 
> "People need to do a better job about fixing vulnerabilities," Schmidt
said.
> "
> _______________________________________________
> Ieprep mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ieprep
_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep
_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep

---

From: Marshall Eubanks <[email-masked]>
Date: Mon, 27 Jan 2003 15:14:41 -0500

As has been discussed extensively on NANOG and elsewhere

http://biz.yahoo.com/rb/030125/tech_virus_boa_1.html

Reuters
Bank of America ATMs Disrupted by Virus
Saturday January 25, 5:33 pm ET

SEATTLE (Reuters) - Bank of America Corp. (NYSE:BAC - News) said on 
Saturday that customers at a majority of its 13,000 automatic teller 
machines were unable to process customer transactions after a malicious 
computer worm nearly froze Internet traffic worldwide.

Bank of America spokeswoman Lisa Gagnon said by phone from the company's 
headquarters in Charlotte, North Carolina, that many, if not a majority 
of the No. 3 U.S. bank's ATMs were back online and that their automated 
banking network would recover by late Saturday.

<snip>

"We have been impacted, and for a while customers could not use ATMs and 
customer services could not access customer information," Gagnon said.

<snip>

                                  Regards
                                  Marshall Eubanks

>> "People need to do a better job about fixing vulnerabilities," Schmidt

T.M. Eubanks
Multicast Technologies, Inc.
10301 Democracy Lane, Suite 410
Fairfax, Virginia 22030
Phone : 703-293-9624       Fax     : 703-293-9609
e-mail : [email-masked]
http://www.multicasttech.com

Test your network for multicast :
http://www.multicasttech.com/mt/
  Status of Multicast on the Web  :
  http://www.multicasttech.com/status/index.html