If I couldn't laugh. . .
. . .I would have to cry. Yesterday's SQL Slammer worm attack exploited a known fault in Microsoft SQL Server 2000--which Microsoft patched 6 months ago! Which db admins could fix with a frigging password. Which sysdmins could avoid by not exposing their database servers to the public Internet. Just like the Nimda and Code Red worms, which exploited known, patched faults. In fact, I applied the IIS patch to my WinNT (it's now Win2K) machine a month before the original Code Red attack--and a month before my employer's IT department took action (day late, many dollars short).
Major SQL Server 2000 Worm Hits The Web. Because of failure to apply existing SQL Server 2000 patch which Microsoft posted last July, a number of database servers across the Web backbone were attacked by a virus-like worm on Saturday morning. [Microsoft Watch from Mary Jo Foley]
Update: 'Slammer' worm slugs Internet, slows Web traffic. One security firm estimated that 150,000 to 200,000 servers worldwide have already been infected by today's attack, which hit the Internet at about 12:30 a.m. EST. [Computerworld News]
Virus Overwhelms Global Internet Systems. A fast-spreading, virus-like infection slowed Internet traffic Saturday, overwhelming the world's digital pipelines and interfering with Web browsing and e-mail delivery. By The Associated Press. [New York Times: Technology]
Fresh warning over cyber attack. Experts warn of new outbreaks of a computer worm when business users return to work. [BBC News | Technology | UK Edition]
And of course the most complete coverage came from Slashdot:
"Since about midnight EST almost every host on the internet has been receiving a 376 byte UDP payload on port ms-sql-m (1434) from a random infected server. Reports of some hosts receiving 10 per minute or more. internetpulse.net is reporting UUNet and Internap are being hit very hard. This is the cause of major connectivity problems being experienced worldwide. It is believed this worm leverages a vulnerability published in June 2002. Several core routers have taken to blocking port 1434 outright. If you run Microsoft SQL Server, make sure the public internet can't access it. If you manage a gateway, consider dropping UDP packets sent to port 1434." bani adds "This has effectively disabled 5 of the 13 root nameservers."
If you're running an unpatched server open to the Internet, you (and we) have no one to blame but yourself.
8:59:10 AM 
|
