Massive Worm going accross the internet

Caveman2001

Senior member
Dec 24, 2000
582
0
0
A local ISP where I am has this to say:

Update Fri Jan 24 23:11:01 PST 2003... This turns out to be a massive worm which is causing denial of service (DoS) across the Internet. UUNet has characterized this as "the DoS of the year". The vector is Microsoft SQL servers. So far, we have found 7 servers pumping 100 megabit/second into our core, which is the cause of the high latency and packet loss within portions of our network. We continue to work the problem. -Scott, Kelsey, and Nathan

Nice way to start the new year ehh?

Silly Hackers, DOS is for kids.

BTW, it's port 1434 and is an exploit of buffer overflows most likely so it can install itself.

Reports are saying install SP3 for SQL server and you should be ok. Not confirmed yet.
 

Mucman

Diamond Member
Oct 10, 1999
7,246
1
0
Originally posted by: Oaf357
Ahhh... the key reason to avoid Microsoft products.

Not 100% true (albeit I do agree with you a bit). MS SQL Server is a great database product, but all someone has to do
is keep on top of patches. An even better solution is to not have DB servers open on public networks. We use multihomed
web servers, but clients want to connect to our SQL Servers using Enteprise Manager, so we don't have much choice.



 

bsr

Senior member
May 28, 2002
628
0
0
I heard about dos attacks hitting game servers (on techtv's techlive news), this is really bad.
 

Saltin

Platinum Member
Jul 21, 2001
2,175
0
0
This worm exploits a hole that was patched in May of 2002. Just goes to show you how little patching people do.
 

skyking

Lifer
Nov 21, 2001
22,649
5,761
146
my friend is running a mssql server for his senior project. I'll bet he's glad it is behind his freebsd firewall, even though he probably patched it properly.
 

stash

Diamond Member
Jun 22, 2000
5,468
0
0
Ahhh... the key reason to avoid Microsoft products
Ahhh...another dumb statement.

Microsoft may have put out a product that contain vulerabilities. But they also released a patch for this problem in MAY. The problems that are occuring today are because of incompetent admins who a) put their machines in a position (internet-facing SQL servers!!!) to be hacked and b) couldn't be bothered to keep up with patches on their servers.

Yes, Microsoft products have many vulnerabilities, and in a perfect world, I would like not to have to worry about patching systems every week. But believe me, if a product like MySQL was in such widespread use as MS SQL, people would find vulnerabilities for that too. And MySQL admins would do dumb things like not use firewalls and forget to patch, and we would have this problem all over again.
 

Caveman2001

Senior member
Dec 24, 2000
582
0
0
I have say that the biggest reason Microsoft Products get hit is because they are the biggest target and will effect the most people. Simple logic ehh? There are security issues with all OS's out there.

Link for Fix

The above link has all the information necessary for anyone to resolve this issue.
 

Oaf357

Senior member
Sep 2, 2001
956
0
0
Originally posted by: Mucman
Originally posted by: Oaf357
Ahhh... the key reason to avoid Microsoft products.

Not 100% true (albeit I do agree with you a bit). MS SQL Server is a great database product, but all someone has to do
is keep on top of patches. An even better solution is to not have DB servers open on public networks. We use multihomed
web servers, but clients want to connect to our SQL Servers using Enteprise Manager, so we don't have much choice.

I don't think my reasoning was made clear.

If you haven't noticed people are attacking Microsoft. The second you put a Microsoft product up on a network you're a target, a very large one at that. The last few worm/viruses that have affected EVERYONE on the Internet (Code Red still roams by the way) were direct attacks on MS products.

Not everyone patches their server, not everyone keeps their DB servers private. Regardless, if you weren't using MS last night you wouldn't have had a headache today.
 

Oaf357

Senior member
Sep 2, 2001
956
0
0
Originally posted by: STaSh
Ahhh... the key reason to avoid Microsoft products
Ahhh...another dumb statement.

Microsoft may have put out a product that contain vulerabilities. But they also released a patch for this problem in MAY. The problems that are occuring today are because of incompetent admins who a) put their machines in a position (internet-facing SQL servers!!!) to be hacked and b) couldn't be bothered to keep up with patches on their servers.

Yes, Microsoft products have many vulnerabilities, and in a perfect world, I would like not to have to worry about patching systems every week. But believe me, if a product like MySQL was in such widespread use as MS SQL, people would find vulnerabilities for that too. And MySQL admins would do dumb things like not use firewalls and forget to patch, and we would have this problem all over again.

Read my reply to Mucman. By the way. If it's a dumb statement then how come every Unix admin wasn't at work today fixing a Windows 2000 SQL Server? The fact of the matter is that the more eyes you put on a product and the more people you get using it the more problems get worked out, right? Right. Now, take an open source app let everyone and their brother look at the code and see how quickly something gets fixed. Better yet, see how many problems come "out of the box". Plain and simple, Microsoft has to start looking at better security before production as opposed to during and after production until they do my opinion will remain that Microsoft should not be on servers.
 

Mucman

Diamond Member
Oct 10, 1999
7,246
1
0
Regardless, if you weren't using MS last night you wouldn't have had a headache today.

I think should revise that statement... Our entire network is mostly MS except for 5 unix machines (like I've already mentioned). Our machines
weren'r part of the worm at all. The only reason why our network was affected was because some of our customers got lazy and didn't patch
their machines. It was a simply a matter of turning off their switchports to fix it.

Whether the network is Unix, Windows, or any other platform; it will all go to crap if not properly administered.
 

Oaf357

Senior member
Sep 2, 2001
956
0
0
Originally posted by: Mucman
Regardless, if you weren't using MS last night you wouldn't have had a headache today.

I think should revise that statement... Our entire network is mostly MS except for 5 unix machines (like I've already mentioned). Our machines
weren'r part of the worm at all. The only reason why our network was affected was because some of our customers got lazy and didn't patch
their machines. It was a simply a matter of turning off their switchports to fix it.

Whether the network is Unix, Windows, or any other platform; it will all go to crap if not properly administered.

Why would I revise this statement. It was the truth.
 

Mucman

Diamond Member
Oct 10, 1999
7,246
1
0
Originally posted by: Oaf357
Originally posted by: Mucman
Regardless, if you weren't using MS last night you wouldn't have had a headache today.

I think should revise that statement... Our entire network is mostly MS except for 5 unix machines (like I've already mentioned). Our machines
weren'r part of the worm at all. The only reason why our network was affected was because some of our customers got lazy and didn't patch
their machines. It was a simply a matter of turning off their switchports to fix it.

Whether the network is Unix, Windows, or any other platform; it will all go to crap if not properly administered.

Why would I revise this statement. It was the truth.

No it wasn't. If we weren't and ISP we wouldn't have had to do anything last night. We run a 95% MS network and there was no worm traffic
coming from us!

Of course this is just a single counterpoint example, and doesn't reflect the majority of networks out there. I am just saying that just because you run a
MS network doesn't mean that you are going to get hacked not matter what.

 

Saltin

Platinum Member
Jul 21, 2001
2,175
0
0
Regardless, if you weren't using MS last night you wouldn't have had a headache today.

There is no validity to that statement whatsoever, and here is why.

#1 The worm caused no damage to the SQL server databases. Indeed, it stays resident only in memory. It was designed for DDoS.

#2 Because of this, the majority of headaches were experienced by people managing routers/switches/backbones, etc.

The worm was designed to cause excess traffic. Excess traffic affects everyone, whether you be an MS admin, Nix Admin, or a Network Admin.

Your statement demonstrates two things

#1 You didnt take them time to understand the worm and its purpose.

#2 You think not using MS products makes you immune to exploits in MS products.

Wrong.
 

DynaGlide

Junior Member
Jan 20, 2003
20
0
0
Frankly, I think this thread is hilarious!

Here I am lurking in a discussion between (presumably) grown, well-educated and informed adults, and they're acting like a bunch of nine-year-old kids out in the school yard:

"My Dad's bigger", "My Dad's smarter", "My Dad's more secure", yada, yada, yada...

Got news for you folks... All your "Dads" be suck!

Never has been, probably never will be, a "secure" operating system or application written. They all have vulnerabilities, get over it!

I do find a couple of points quite interesting, however. One participant makes the point that Microsoft is the target of worms, viruses, et al because they are a target of opportunity. Exactly! Anybody ever seen a virus written for Novell GroupWise? Anybody ever even seen GroupWise? The irony of the counter-argument to this is that if we were all to heed the advice of another respondent, why, then we'd all move off of our Microsoft platforms post-haste, moving to a supposedly more secure platform like 'Nix. Guess what? The instant we do that, all the "Little Danny Dirtballs" of the world are going to focus their efforts on 'Nix, the new target of opprtunity, and all of a sudden Microsoft is going to look attractive again. I refer to my statement above concerning O/S vulnerabilities. Every O/S Sucks!

Another point that has been made, but needs to be re-stated is that this entire episode could have been avoided had our Ivory Tower Administrators put down their copy of Information Week, logged off of Monster.com, and moved their butts into the server room where they should have been appying patches and looking after the health and well being of their end-users and systems. An eight month old patch would have fixed this problem before it started.

Which brings me to my last point. I absolutely agree that Microsoft has been negligent about developing code with security in mind. Perhaps you might even consider them ciminally negligent; I'm not qualified to address that. They've written an awful lot of vulnerable code, to be sure. Guilty as charged. Frankly, I'm not convinced that if they had been "Open Source" this would have been avoided. Now that Microsoft has made their source code available to various governments and institutions, I guess we'll see. But I don't think that anyone can begin to make the argument that because various flavors of 'Nix are ostensibly "Open Source" that it has been imune or impervious to vulnerabilities. I think that I can confidently predict that Microsoft product will become secure in the next few generational releases. There have only been a few times in Microsoft's corporate history where Bill Gates sent an e-mail to "Everyone". The most recent example of this was his "Trustworthy Computing" initiative. To date, Microsoft claims to have invested over $100,000,000.00 in re-training their developers and refocusing their visionaries and evangelists on producing secure products. This will happen, its just a matter of time, I assure you. In an earlier time, Gates issued a memo to "Everyone" when he woke up one morning and discovered that there was this thing out there called "The Internet", and decided that Microsoft ought to look into it. I ask you, how many of you are reading this in Netscape Navigator right now? Maybe more importantly, how many of your Grandfathers, Aunts, Uncles, or "Dads" are using anything but IE? My point is, when Bill Gates says it's going to happen, it happens, guaranteed.

Ok, end of rant. I think I've manage to piss off or alienate pretty much everyone out there. And me just some silly newbie. Thanks for listening.
 

Oaf357

Senior member
Sep 2, 2001
956
0
0
Originally posted by: DynaGlide
Frankly, I think this thread is hilarious!

Here I am lurking in a discussion between (presumably) grown, well-educated and informed adults, and they're acting like a bunch of nine-year-old kids out in the school yard:

"My Dad's bigger", "My Dad's smarter", "My Dad's more secure", yada, yada, yada...

Got news for you folks... All your "Dads" be suck!

Never has been, probably never will be, a "secure" operating system or application written. They all have vulnerabilities, get over it!

I do find a couple of points quite interesting, however. One participant makes the point that Microsoft is the target of worms, viruses, et al because they are a target of opportunity. Exactly! Anybody ever seen a virus written for Novell GroupWise? Anybody ever even seen GroupWise? The irony of the counter-argument to this is that if we were all to heed the advice of another respondent, why, then we'd all move off of our Microsoft platforms post-haste, moving to a supposedly more secure platform like 'Nix. Guess what? The instant we do that, all the "Little Danny Dirtballs" of the world are going to focus their efforts on 'Nix, the new target of opprtunity, and all of a sudden Microsoft is going to look attractive again. I refer to my statement above concerning O/S vulnerabilities. Every O/S Sucks!

Another point that has been made, but needs to be re-stated is that this entire episode could have been avoided had our Ivory Tower Administrators put down their copy of Information Week, logged off of Monster.com, and moved their butts into the server room where they should have been appying patches and looking after the health and well being of their end-users and systems. An eight month old patch would have fixed this problem before it started.

Which brings me to my last point. I absolutely agree that Microsoft has been negligent about developing code with security in mind. Perhaps you might even consider them ciminally negligent; I'm not qualified to address that. They've written an awful lot of vulnerable code, to be sure. Guilty as charged. Frankly, I'm not convinced that if they had been "Open Source" this would have been avoided. Now that Microsoft has made their source code available to various governments and institutions, I guess we'll see. But I don't think that anyone can begin to make the argument that because various flavors of 'Nix are ostensibly "Open Source" that it has been imune or impervious to vulnerabilities. I think that I can confidently predict that Microsoft product will become secure in the next few generational releases. There have only been a few times in Microsoft's corporate history where Bill Gates sent an e-mail to "Everyone". The most recent example of this was his "Trustworthy Computing" initiative. To date, Microsoft claims to have invested over $100,000,000.00 in re-training their developers and refocusing their visionaries and evangelists on producing secure products. This will happen, its just a matter of time, I assure you. In an earlier time, Gates issued a memo to "Everyone" when he woke up one morning and discovered that there was this thing out there called "The Internet", and decided that Microsoft ought to look into it. I ask you, how many of you are reading this in Netscape Navigator right now? Maybe more importantly, how many of your Grandfathers, Aunts, Uncles, or "Dads" are using anything but IE? My point is, when Bill Gates says it's going to happen, it happens, guaranteed.

Ok, end of rant. I think I've manage to piss off or alienate pretty much everyone out there. And me just some silly newbie. Thanks for listening.

Well said. But, I'm the kind of guy that will not let a misinterpretation of my statements force me to retract them. I said that, if you weren't using MS last night then you wouldn't have a headache today. Maybe I should have been more clear (especially for the moron who said that it wasn't an MS attack it was a DDoS attack), it was the attack on MS SQL servers that started the DDoS onslaught. Which means if you weren't using MS the night before the attack (at least SQL or MSDE 2000, without the appropriate patch) the DDoS wouldn't have ever happened. This means that you have total control of your network (even your customers segments). It sounds totalitarian and all but let's face it, if your network has vulnerable servers on it regardless of whether or not they are "yours" then you should know about it. I would even go as far as saying that the overtime needed to fix the problem should be charged to the customer(s) with the unpatched servers.

I read a very interesting series of leaked Microsoft memos at The Register which basically stated the MASSIVE headache it was for even the mighty Microsoft to patch its systems. Apparently (and I could be wrong about this because I don't use MS SQL), the patch released last year was quite intensive to apply and for a few individuals caused massive problems once the patch was successfully applied. You have to put some blame on the company that made the vulnerable product, I totally agree with that, whether they were criminally negligent, I can't say and I doubt very seriously it will even get a chance in court due to the fact that Microsoft didn't release the worm, the "Little Danny Dirtbags" did. They were the "criminals".

You are right if everyone went to a Unix platform it would be the #1 and no one likes the guy on top and it would be the #1 attacked system. But, at least Unix puts some emphasis on security in the design stages. I'm sure Microsoft will come around, but the prove is in the pudding.
 

wolf31o2

Junior Member
Jan 27, 2003
22
0
0
Originally posted by: Mucmanbut clients want to connect to our SQL Servers using Enteprise Manager, so we don't have much choice.
Make them VPN in, then, rather than having them open to the 'net.

 

Saltin

Platinum Member
Jul 21, 2001
2,175
0
0
especially for the moron who said that it wasn't an MS attack it was a DDoS attack

It was a DDoS attack that leveraged an MS exploit. I think my point was pretty clear.

Also, Just because I disagree with you doesnt mean I am a "moron". I don't think there is any room on these boards for ad-hom attacks like that. This is a technical discussion.
 

Oaf357

Senior member
Sep 2, 2001
956
0
0
Originally posted by: Saltin
especially for the moron who said that it wasn't an MS attack it was a DDoS attack

It was a DDoS attack that leveraged an MS exploit. I think my point was pretty clear.

Also, Just because I disagree with you doesnt mean I am a "moron". I don't think there is any room on these boards for ad-hom attacks like that. This is a technical discussion.

Writing doesn't have the stresses or facial expressions of verbal communications. Sorry if you were offended but I call everybody a moron or jackass. Just the way I am.

Your last statement about not using MS products is inaccurate at best however.
 

DynaGlide

Junior Member
Jan 20, 2003
20
0
0
In which Oaf357 said:

Well said. But, I'm the kind of guy that will not let a misinterpretation of my statements force me to retract them. I said that, if you weren't using MS last night then you wouldn't have a headache today. Maybe I should have been more clear (especially for the moron who said that it wasn't an MS attack it was a DDoS attack), it was the attack on MS SQL servers that started the DDoS onslaught. Which means if you weren't using MS the night before the attack (at least SQL or MSDE 2000, without the appropriate patch) the DDoS wouldn't have ever happened. This means that you have total control of your network (even your customers segments). It sounds totalitarian and all but let's face it, if your network has vulnerable servers on it regardless of whether or not they are "yours" then you should know about it. I would even go as far as saying that the overtime needed to fix the problem should be charged to the customer(s) with the unpatched servers.

Oaf357, my man, I think that we're in substantial agreement here. I certainly didn't mean to misrepresent your position, or in any way minimize or undermine your substantial "correctness". I apologize if that was the way it came off. I have experienced the royal pain that the referenced patch introduced, but I think that we'd agree that that's no excuse to leave your systems unprotected. Overall, I can't argue one bit with your position that if we weren't using Microsoft in the first place, we could not have been impacted. Absolutely correct.

Suppose that we just amend your statement to read "if you weren't using -> UNPATCHED <- MS last night then you wouldn't have a headache today" I think this conveys your original point, and the spirit in which it was made, much more accuarately. Ok? Doesn't exonerate MS for having written vulnerable code in the first place, of course, but admins need to take some responsibilty here, too.

Perhaps our service agreements might insist that our customer's either maintain their own servers and services to acceptable standards, or agree to either paying us to maintain them for them, or risk a service interruption, at our discretion. We might lose some business in the short term, but how many of us are now going to get blamed by our customer's for the service disruption that their lack of a decent maintenance regime resulted in?

Out.