Feeds

ATMs, ISPs hit by Slammer worm spread

Damage reports

  • alert
  • submit to reddit

5 things you didn’t know about cloud backup

The bandwidth-crunching Slammer worm caused all manner of damage since its appearance on the Net in the early hours of Saturday morning.

On Saturday, the spread of the worm was so severe that the majority of Bank of America's 13,000 automatic teller machines "were unable to process customer transactions", the
Washington Post reports. The paper quotes the bank saying it was able to restore services on Saturday evening but a Seattle-based Reg reader tells us he was "unable to make a deposit to my Bank of America Account on Sunday at about noon Pacific time".

"I observed several others having similar problems accessing their accounts," he adds.

Over in Redmond, Windows XP activation servers were thrown offline while in Korea (whose Net connections were particularly hard hit by the worm) shares in the country's two largest ISPs, KT Corp and Hanaro Telecom Inc, fell sharply while computer security stock rose sharply, Reuters reports.

The news agency states "almost all KT customers lost their connections during the attack".

The DDoS potential of the worm on Net access was also felt in Europe.

In Portugal over 300.000 subscribers to Cable ISP Netcabo were without Internet access for more than 12 hours due to the worm, Reg reader Nuno Alves tells us.

Slammer hammers Net

The Slammer (aka Sapphire) worm, takes advantage of a six-month-old vulnerability in MS SQL Server 2000 (a server resolution service buffer overflow flaw), to spread.

Although Slammer is not destructive to an infected host (like Code Red it only exists in memory), it generates a damaging level of network traffic when it scans for additional targets. The worm continuously sends 367 bytes of exploit and propagation code across port 1434/UDP until the SQL Server process is shut down. Unlike Nimda these attacks are not directed towards local sub-nets but spread across the wider Internet.

During peak hours of infection, security firm Symantec observed more than 22,000 unique systems infected by the worm. Infection rates have, thankfully, dropped markedly since but that still leaves a labour-consuming mop-up operation ahead.

On Saturday we reported that afflicted servers are relatively easy to cure, once identified. Although Microsoft has supplied a patch fixing the problem turns out to be far from trivial, as IT staff who spent an unscheduled weekend at work in the City have found.

"Well, after spending the weekend in the office (thanks to the SQL Slammer worm), I can confirm that at least two City investment banks have been severely impacted by this," one technician, who asked to remain anonymous, tells us.

"Of course, Microsoft have made our jobs easier (not!) by having two different patches that need to be installed for SQL Server 2000 and Microsoft Data Engine (MSDE), although there's very little to tell the difference between the two installations so as to target them correctly. Not to mention conflicting security bulletins, and a service pack that needs to be installed before the patch can be applied," he adds.

Security firms recommend that all MS-SQL server system admins audit their machines for known security vulnerabilities. Since Slammer spreads on UDP port 1434, users are been urged to update firewall or router tables to block this traffic as a workaround, prior to putting patches in place. ®

Related Stories

SQL worm slams the Net

External Links

SQL Slammer worm advisory by security tools firm ISS
More on the SQL Server 2000 vulnerability Slammer exploits, alert by Next Generation Security Software

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
JLaw, Kate Upton exposed in celeb nude pics hack
100 women victimised as Apple iCloud accounts reportedly popped
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.