Virus Overwhelms Global Internet Systems

Advertisement (Why?)

No, it wasn't neowin down this time. It was the whole Internet!!

The virus-like attack, which began about 12:30 a.m. EST, sought out vulnerable computers on the Internet to infect using a known flaw in popular database software from Microsoft Corp. called "SQL Server 2000." The attacking software was scanning for victim computers so randomly and so aggressively, sending out thousands of probes a second, that it saturated many Internet data pipelines.

The FBI was searching for the origin of the attack, which experts variously dubbed "sapphire," "slammer" or "SQ hell." Some security researchers noted that software unleashed in Saturday's attack bore striking resemblance to blueprints for computer code published weeks ago on a Chinese hacking Web site by a virus author known as "Lion." An FBI spokesman said he couldn't confirm that.

News source: Yahoo! News

Version 3.7 now available!

- Added a number of new profiles and updated existing ones.
- A new Reset profile saves the current settings at the time you installed Rage3D Tweak so you can easily revert to the settings you had before installing the tweaker.
- Updated tweaks for full support of Catalyst 3.0 options.
- New GUI updates include new buttons, support for nested tree-view for more useful tweaks organization and more.
- Updated support for additional 9500/9700 boards as well as updates for older generation Radeon cards.
- New overclocking files with better support for all ATI Radeon core based chips. (Mobility included)
- Added the ability to Export and Import profiles between R3DTweak versions now!
- Exported profiles go to a file format that is easy to pass between your friends as well as save your personal profiles for easy upgrading to new Rage3D Tweak versions. Simply double-click a profile file to import it back into the tweaker.
- Folding@Home support has returned to the tweaker! The F@H tab will now prompt you to download the client from the correct place and tell you where to put it for full support of running/hiding the console. Right-Click on the F@H tab window for menu options. Be sure that you download the text-only client from the web site and copy the file into program filesrage3d tweakfolding. the client must be called FAH.exe in that directory for it to work. You can transfer your current work to that directory as well, just rename the client as mentioned and the stats will work with your existing work units.
- Quite a lot of other under the hood enhancements to help prepare for the future.
- The setup program now auto-detects all Radeon cards and selects the correct tweaks for your card type. If you have more than one card listed in the registry it will prompt you for the card you are using now.
- The setup program now prompts you for the location you would like to install Rage3D Tweak. All files now go into this folder (except the overclocking files) instead of the various windows directories where most files did in former versions.
- You can now change skins without any need to install or reboot anything. An icon in the Rage3D Tweak program group allows you to change skins at will. Just close and open the tweaker after each skin change for it to take place.
- The Tweaker now uses a registry hive system which keeps all the extra tweak information from bloating your registry. The settings are only stored in the registry while the tweak interface is open and written out to a special file (and removed from the registry) after you close the tweaker interface.
- New GameUtil startup graphic thanks to a Rage3D Forum regular.

#1 radixvir on 25 Jan 2003 - 21:26

this is huge i want to know how many servers were infected by it

#2 viewmont on 25 Jan 2003 - 21:28

5 out of thirteen NOCs, i heard.

(3 replies) #3 superfula on 25 Jan 2003 - 21:28

A lot. Rumors are that the worm originated in N Korea.

#3.1 Edge on 25 Jan 2003 - 21:48

Yeah...so I've heard too. Does msn.com accounts work for anyone yet?

#3.2 superfula on 25 Jan 2003 - 21:54

Yeah mine started working just before Neowin came back up.

#3.3 Edge on 25 Jan 2003 - 23:57

Cool! Gonna check mines out now. Works!

Last edited by 14267 on 26 Jan 2003 - 01:53

#4 xStainDx on 25 Jan 2003 - 21:31

YAY We're Back!!!!!!!!

(3 replies) #5 Ravager on 25 Jan 2003 - 21:36

Yea. A lot of root servers were hit. This was crazy. Even Neowin was affected :'( Could it be Mitnick?

#5.1 xStainDx on 25 Jan 2003 - 21:42

neowin couldn't have been infected.... they odn't use Microsoft SQL Server.. last i checked, IBF needed mySQL and PHP.

Just a traffic stop!

#5.2 rastachops on 25 Jan 2003 - 22:42

Its not just Microsoft SQL server that was effected...

#5.3 Hawkeye on 25 Jan 2003 - 22:46

[neoquote=#5.1 by xStainDx]neowin couldn't have been infected.... they odn't use Microsoft SQL Server.. last i checked, IBF needed mySQL and PHP.

Just a traffic stop![/neoquote] You have to remember that Neowin is being hosted by Invision Power Services. Earlier today, all sites hosted by Invision Power Services were down. This includes Neowin, IB Skins, IB Resource, and Invision's homepage as well.

(8 replies) #6 kuregu02 on 25 Jan 2003 - 21:41

Lazy admins. :disappoin

#6.1 Eduardo on 25 Jan 2003 - 21:58

I have one server affected (right now i'm on hold with the ISP), but I'm not lazy nor admin, I'm a developer, but my boss put me in charge of the server. I dont have the time to check all the the patchs

#6.2 Eric Ferleman on 25 Jan 2003 - 22:04

Don't suppose you could just have it AutoUpdate, but that depends on what OS your using....

#6.3 Eduardo on 25 Jan 2003 - 22:16

Yes, I have auto-update, but this don't update SQL server

#6.4 Eric Ferleman on 25 Jan 2003 - 22:25

Sorta defeats the point of AutoUpdate doesn't it.

#6.5 xStainDx on 26 Jan 2003 - 00:02

NO, AUTO-UPDATE is for the Windows OS itself, not secondary Microsoft Products that you install. When i say "Windows OS" itself, that includes any product thats included in the Windows Package or CD. ex, WMP WMM etc.. SQL Server is an Enterprise Level Solution and is a secondary product, you cannot put in a Autoupdate because these machines are always running, and you can't force down a server at any will.

#6.6 radixvir on 26 Jan 2003 - 01:46

autoupdate? come on. admins are supposed to know what is going on with their servers including vulerabilities. they are being paid to make sure they are working. obviously some are not doing their jobs. and its not the fault of the first guy who has hosting services although sometimes it helps to bug them about it if you know there is a vulernability

#6.7 Eric Ferleman on 26 Jan 2003 - 02:51

Hmm well then, perhaps MS should extend Autoupdate to notify users if their "secondary Microsoft Products" have a critical flaw that needs a patch immediately, and provide them the link to download it. That might have prevented a lof of problems.

#6.8 Eduardo on 26 Jan 2003 - 06:28

Things are not that easy. * I have an MSDE, after downloading SQL server SP3, it tell me (in the read me) that I have to download another file for MSDE. * I look for this file like mad, finally found a SP3 ReadMe *addendum* that says that the readme was wrong, and the MSDE SP3 wasn't ready yet (and MS says security is #1

) * I download MSDE SP2, and reboot. * SP2 dont solve this problem, so the virus start again * call the ISP to stop the service (Im controling it remotely) * Install the patch...... so, its 3:00 am, my girlfriend is sleep (no sex today), and the problem is not solved...

(6 replies) #7 Fotix on 25 Jan 2003 - 21:50

My firewall log overnight was filled with that garbage requests on UDP Port 1434... and hell I'm still getting them. Ugh....

#7.1 aem4162 on 25 Jan 2003 - 21:59

[neoquote=#7.0 by Fotix]My firewall log overnight was filled with that garbage requests on UDP Port 1434... and hell I'm still getting them. Ugh....[/neoquote] Me, too. I've got a list a mile long...

anita

#7.2 Eric Ferleman on 25 Jan 2003 - 22:07

I'm just curious, but are you using a software firewall or an actual physical firewall?

#7.3 xStainDx on 25 Jan 2003 - 22:08

I have a router... and sometimes software firewalls.

#7.4 Eric Ferleman on 25 Jan 2003 - 22:12

Aite thanks. I was just curious to see if anyone thinks that the free version of Zone Alarm is any good....

#7.5 Fotix on 25 Jan 2003 - 22:15

[neoquote=#7.2 by Eric Ferleman]I'm just curious, but are you using a software firewall or an actual physical firewall?[/neoquote] Agnitum Outpost Firewall, software. I use dial-up net access at home.

#7.6 Eric Ferleman on 25 Jan 2003 - 22:17

Yeah, I'm stuck on dialup too, at home anyway.

#8 aem4162 on 25 Jan 2003 - 21:55

You never ever heard so much screaming and cussing in this house since last night... DAMN those hackers...can't they do SOMETHING constructive ONCE in a while????? I'm glad Neowin is BACK!!!!!!

#9 Eric Ferleman on 25 Jan 2003 - 21:59

Indeed, glad Neowins back. I assume that it was merely a routing problem, since Neowin doesn't use SQL Server.

#10 smek on 25 Jan 2003 - 21:59

yay to neowin being back i didnt have any trouble with other sites tho, most odd i recon its a cover up, i think the neowin people broke sumin

#11 RazerBack on 25 Jan 2003 - 22:07

I'm glad I'm not working today.... Tech support for cable is just crazy, oh well.

#12 MrHolliday on 25 Jan 2003 - 22:07

Maybe this would explain Bank of America's "technical difficulties" which are slowing down their online banking service. They obviously don't want to say "We're dealing with a large virus outbreak" lol

#13 Mango on 25 Jan 2003 - 22:08

Check this graph out. http://average.matrix.net/Daily/markR.html

#14 Arch on 25 Jan 2003 - 22:12

Wow, this is an amazing attack. I though my ISP had started blocking certain sites (terrifying though)! Happy to have neowin back though, very happy indeed.

#15 Wickedkitten on 25 Jan 2003 - 22:32

odd, the only thing that didnt work for me today [b]was[/b] neowin. Everything else was just a wee bit slower than usual

(1 reply) #16 whistlerxp on 25 Jan 2003 - 22:34

Hmmm strange, will they be able to do it again?

#16.1 radixvir on 26 Jan 2003 - 01:55

watch out for a recursion with a couple of days. everyone got lucky because the virus only affects one port. the second one will probably send data to random ports. lets get those ms admins to patch their stuff up

#17 eaglebtc on 25 Jan 2003 - 22:50

I looked at the "performance events" link from that page, and examined the graphs for the times when Code Red had struck. There wasn't nearly as much packet loss or latency during Code Red as there has been for this newest virus. Simply stunning. Fortunately, these sort of things can be canned fairly quickly, but they are highly disruptive.

#18 kairon on 25 Jan 2003 - 23:01

I figured this was what happened to Neowin when it was down, but the question is, why is Neowin using MS SQL (if they are) or why arent they filtering port 1434 ?

#19 Justin Hancock on 25 Jan 2003 - 23:02

Half the Internet being down for around 12 hours isn't good at all

#20 kairon on 25 Jan 2003 - 23:04

By the way this flaw was fixed a long time ago and the administrators at neowin shouldn't be putting there SQL server online anyways, it should be behind a firewall. IPS, great service, not so up-2-date security

Also, if your interested in a dissasembled copy of this worm (something like 367 bytes compiled, how funny how something that small can be so destructive) look on slashdot, theres some postings in the comments linking to the dissasembled worm. Rather interesting I must say, as its been shown in Assembly code (with AT&T Syntax, so it might look different then other ASM (intel synta

)

#21 Yvo on 25 Jan 2003 - 23:12

shows you that even in today's world a 367 byte file can take down 20% (according to internettrafficreport.com and average.matrix.net) of the net. the net is still recovering as of right now due to this incident (its at 95&%, before the virus it was at 99% - 100%.

#22 eaglebtc on 25 Jan 2003 - 23:31

post the source code link? i can't find it on the slashdot page anywhere

#23 DrOmango on 25 Jan 2003 - 23:42

welcome back neowin

(1 reply) #24 creamhackered on 25 Jan 2003 - 23:49

[b]Neowin wasn't down due to MS SQL[/b] [url=http://www.invisionpower.com/?125down]Down Time[/url]

#24.1 Yvo on 26 Jan 2003 - 01:40

kind of deceiving to put [i]No, it wasn't neowin down this time. It was the whole Internet!![/i] in the news then

(3 replies) #25 xpablo on 26 Jan 2003 - 00:01

Word has it, the worm originated from North Korea's military computers. and the worm was concieved in china.

Like N.Korea has major power supply problems, but yet they'll have enuf juice to run their computers. Welcome to Communism !

PS. They must be running Linux, as I think Microsoft and other products would be illegal.

#25.1 Foo Fighter on 26 Jan 2003 - 02:01

F***ing North Korea. We should bomb their asses.

#25.2 Eric Ferleman on 26 Jan 2003 - 02:58

In time perhaps, in time....

#25.3 Daybreak on 26 Jan 2003 - 05:12

And what proof do you have that it originated from North Korea and China? Going around saying that you'll bomb their asses without proper investigation is plain insensitive and just shows the lack of maturity on your part?

#26 Tai on 26 Jan 2003 - 00:25

baaa ... more lamers .... spoiling it for everyone else ...

(1 reply) #27 naap51stang on 26 Jan 2003 - 00:37

Explains why last night when I got home (midnight CST) I couldn't connect to squat! 3/4 of the servers I tried to reach were 404 errors. I gave up and went to bed. Even saturday afternoon things were still slow. Dang hackers.........do something CONSTRUCTIVE once in a while.......I also blame (partly) MS......plug the d**n holes!

#27.1 Eric Ferleman on 26 Jan 2003 - 03:04

Yeah I was looking at my hit counter statistics and info around 10:45pm last night, and was annoyed because all of a sudden pages either wouldn't load or took forever in loading. Then a page came up that said "This sites gateway interface has too many users accessing it. Try again later." Guess that was around when it all started. The next morning I get up, and Neowin.net won't work either...

(3 replies) #28 Geronimo on 26 Jan 2003 - 00:40

Should of added most of the downed sites was because of the network congestion. Took most of the major backbone operators 4 or 5 hours to figure out if they dropped packets to the affected ports that they would reduce the congestion. But still damn lazy admins. I mean this is fix has been out since July and if you just use hfnetchk.exe you would of picked these up.

#28.1 Yvo on 26 Jan 2003 - 01:38

i agree... lazy admins in deed. there is no valid excuse an admin can give to not patching their system. if you can't keep up with patching leave the freaking field... i don't want to hear the yammering "but I don't have time to keep with the patches" your getting paid to ADMINISTER a system

#28.2 Eduardo on 26 Jan 2003 - 06:50

things are not taht easy, do you try to install this patch in a MSDE? believe me, is not so easy.

#28.3 JaggedFlame on 26 Jan 2003 - 07:31

It is easy. You take down the server, replace two files, and bring it back up. It could be easier, but it's not rocket science right now.

(4 replies) #29 warr on 26 Jan 2003 - 02:31

continue to use M$. continue to be attacked. we are celebrating...

#29.1 Eric Ferleman on 26 Jan 2003 - 03:08

You stupid syncophant, it's also MySQL thats attacked too.

#29.2 Prasanth on 26 Jan 2003 - 03:54

No, it only attacks MS SQL. And I will continue to use MS software. They did release a patch for this sometime ago.

#29.3 xStainDx on 26 Jan 2003 - 04:50

[neoquote=#29.1 by Eric Ferleman]You stupid syncophant, it's also MySQL thats attacked too. [/neoquote] if it was attacking mySQL as well, i'd be looking for a patch myself, and so would redmak and neobond.

#29.4 xStainDx on 26 Jan 2003 - 04:56

#30 ramesees on 26 Jan 2003 - 02:42

First I heard of it was when I received an email from bink in my hotmail box, which took about 5 minutes to load....grrr Thinks are still pretty slow here at university and sites are still taking ages to load I hope this gets sorted soon so things can get back to normal

#31 coldmeat on 26 Jan 2003 - 02:50

I got these emails from my host as it was happening [quote][b]25/01/03 - 20:35[/b]It appears at this stage there is a large outage affecting several major internet backbones. As such, you may have problems accessing your website or email. This seems to be a massive DoS (Denial of Service) attack of sorts that is affecting a large cross-section of the internet. This is a very serious problem and we can assure you that technicians are working on rectifying the situation as quickly as possible. We'll send out further updates as and when they come to hand.[/quote] [quote][b]25/01/03 - 22:55[/b]Further to our previous email, it does appear that the current outage is being caused by a Worm plaguing tens of thousands of Windows servers running SQL 2000 software. As many as 5 of the 13 root nameservers have been down, up to 10 with massive packet loss. While our servers have not been affected directly - they are not running Windows - the network infrastructure we rely on to carry data is under extreme pressure. Please bear in mind this is affecting literally thousands of web servers - we are not alone. The technicians in our data centre will do the best they can to isolate us from the issue but there are still significant problems with the major internet backbones [/quote] [quote][b]26/01/03 - 10:32[/b]We are glad to say that we appear to be nearing the end of the current problems, with all services slowly returning to normal this morning. Not all MyHost customers have been affected to the same extent by this outage, depending on which ISP you are connected with - and therefore what route you take to our servers. Symantec have estimated around 22,000 systems worldwide were affected by this worm. At the root of the problem are Windows 2000 servers which were not updated with security patches that Microsoft issued last July. These infected servers generated enough traffic to cripple large parts of the internet for many hours. The phenomenon was reported by many major news services. [/quote] Heres a snapshot of internets reachability over the last 24 hours at 15:45 new zealand time [img]http://www.coldmeat.net.nz/sqlhell.gif[/img]

#32 Chewbacca on 26 Jan 2003 - 04:00

Well I do know Amex went down globally due to a virus. Also Visa were affected but not as bad. Coincidence? I think not

#33 bot_alpha on 26 Jan 2003 - 06:10

#34 j.reed on 26 Jan 2003 - 06:13

worm people... it was a worm.

#35 ss1 on 26 Jan 2003 - 07:28

Lazy admins. There was a patch for the MS SQL bug since [b]June 2002 [/b]! ss1.

#36 Yvo on 26 Jan 2003 - 08:51

speaking of which... credit card orders did take way longer today than usual

#37 macster on 26 Jan 2003 - 09:26

lazy admins naughty hackers and GREAT microsoft

everyone should be responsible

#38 leebobs on 26 Jan 2003 - 10:15

So it is now comming to an end, by the looks of it. All the admins lost their weekends and have started fixing the 28% of servers which run Microsoft

#39 kjordan2001 on 26 Jan 2003 - 17:27

I'm just glad Neowin got back up, I was freaked when I couldn't reach it

#40 guru on 27 Jan 2003 - 06:12

i literally saw the worm propagating first i couldn't get neowin. then the internet access from my company in india died. then it was the turn of internal networks of the company

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Neowin.net

Virus Overwhelms Global Internet Systems

Share this Article

About the Author

Related news