MASSIVE internet DDOS attacks....

Sorry if this is a repost.



This was taking from the military forums, looks like a all out cyberattack has just started taking place. heres some info

/quoted from forums.military.com/
AmericanIntel
Basic Training

Registered: Friday, 03 January 2003
Posts: 10
MASSIVE DDOS ATTACKS ALL OVER U.S.
------------------------------------------------------------------------ --------
We are monitoring massive Distributed Denial of Service attacks all over the U.S. tonight starting at around 11:30 PM CST. As many as 5 of the 13 root nameserver have been down, up to 10 with massive packet loss (xx%):

Internet Status to Root Name Servers
Date: Fri Jan 24 21:37:00 PST 2003

Place Address Packet Loss Time: Min/Avg/Max
Root b.root-servers.net 53% 25/40/48
Root c.root-servers.net 0% 82/82/82
Root e.root-servers.net 20% 16/29/33
Root f.root-servers.net 26% 17/27/32
Root h.root-servers.net 20% 91/101/108
Root i.root-servers.net 26% 190/199/205
Root j.root-servers.net 26% 81/91/96
Root k.root-servers.net 64% 172/188/201
Root l.root-servers.net 0% 5/5/6
Root m.root-servers.net 33% 160/171/205
GTLD b.gtld-servers.net 26% 52/63/67
GTLD c.gtld-servers.net 31% 85/93/95
GTLD d.gtld-servers.net 13% 88/100/103
GTLD f.gtld-servers.net 22% 38/50/57
GTLD i.gtld-servers.net 0% 198/200/203
GTLD k.gtld-servers.net 24% 90/100/105
GTLD l.gtld-servers.net 33% 128/138/171


All backbone providers are suffering major packet loss (XX%):

Place Address Packet Loss Time: Min/Avg/Max
AboveNet ns.above.net 28% 53/64/66
AGIS ns1.agis.net 26% 62/74/78
AlohaNet nuhou.aloha.net 35% 84/94/98
ANS ns.ans.net 26% 83/97/100
BBN-NearNet nic.near.net 28% 91/114/572
BBN-BARRnet ns1.barrnet.net 26% 16/26/32
Best ns.best.com 35% 79/89/95
Concentric nameserver.concentric.net 35% 18/31/56
CW ns.cw.net 28% 88/98/105
DIGEX ns.digex.net 31% 78/86/91
ENTER.NET dns.enter.net 28% 91/104/108
Epoch Internet ns1.hlc.net 33% 37/48/52
Flash net ns1.flash.net 17% 80/92/94
GetNet ns1.getnet.com 20% 40/52/56
GlobalCrossing name.roc.gblx.net 24% 85/97/104
GoodNet ns1.good.net 31% 83/92/97
GridNet grid.net 20% 80/92/101
IDT Net ns.idt.net 20% 91/104/121
Internex nic1.internex.net 26% 18/31/35
MCI ns.mci.net 22% 91/103/107
MindSpring itchy.mindspring.net 15% 75/88/106
NAP.NET ns2.nap.net 20% 73/85/94
PacBell ns1.pbi.net 0% 89/89/90
Primenet dns1.primenet.net 20% 31/41/45
PSI ns.psi.net 0% 82/84/160
RAINet ns.rain.net 31% 40/49/53
SAVVIS ns1.savvis.net 31% 88/99/102
SprintLink ns1.sprintlink.net 11% 15/27/35
UUNet,AlterNet auth00.ns.uu.net 26% 89/98/103
Verio-West ns0.verio.net 22% 31/42/47
Verio-East ns1.verio.net 22% 86/96/101
VISInet ceylon.visinet.ca 20% 102/116/188
MoonGlobal-ClubNET ns.clubnet.net 0% 0/1/2
MoonGlobal-Netway dns.nwc.net 4% 6/6/7
MoonGlobal-Netxactics verdi.netxactics.com 4% 6/6/7
InterWorld ns.interworld.net 0% 4/4/5


It's massive, no word on source yet. We are watching it closely.

Brad G
American Intelligence
www.americanintelligence.us

its annoying I can't access many sites
According to driverheaven.net

There appears to be a Microsoft SQL Monitor worm spreading. Massive UDP traffic on port 1434 is affecting major internet backbones, including UUNET. Of course, servers and home users are being flooded as well. Many websites are currently inaccessible or slow, depending on your location and ISP

Also on http://netweb.us.keynote.com/1/ you can see the health of the net, UUNET is under the worse of the attacks, it as almost flatlined....

aww.........its really massive.i agree with cheesegoduk.

Well hell.......I just came off of one of the worst weeks ever (server crashes, frame relay died.....etc.) and now instead of a Saturday, I get to head in and see what got hit.

This is the second time that the root nameservers have been attacked in recent months. Would adding more root name servers help out or would that just spread the denial of service attacks to those name servers as well????

im getting packet loss from london gateway to washinton, then 100% loss at At+t, i done some scouring and found a cnn report, its been put across as another code red

http://www.cnn.com/2003/TECH/interne....ap/index.html

Preep

This doesn't attack the root servers directly, it's the traffic that the worm generates while trying to propagate itselft that DOSes routers and hosts...

Right now I'm seeing about a worm packet (well actually "datagram" since it's udp) hit our firewall about every 5 to 30 seconds. It was about one every 2 to 15 seconds...

Actually I'm surprised it's not more discussed here on AO...

Ammo

Well, i'm having problems getting through Antionline.com also, leave alone others.

Other intersting monitoring sources:

http://www.internethealthreport.com/
https://gtoc.iss.net/issEn/delivery/gtoc/index.jsp (WOW! they just went to AlertCon 4 (they were at 3 an hour ago!)
http://www.symantec.com/avcenter/ven...lexp.worm.html
http://www.boredom.org/~cstone/worm-annotated.txt (worm analysis)
http://average.matrix.net/

Ammo

Massive traffic on UDP 1434 is coming across my front door, this is a bad one guys heads up

Even though the ISP I used appears to have missed
the bullet overall with no extra bandwith useage......
My one server has been getting over the last
week, a problem of server overload......
Maybe I need a bigger server!!! or more memory!!!

It looks like UUNET Dallas TX has been getting hit real hard.

Personally I think Bill Gates should pay the bill for writing
bad software... and not fixing it right. Setting up defaults
to let the world in instead of keeping the world out is DUMB!

Sources on the attack....

Maybe it is Binladen
North Korea
Iraq
Iran
Lybia

Maybe it is none of the above.... It is just script kiddies
or real stupid Admins who never patch their systems.

I just did a check of my logs on 6 different Linix boxes
and found my Nimda probes are up by 10 times...
on all but 1 of my boxes I admin

Hmmmmmm!!!
:confused:

im just curious what services run on udp port 1434 that makes it so vulnerble, is it just the port that the worm is set to move on? or is it some thing else? also i ran a netstat -an and i dont have anything running on port 1434, and i use mediacom...so my question in short why am i not being affected and you guys are?

If only 22,000 administrators had patched their systems responsibly like they should... *sigh*

For the patch, go here: http://www.microsoft.com/technet/tre...n/ms02-039.asp

Anyone who is running the SQL server and is not patched, do the Internet a favor and please go to that address and install the patch if you haven't already.

It only effects people running MS SQL Server.

http://isc.incidents.org/analysis.html?id=180

Gotta love getting woke up at 3am cause some wanker decides to release something like that. Basically memory resident worm only. Rebooting the machine will remove the infection; however, unless you patch it, you are just as vulnerable and will get infected rapidly again. Blocking udp/1434 at your gateway is quite effective. The above aritcle gives snort signatures and methods for correction.

Installing SP3 for SQL 2000 should correct it.

http://www.microsoft.com/sql/downloads/2000/sp3.asp
http://vil.mcafee.com/dispVirus.asp?virus_k=99992

/nebulus

quote from bugtraq:

Quote:

---

A worm which exploits a (new?) vulnerability in SQL Server is bringing
the core routers to a grinding halt. The speed of the propagation can be
attributed to the attack method and simplicity of the code. The worm
sends a 376-byte UDP packet to port 1434 of each random target, each
vulnerable system will immediately start propagating itself. Since UDP
is connection-less, the worm is able to spread much more quickly than
those using your standard TCP-based attack vectors (no connect
timeouts).

Some random screen shots, a copy of the worm as a perl script, and a
disassembly (sorry, no comments) can be found online at:

http://www.digitaloffense.net/worms/mssql_udp_worm/

-HD

---

for them geeks who can read assembler ;)

Even a well patched sql server has some interference with this... Mine was patched and still it acts crazy... so get the patch if you haven't already and if you want drop udp packets for ports 1433 and 1434 both in and ourgoing, till it's ok again.

to ammo: sorry to say it, but I think most people on AO don't know what the hell we're talking about, and the ones that do know are somewere else reading places were it does get discussed :/

oh its ONLY for servers running microsoft sql, i was underthe impression that it was the back bones that was getting hit , which they are, but because of that EVERYONE was getting hit, not just M$ users, thank you for clearing that up for me nebulus200, i appreciate it.

Yeah, well my openBSD box does get hit, but it isn't as damaging as to the windows box... It's still anoying though to get those packets... maybe only for my firewall logs get long and it is spoiling my time.

Quote:

---

to ammo: sorry to say it, but I think most people on AO don't know what the hell we're talking about, and the ones that do know are somewere else reading places were it does get discussed :/

---

Yeah, I guess... Actually, I am one of those who's reading about it elsewhere where it get's better coverage...

Quote:

---

Originally posted here by hatebreed2000
oh its ONLY for servers running microsoft sql, i was underthe impression that it was the back bones that was getting hit , which they are, but because of that EVERYONE was getting hit, not just M$ users, thank you for clearing that up for me nebulus200, i appreciate it.

---

Well, is aimed only at MS SQL servers, ie: only MS SQL servers can get "infected/compromised" by the worm, HOWEVER, everyone feels its effects because of the huge amount of traffic it generates while trying to spread itself; this leads to core routers backbone links being overloaded and results in legitimate traffic not getting through.

Ammo

thank ammo i now understand, just an after thought though. i know admins have a tough job, having to keep upto date with patches and fixes and what not but, i remember when this patch came out, cant say i ever would have guessed soem one would use the exploit to such a large scale, but now maybe the admins will keep the patches more upto date,.........even though its really not there fault, cause M$ is crap, but at least now they will know that M$ is crap and will proceed with caution from now on.

Quote:

---

Originally posted here by hatebreed2000
thank ammo i now understand, just an after thought though. i know admins have a tough job, having to keep upto date with patches and fixes and what not but, i remember when this patch came out, cant say i ever would have guessed soem one would use the exploit to such a large scale, but now maybe the admins will keep the patches more upto date,.........even though its really not there fault, cause M$ is crap, but at least now they will know that M$ is crap and will proceed with caution from now on.

---

Well you'd think they'd have learned after Code Red and Nimda, but apparently not... It's sad really. What I don't understand is how they can sleep at night with an MSSQL server exposed on the net!! Heh.. beats me...

Ammo

HAHA yeah, lucky me my microsoft box is just for the testing of some servering things and etc. My openBSD and gentoo boxes don't have anything exposed exept the things people really are allowed to touch. Setting up yer firewall the right way could have fixed this for some part before it begun. I put the loggin of for ports 1433 and 1434, wich is a bit stupid, but that way I can be lazy and secure at the same time :o

305 hits to 1434 since 12:30AM here in Toronto. Averaging 20 hits/hour for now.

Jan 13th took 330 hits to port 445. This new one should surpass that.

I haven't noticed a drop in net speed here though.

Does this SQLping.c have anything to do with this?

Recent Exploits Scripts/Techniques (starting bottom of page 7 into page 8 (middle of table under date March 15th, 2001))
It's just a description of some packet tool but, it's listed under exploits, so it caught my attention.
http://www.nipc.gov/cybernotes/2001/...sue2001-06.pdf

I am at Tennessee Tech University and their routers got hit hard enough it knocked us offline for a few hours this morning. Even now not all of the campus is back up yet. It's crazy. We have been in the Comp. lab all day and stuff is now a little bit better.

Internet Security System (ISS) was the first to discover and name a new worm it is tracking - “SQL Slammer” - that is rapidly spreading across the Internet via Microsoft SQL servers.

The worm is responsible for large amounts of Internet traffic as well as millions of UDP/IP probes causing the Internet and online service to be inaccessible.

•Reports of major Internet Service Providers (ISPs), banking services and telecommunications worldwide have been affected
•Severe latency in domain name service (DNS) causing Web sites to be completely unreachable
•Other nations affected include South Korea’s Internet infrastructure which has come to a stand still

This worm exploits MS/SQL servers vulnerable to the SQL Server Resolution service buffer overflow (CVE CAN-2002-0649). Once a vulnerable computer is compromised, the worm will infect that target, randomly select a new target, and resend the exploit and propagation code to that host.

ISS X-Force team responsible for the discovery and naming of this worm are available to provide help at: https://gtoc.iss.net/issEn/delivery/gtoc/index.jsp

Impact:
The Slammer is generating a damaging level of network traffic when it scans for targets that are vulnerable. Billions of attacks have been detected in the last 12 hours from ISS Global Threat Operations Center (GTOC).

Affect Versions:
Microsoft SQL Server 2000
Microsoft Desktop Engine (MSDE) 2000
Note: Unpatched or base installations older than SP3 are vulnerable.

Description:
The Slammer worm propagates via Microsoft SQL installations without patches from Microsoft Security Bulletin MS02-039 or higher. The main function of the Slammer worm is to continue propagation. No Denial of Service or backdoor functionality is incorporated into the worm. Infection can be removed with a reboot, however without protection in place, it is likely that vulnerable servers will be quickly re-infected.

The Slammer worm seeks to replicate itself and does not try to compromise servers or retain access to compromised hosts. The Slammer worm does not infect or modify files, it only exists in memory.

Warning: Anti-virus programs do not detect nor stop this worm.

Recommendations:
The ISS Dynamic Threat Protection platform has protected ISS customers for this major vulnerability for 6 months.

Protection mechanisms have been available in RealSecure Network Sensor XPU 20.4 and XPU 5.3 and Internet Scanner XPU 6.15 (available as of 7/25/02).

ISS X-Force recommends that system administrators immediately take steps to protect their networks. To remove the infection, apply the necessary patches listed below and restart the server. This action will remove the worm from memory.

The following ISS updates address the issues described in this alert.
These updates are available from the ISS Download center
(http://www.iss.net/download)

Additionally ISS X-Force recommends blocking UDP port 1433 and 1434 traffic to protect SQL Server databases with a firewall or packet filter.

Microsoft SQL Server customers should refer to the following address for
information and securing Microsoft SQL Server against this buffer
overflow: http://www.microsoft.com/technet/sec.../MS02-039.asp.

Additional Information:
The Common Vulnerabilities and Exposures (CVE) project has assigned the Name CAN-2002-0649 to this issue. This is a candidate for inclusion in the CVE list http://cve.mitre.org), which standardizes names for security problems.

Additional Links:
ISS: Security Center: X-Force Threat Forecast
https://gtoc.iss.net/issEn/delivery/gtoc/index.jsp

Microsoft SQL Slammer Worm Propagation
http://bvlive01.iss.net/issEn/delive....jsp?oid=21824

ISS Advisor community feedback
http://www.issadvisor.com

______
About Internet Security Systems (ISS)
Founded in 1994, Internet Security Systems, Inc. (ISS) is a world leader in Dynamic Threat Protection software and services that protect critical information assets from an ever-changing spectrum of threats and misuse.Internet Security Systems is headquartered in Atlanta, GA, with additional operations throughout the Americas, Asia, Australia, Europe and the Middle East.

I live in Australia and am thus far unaffected from this virus like worm. anyway,

hope you peoples find out who's doing it and getting through it safely

VIRUS WARNING ISSUED BY CENTRALCOMMAND®
on January 25, 2003
for W32/SQLSlammer

VIRUS WARNING The Central Command® Emergency Virus Response Team™ (EVRT™) has received thousands of virus infection reports for the new Internet W32/SQLSlammer. Due to increased customer inquires and infection reports the EVRT is issuing a VIRUS WARNING.

Help us defeat viruses, forward this newsletter to your friends.

You are receiving this news letter because you are a subscriber to the Central Command Virus News mailing list.

[ EVRT™ Virus Warning issued for W32/SQLSlammer ]

Complete description can be read online by clicking here

Details:

Name: W32/SQLSlammer
Alias: SQL.Slammer
Type: Worm
Discovered: January 25, 2003
Home users: LOW RISK
Corporate users: HIGH RISK

Description:

W32/SQLSlammer is a fileless worm that targets Microsoft SQL 2000 servers. If a vulnerable server is found, W32/Slammer installs itself into memory and does not write a file to the hard disk. An exploited server will then create traffic on UDP port 1434. To correct and fix an affected server an administrator will have to apply the necessary patch to avoid re-infection and reboot the server.

This worm can generate massive IP traffic to effect the quality of service of the network.

Microsoft has issued a patch which protects users against this vulnerability. It can be downloaded from here:

Microsoft patch and information


[ Vexira Antivirus Solutions ]

- Vexira Antivirus for Windows workstations/desktops
- Vexira Antivirus for Windows Server
- Vexira Antivirus for Linux Server
- Vexira Antivirus for Linux Workstation
- Vexira Antivirus for FreeBSD
- Vexira Antivirus for OpenBSD
- Vexira Antivirus for Sendmail
- Vexira Antivirus for Sendmail + Milter
- Vexira Antivirus for Qmail
- Vexira Antivirus for Postfix
- Vexira Antivirus for SuSE
- Vexira Antivirus for Exim

More information: http://www.centralcommand.com

[

This new attack would of been no big whoop if frigging sys admins would apply the damn patches that they are supposed to. This is expoiting something that M$ reported on last
year for crying out loud.

taken from: http://www.unerror.com/

Quote:

---

Well, today has proven how many lazy or unaware webadmins this world has. A worm who exploits an exploit in MS SQL. The point is: there already was a patch for the vulnerability and it's just a fact MS flaws get patched less fast then linux. That means very many admins don't track mailinglists, who have been talking about this problem and as many of them also don't track patches etc. for the software they use.
Because of this "lack" of interest in security the worm was able to spread very widely. Because the worm work with datagrams (via udp), it spreads much faster then worms traveling by tcp. Udp doesn't require to wait for a acknowledge responce or a message that says the packet has arrived proparly. The danger with that is, because of the "lazyness" (how would you call it) of many admins and other people the worms olso threaths dns servers routers etc. with their extreme bandwith consumeing activities (that's what a worm does).
Every sql server does get some interference with this, because it still get's targetted at port 1433 and 1434, so firewall logs may grow large... that means if your firewall was setup correctly... you guessed it, that's often NOT the case. Those server will still have a little slow down because of the incoming packets. Nothing would be harmed if the worm hadn't been able to spread.

---

this is a classic example of admins not doing their job properly .. this would never have happened if the admin could keep uptodate with their OS patches. pretty much everything these days is a result of poorly educated (or well educated but lacking in certain areas) administrators

Some "aftermath" links:
http://www.eeye.com/html/Research/To...pphireSQL.html (scanner for the worm)
http://www.techie.hopto.org/sqlworm.html (analysis of the worm, I didn't read it yet, but it looks pretty complete)

ScanSlam - SQL Slammer vulnerability scanner
This tool scans for systems that might be vulnerable to the SQL slammer worm and can be found @
http://www.iss.net/support/product_u...sqlslammer.php

www.issadvisor.com