Slashdot Mirror
New "SQLsnake" Microsoft Worm
sevenn writes "A new worm, targeting the Microsoft SQL daemon, has been sweeping the net. It uses massive scanning, default passwords, exploits against vulnerable versions and even attempts to brute force passwords.
Here is the (vague) Microsoft bulliten,
the SANS analysis,
and a securityfocus article"
Already over a thousand compromised system- you're apparently only vulnerable
if you run MS SQL, but the worm is causing a substantial spike in traffic to
port 1433 on the net.
<sarcasm>
Holy shit! A flaw in microsoft software? How did this happen???Arent Microsoft systems the most secure systems available???
</sarcasm>
GOD DAMNIT , MODERATE ME!
I'm waiting for the day when people stop saying "We got another worm." and start saying "We just got Microsofted again".
Outdoor digital photography, mostly in New Engl
Some of the DBA's I have worked with love a blank SA password. They also love to write scripts that attach with SA and a blank password. I hope this will teach them to stop being stupid...
I guess they can use next.
What OS do you want to abuse today?
A massive "unlocked door" worm has been ravaging users of Schlage locks. Aparrently hackers have been breaking into houses with Schlage locks installed. 9 out of 10 users were found to have installed the locks but never engaged the locking mechanism, and many times had left the key in the knob.
I've got the bandwidth. If we all set up something like this, maybe it'd hurt a little bit, and compromised systems will be slowed more, and maybe be noticed.
/etc/services:1433 1433/tcp wormstomper #crapflood
/etc/inetd.conf:wormstomper stream tcp nowait dd if=/dev/katz wormstomper
is that like gangsta?
"chillin in the hood with the SQLSpida..."
Looking for Book Reviews? Check out Literary Escapism.
Christ, don't you ever READ what you post!!!
> Already over a thousand compromised system
Grepping my firewall logs for hits to port 1433, I find 1078 hits since midnight, from 39 unique IP addresses.
The majority appear to be dynamic residential addresses -- attbi.com, swbell.net, pacbell.net. Only a few resolve to static addresses. Here's one of the sites that probed me:
http://210.90.207.4/admin.inc
LMAO!
Why The X-Box Network Will Fail
New "SQLsnake" Microsoft Worm
yuk yuk yuk etc
By the time you finish reading this sentence will end.
Well, I'll just wait here for that...
---- It puts the lotion on its skin or else it gets the hose again. It does this whenever it's told.