MS SQL Server Worm Wreaking Havoc

defile writes "Since about midnight EST almost every host on the internet has been receiving a 376 byte UDP payload on port ms-sql-m (1434) from a random infected server. Reports of some hosts receiving 10 per minute or more. internetpulse.net is reporting UUNet and Internap are being hit very hard. This is the cause of major connectivity problems being experienced worldwide. It is believed this worm leverages a vulnerability published in June 2002. Several core routers have taken to blocking port 1434 outright. If you run Microsoft SQL Server, make sure the public internet can't access it. If you manage a gateway, consider dropping UDP packets sent to port 1434." bani adds "This has effectively disabled 5 of the 13 root nameservers."

Comments

Who did this I wonder?????

[amigaluvr]

Kevin Mitnick is allowed back on the net and the net goes fubar

Re:Who did this I wonder?????

[Anonymous Coward]

It was not Mitnick.

I investigated into this matter, and came up with the following theory.

Port 1434 = 1+4+3+4 = 12

12 is the number of the month when Steve Gibson got hired as a consultant. Coincidence? I think not!

SQL (alphabet numbered) = S(19) + Q(17) + L(12) = 48

48 is the number of states which are connected together on US map. That means that attack came either from Hawaii or Alaska.

Using the search on a popular site called Google, I was able to track down the perpetrator.

So at the end we are left with one answer: Steve Gibson is just hax0ring back, in an elaborate revenge plan to outlaw port 1434 and raw sockets.

Re:Who did this I wonder?????

[TheTomcat]

How do we get back??

I know..

HACK THE GIBSON

erm..
nevermind..

S

Re:Who did this I wonder?????

[zogger]

--I thought this too, but I mean semi seriously. I stayed up real late watching it to make sure it wasn't a 'war' prelude. All the second world potential badguys have a cyber attack part of their assymetrical warfare plans, that's just freely available data you can read about.

My "oh crap,no internet" communications plans are a heap-o shortwaves and scanners. Better than nuthin. I know all the commercial am and fm and tv stations will all get taken over by the fema boxes, and start spewing dotgov propaganda (moreso than normal), so I'd be more monitoring some more "unregulated" sources.

Re:Who did this I wonder?????

[FenderGeek]

Aw man, now I went and spit Coke all over my keyboard! Hey wait... Gibson makes guitars. Guitars are played by musicians. Musicians with contracts work for a record company. Record companies are in league with the RIAA! The RIAA is doing this to keep me from my mp3s!!

Re:Who did this I wonder?????

[jpop32]

My dumbass is actually running SQL Server 2000...my switch was lit up completely. I've never seen the traffic light glow more solid than the connection light.

Well if you took the time and installed the patches (which have been out for some time, also included in SP3, BTW), you wouldn't have been a part of the problem, you would have been a part of the solution.

Leave it to Mircosoft to crash the internet.

Leave it to the lazy and incompetent, I say...

Terrorism, must be

[isorox]

In South Korea internet services were shut down nationwide for hours on Saturday, the country's Yonhap news agency reported.

It said the shutdown was triggered by "apparent cyber terror committed by hackers".

http://news.bbc.co.uk/1/hi/technology/2693925.stm

Re:Terrorism, must be

[weave]

Terrorism? Bill Gates better be detained indefinitely as an enemy combatent then. Finally, some good may come out of this terrorism paranoia!

Re:Terrorism, must be

[hardcode]

In South Korea internet services were shut down nationwide for hours on Saturday, the country's Yonhap news agency reported.

And every email admin in the western world heaved a sigh of relief

Re:Terrorism, must be

[Nogami_Saeko]

Not to mention every starcraft and diablo player :P

N.

Re:Terrorism, must be

[JebusIsLord]

What starcraft/diablo players exactly? They said Korea was down for chrissake!

Re:Terrorism, must be

[t]

Uh no. Having a nuke and being able to deliever that nuke are two entirely different problems. The nukes that were dropped on Japan were literally dropped. A plane flew overhead and dropped them. North Korea does not and will not have the ability to deliver a nuke to the US.

If it is ever proven that North Korea has nuclear bombs, then that will hasten their demise. Probably at the request of Japan and South Korea since they are realistically the only countries close enough to be in danger.

As I said in a previous post...

[caluml]

I find it lucky that the worm writer didn't make the worm fire out random traffic on random udp ports with spoofed addresses.

It's only the fact the traffic is all destined for a certain destination port that makes it easy to filter.
You are filtering it out on your firewalls, aren't you?
/sbin/iptables -I FORWARD -p udp --dport 1434 -j DROP

This could have been a lot lot harder to filter out. I expect we'll see ThisWorm v2 soon.

I dread the day someone finds a hole in Apache, Sendmail or something really popular and writes a worm like this...

Re:As I said in a previous post...

[bwalling]

It's only the fact the traffic is all destined for a certain destination port that makes it easy to filter.
You are filtering it out on your firewalls, aren't you? /sbin/iptables -I FORWARD -p udp --dport 1434 -j DROP

Exactly. From the MS Security bulletin:

The risk posed by the vulnerability could be mitigated by, if feasible, blocking port 1434 at the firewall.

What the heck was it doing open in the first place?

Re:As I said in a previous post...

[sql*kitten]

You are filtering it out on your firewalls, aren't you? /sbin/iptables -I FORWARD -p udp --dport 1434 -j DROP

I bloody hope no-one is specifically blocking this port. That's not how firewalls are supposed to be used. First you block everything then only open the specific ports you need. In most cases, these are 80 and 22 and maybe 25. There's no reason a database server's protocol port should ever be exposed to the public Internet!

Re:As I said in a previous post...

[caluml]

Wouldn't it be nicer if the owners of these machines bother patching the fucking things though?

As far as I'm concerned, boxes SHOULD be able to stand on their own without firewalls. A firewall just adds another layer.

Sounds like you're advocating armadillo security to me - hard on the outside, soft on the inside.

Re:As I said in a previous post...

[blowdart]

What the heck was it doing open in the first place?

Because sometimes you need to connect to SQL from somewhere outside the local LAN? For example, we have SQL passed logging services running in Sydney that connect back to a SQL server in London. Of course, inbound connections are limited to the correct address range.

Re:As I said in a previous post...

[Anonymous Coward]

Depends. If you're protecting your network, you are right: "allow required traffic, block everything else". If you're providing network services to others, they probably don't want to beg you everytime they need to open a port. In that case it's "filter bad traffic, allow everything else".

Re:As I said in a previous post...

[caluml]

No, firewalls are for use as your needs require.
I, for instance allow no incoming, but don't restrict outgoing. It's not a huge corporation, it's a R + D lab, where the overhead and hassle I'd cause by restricting outbound traffic would stiffle the lab users productivity. Still, I added the block to that specfic port in the slim chance that an internal box was infected (lord knows how) that it would be a localised problem, not contributing.

I don't think you should tell people what firewall rules they should be running.

Re:As I said in a previous post...

[blowdart]

There's no reason a database server's protocol port should ever be exposed to the public Internet!

No reason? Really? What about distributed servers taking to a central database? Desktop software that queries a remote database? Remote administration of a remote database? All legitimate reasons.

Re:As I said in a previous post...

[bwalling]

Because sometimes you need to connect to SQL from somewhere outside the local LAN? For example, we have SQL passed logging services running in Sydney that connect back to a SQL server in London. Of course, inbound connections are limited to the correct address range.

If you limited the IP address range, then you don't have it open. You have controlled access to the resource.

Re:As I said in a previous post...

[Anonymous Coward]

What the heck was it doing open in the first place?

When the SQL Server 2000 client Net-Libraries connect to an instance of SQL Server
2000, only the network name of the computer running the instance and the instance
name are required. When an application requests a connection to a remote computer,
Dbnetlib.dll opens a connection to UDP port 1434 on the computer network name
specified in the connection. All computers running an instance of SQL Server 2000
listen on this port. When a client Dbnetlib.dll connects to this port, the server
returns a packet listing all the instances running on the server. For each instance,
the packet reports the server Net-Libraries and network addresses the instance is
listening on. After the Dbnetlib.dll on the application computer receives this
packet, it chooses a Net-Library that is enabled on both the application computer and
on the instance of SQL Server, and makes a connection to the address listed for that
Net-Library in the packet.

So the UDP 1434 port is open when the SQL Server is started to listen all the clients
with any IP address on this port. SQL Server only receives the packet from the client
on this port to determine which instance the client attempts to access and return the
related information of the SQL Server to the clients. Then, the clients can create
the connection to the SQL Server with the protocol enabled on the server side.

Re:As I said in a previous post...

[tom.allender]

Consider a VPN dude.

Re:As I said in a previous post...

[caluml]

Firewalls promote softer security.

"Oh, it's OK because it's behind the firewall..."

I think firewalls make people lazy. Imagine if we didn't have firewalls. We'd have to keep our passwords good, our services minimal, and make sure we were running the latest, most secure daemons.

Re:As I said in a previous post...

[Fembot]

Actualy I suspect most ISP's probably operate a policy of blocking only problem ports. Imagine how annoying it would be if your ISP/coloc host blocked everything except http, telnet and smtp on the grounds that one day there might be a vunerability in some of the other services that run on other ports... I suspect they wouldnt be my coloc host for long at all

Re:As I said in a previous post...

[sql*kitten]

No reason? Really? What about distributed servers taking to a central database? Desktop software that queries a remote database? Remote administration of a remote database?

That's what VPNs are for, my friend.

Re:As I said in a previous post...

[sporty]

Actually, then the firewall rules are screwed up. If there is an ISP with billions and billions of servers, the firewall should block all traffic to the servers while routing all traffic to specific subnets. Block first, allow through later.

Re:As I said in a previous post...

[Lawrence_Bird]

Isn't this an unprivledged port? If you block all of those to start many of your inet based programs that open random/rangebound high port #s wont work at all. Perhaps somebody more knowledgeable about what to do with ports > 1024 can comment?

Re:As I said in a previous post...

[silas_moeckel]

That depends on what sort of routers they are using. A lot of Cisco gear an others have overhead running ACL's (first Cisco that can do compiled is a 7200 I think) so you want to accept/deny your most common traffic first so your router dosent die when your throughput goes up.

Re:As I said in a previous post...

[bwalling]

So the UDP 1434 port is open when the SQL Server is started to listen all the clients
with any IP address on this port. SQL Server only receives the packet from the client
on this port to determine which instance the client attempts to access and return the
related information of the SQL Server to the clients. Then, the clients can create
the connection to the SQL Server with the protocol enabled on the server side.

There is a difference between a port being open on the machine the service is on and the port being open to the world. You should not leave this port open to the world. If people outside your firewall need access to your internal MSSQL server, you leave TCP 1433 open to selective hosts.

Re:As I said in a previous post...

[Zeinfeld]

Firewalls promote softer security.

I have argued for many years that people tend to get the idea that a firewall is some kind of +8 amulet of protection they just strap on which will protect them from pretty much anything.

However there are real benefits to using firewalls and NAT boxes. Unfortunately there are some members of the IESG who are confused on this point but thats because they are blinkered by the end-to-end dogma. I'll note here that Steve Bellovin, the new security AD knows a thing or two about firewalls.

There are actually two end-to-end principles. Applied to networking it meant put the intelligence at the ends, not in the middle of a communication. This was applied to security to mean the same thing.

End-to-end is appropriate to the design of network protocols, it is inappropriate as a guide to operational security. Many protocols are not designed securely, most protocol implementations have flaws.

Another dogma that is inappropriate to operational security is the 'security through obscurity' trope. A design that relies on security through obscurity is broken. This does not mean that operators should divulge all the details of their operations to attackers in the hope this will improve security, it will not. Argument of this type was used to block the introduction of shadow passwords on UNIX for years after the vulnerability to dictionary attacks was widely known and being exploited by attackers.

A firewall and NAT box provides a significant degree of security at low cost. NAT provides a means of concealing the internal structure of the network. This does not eliminate the possibility of attack but raises the bar significantly. If you are running a site that is considered attractive to hackers a technology that weeds out the knob turners and dimmer script kiddies has value.

What we need to move to is security in depth, recognizing that design security and operational security are different and that both are important.

Re:As I said in a previous post...

[Dudio]

I wouldn't say firewalls make people lazy; it's more a problem of people not understanding security.

These people are just as likely to say things like "I'm 3DES encrypting my data, so there's no way anybody can read it", because they fail to understand the meaning of statements like "cracking 3DES is computationally infeasible". When you try to explain to them that their webserver and applications are much more likely to be their weakness than their encryption algorithm, they give you blank looks and mutter about the Computerworld article that said 3DES is "unbreakable encryption". It's not a problem with 3DES (or any strong algorithm); it's a problem with people not understanding that any security measure can be negated by poor design in other parts of their architecture.

It's the same thing with firewalls. Only the unknowledgable would drop in a firewall and then go off to the bar to celebrate their newly "secure" network. That doesn't mean that the firewall is useless; it is still a crucial tool for securing one's network. The problem is the people who have no idea how to use the tool properly, and no concept of what a real-world attack actually looks like.

Re:As I said in a previous post...

[DarkZero]

Imagine if we didn't have firewalls. We'd have to keep our passwords good, our services minimal, and make sure we were running the latest, most secure daemons.

Locks promote softer security.

"Oh, I'm OK because I have locked doors and windows..."

I think door locks make people lazy. Imagine if we didn't have deadbolts, or doors for that matter. We'd have to sit in front of the front door, with a shotgun, never sleeping for more than a few moments.

Re:As I said in a previous post...

[DavidTC]

One of the best thing you can do with a firewall is something it's hard to do with a desktop machine...LOG.

This adds a third layer of security, in addition to the 'secure firewall' and the 'secure desktop'. If, god forbid, someone gets through your firewall, you'll at least know it.

And I'm talking about logging outgoing traffic, also. After all, if your firewall is set up correctly you can't have any random incoming traffic...but you'll have lots of outgoing. They have NIDS to detect suspicious traffic, or you can just get a huge dump and start filtering out things you know are okay.

And it's about the only way you'll ever catch that some idiot is running an ICQ from three years ago with a known buffer overflow or something stupid. Neither firewalls nor updated desktop machines can protect you from your own users, only log files of network traffic can do that.

Re:As I said in a previous post...

[Dr. Photo]

Sounds like you're advocating armadillo security to me - hard on the outside, soft on the inside.

Mm... sounds like them's good eatin'! :D

Re:As I said in a previous post...

[Cramer]

Slight correction: compiled access lists are a function of the software (even a the lowly 2500 can have compiled ACLs)

The problem with ACLs on most Cisco gear is where it gets processed. On all but the most recent (and very expensive) hardware requires all the packets to pass through the RSP or NPE if an access list is applied. I forget what the conditions are for ACLs on a 75xx VIP -- everytime I've been forced to filter traffic it's been process switched through the RSP (it isn't designed to move packets -- it's designed to manage routing) If you happen to have a 7400/7600/NSE, then it's a different story; most of the things needed to filter IP traffic are PXF accelerated.

The next time someone steps up to say "let's just filter..." cut them off at the word filter. Routers are routers; firewalls are firewalls. Routers are designed to move packets (quickly), not block them. Firewalls are designed to block packets, not move them. Switches move millions of packets per second. Routers move hundreds of thousands of packets per second. Firewalls move around 1000 packets per second.

Re:As I said in a previous post...

[Zeinfeld]

One of the best thing you can do with a firewall is something it's hard to do with a desktop machine...LOG.

The problem with logging is that it is usless unless you actually review the logs. This rarely happens until after a site has been compromised.

Much more useful is to have the firewall connected up to a 24x7 monitoring, or better management service like Counterpane, VeriSign or whatever.

Over time I expect that cost of high end firewalls to drop significantly. I have two firewalls at home, neither cost more than $200 and they are both pretty adequate for my needs. So why does an enterprise setup cost $80K rather than $4K or so?

Re:As I said in a previous post...

[Tassach]

There's no good reason whatsoever for a database server to connect directly to the internet - it should only accept connections from trusted hosts. You never let an untrusted application talk directly to the database - if they need to query the database it should be proxied by a piece of middleware. Any DBA who says otherwise is an incompetent idiot.

You put your webserver on a DMZ, and let it (and only it) talk to the database server through the firewall. Any 2-tier client-server app should be going through a VPN or other secure tunnel.

The only way to do security is to have multiple layers, and to ruthlessly apply the priciple of least privilidge (you get only those permissions you ABSOLOUTELY need and nothing more).

Re:As I said in a previous post...

[Anonymous Coward]

This is a bad analogy. A better analogy is this:

I don't need to lock any doors in my office building because we have a security guard at the front door.

Firewalls promote an all-or-nothing way of thinking that I routinely encounter at work. Firewalls only mitigate the risk of running insecure services, but the false assurances of perimeter security they offer frequently lead to a careless internal security posture, vulnerable both to insider attack and firewall failure/misconfiguration.

Re:As I said in a previous post...

[GigsVT]

This is not a dig at you, but since when did DMZ mean "completely unrestricted access to and from the Internet"?

I'm seeing this a lot lately, I think I first saw it when there were some of those home hardware NAT/router/dhcp boxes, if you put a server in "DMZ", it really means totally unprotected.

At work, I use a two firewall setup, and I call the area between the two firewalls the DMZ. The computers there have real routable IPs, but most of their ports are filtered, except the ones they need open. Every doc I read about firewall setup a few years back referred to these filtered hosts as DMZ also.

So when did the meaning change?

Re:As I said in a previous post...

[Rain]

There are two reasons an enterprise setup costs so much:

1. Fear sells.
   Seriously. I would guess that some of the most succesful marketing strategies are based on this fact.
   
2. Industrial grade equipment is expensive.
   
3. I've worked for a few ISPs, and I can tell you right off that this is another large factor. If you take, for example, Cisco's equipment--The hardware can get
4. very expensive; however, hardware failures are very rare. This is important when downtime =~ lost money.
   

(otoh, IOS isn't always the most stable piece of software, but I tend to run LD/ED releases because I need the features, roughly equivalent to beta versions. A software failure is also much less of a catastrophe than a hardware failure--it's much faster to restart a router than to wait for hardware.)

While a Linux/BSD box running iptables/ipf is dirt cheap, it's not hard to imagine why it might not sit well with the suits in larger companies. I would wager that PC hardware isn't quite as reliable, either--especially since nearly all hardware firewalls/routers use flash as the primary means of storage rather than a hard drive.

Re:As I said in a previous post...

[duffbeer703]

Middleware is another name for "Proxy Server" or "Firewall". Having middleware adds security as long as the application is designed well.

In general, middleware, firewalls, proxies, and VPNs add to overall security. They do this by pushing the most important piece of the overall system, the database and data as far away from the public as possible.

In many cases though, a 3-tier or similar configuration adds more needless complexity which creates more problems then it solves. I recently did some work at a datacenter that provides directory services for a large (500,000 user, 350,000 host) enterprise. This datacenter literally has two racks of PIX firewalls providing access to one rack of LDAP servers!

Whether a "hacker" or an admin makeing a mistake takes down access to a web or middleware server which denies access to data, the application is still down.

There is no general rule to "secure" services -- you need to make an intelligent decision based on your budget, staffing and application. Multi-layered, locked down configuration cause plenty of grief to regular users and often pose no challenge to intruders, who exploit bugs to get full access to everything anyway.

In plenty of cases a single, secureed server providing all services is a simpler and affordable solution.

Re:As I said in a previous post...

[duffbeer703]

One of the big problems with applying Microsoft patches, is that Microsoft uses patches to push unpopular and/or useless software on people.

For example, applying security hotfixes to Windows XP causes MSN Messenger to be installed, even if it was previously removed. This practice got a Microsoft infantry mobile-computing solution to be disqualified when Outlook Express and MSN Messenger were installed to Army XP-Embedded machines.

If you blindly apply MS patches to a mission-critical system, you're nuts. If you have the time to verify the multitude of MS patches as they come, you are probaly soon to be unemployed.

been watching this all night

[h2odragon]

the fun's almost over now

Collected a packet disasembly and some urls here.

Everyone seems to be assuming this is a new use of an old (July) hole; I'm not certain of that. Any facts welcomed, see above url.

Re:been watching this all night

[numatrix]

I'm relatively sure it ~is~ the old vulnerability. Notice in your very own hex dump.

It starts off with 04 (the same hex byte as in my IDS signature for the Server resolution service buffer overflow everyone thinks this is) and then a bunch of padding with 0101. I myself am skeptical based on volume alone how this could be an old vulnerability, but remember, Code Red and Nimda were old too, and they didn't have any problem finding lots of new hosts very quickly.

Re:been watching this all night

[Anonymous Coward]

You have been watching this all night?

Man that is sad.

I have been banging hot chicks all night. Gimme yer phone # and I will hook ya up with some of my hot and slutty ho's.

Re:been watching this all night

[Graspee_Leemoor]

" been watching this all night...
the fun's almost over now"

I sincerely thank you, Sir or Madam. I previously thought that I was the most sad, laughable figure in the entire world, but now, having read your post, which conjures up images of someone sitting in front of their monitor, snacks in hand, gasping in amazement at the output of tail -f on their firewall log all night, I know that there is yet hope for me.

graspee

Patch

[sql*kitten]

Microsoft released a patch for this 24th July, 2002.

Re:Patch

[clifyt]

"Does anybody get to be a sysadmin? IANASA, but I keep up with this stuff fairly regularly. It ain't hard."

Sure...in most of the real world, most of us have several duties. I am in charge of programming, system administration, web design, research, and a slew of other things associated with computers. In a sense, M$ makes their servers so that folks CAN be more productive...I know Unix and can admin the machines somewhat (been using it since the mid 80s) but its NEVER point and click like Wind'rs.

I have a small team of folks that are constantly rotating because we don't have the money to keep them on indefinately, and as soon as they have enough knowledge, they take off for better digs -- which I don't blame them what so ever. These folks have to take care of a lot of the minor details but don't have the big picture that comes from a full time job for several years and experience that comes from this type of activity.

I personally try to keep up with the systems we have running...but while its not hard, in most of the real world, babysitting a single server will not get you far. If thats all most of us were doing, we'd be able to easily take care of this stuff.

Luckily enough, I run an ancient version of SQL server and thus this all doesn't apply to me :-) Its all patched and firewalled...

clif

Re:Patch

[Anonymous Coward]

I found it amusing that the two current headlines on the front page under the technology section at CNN are:

Gates pledges better software security
Electronic attack slows Net

Now if they would only address security before they released their products we might not see these issues.

wow yeah!

[matth]

Where I work we ended up with quiet the excitement. Around 1am I lost connectivity on my DSL modem at my house.. and I just figured something was up with the DSL so I fooled around with that for a while.... but then I realized the data light on the hub for the DSL modem was blinking a WHOLE lot and nothing else on the hub was (ie broadcasts were coming through)... I couldn't ping our core router, nothing... YIKES! So I hiked into work... only to find that 3 machines had been compromised. A co-lo we have, and some other ones. Nothing bad mind you.. easy to fix.. install Service Pack, and then firewall the ports out.. but still.... it was interesting.. I walked into the server room and was greated with a ton of orange lights (that are normally just blinking!) That thing can really cook out the damage!

Someone really has carefully crafted this worm to try to bring down the net.. and what better time then on a Saturday morning when all admins are away and not planing to work the next day!

Re:wow yeah!

[sporty]

Someone really has carefully crafted this worm to try to bring down the net.. and what better time then on a Saturday morning when all admins are away and not planing to work the next day!

AND verisign will be down for certain hours while .org transitions to PIR/Affilias.

Re:wow yeah!

[Gothmolly]

So you contributed 3 servers to the global pool of zombie boxen, by sheer laziness? Thanks. The patch has been out for 6 months. I think the proper term is "fucktard".

Re:wow yeah!

[dangermouse]

and what better time then on a Saturday morning when all admins are away and not planing to work the next day

What's it matter? It's not like you people have gone to work since last July anyway.

Re:wow yeah!

[Sycraft-fu]

Ummm, I don't think the parent is funny but rather very serious and very right. The patch for this has been out for 6 moths, there is no excure not to have your systems fixed. It's just laziness and/or stupidity that you would have an unpatched server on the Internet.

Re:wow yeah!

[frigate]

People like this can screw up anything. If we made Linux easy to install, we would end up having a bunch of morons like this install and "configure" that as well. So keep the idiot installs out and we can keep the idiots out. I will go in Monday WILL PROMPTLY FIRE the admin if any of our systems are compromised.

Re:wow yeah!

[Sycraft-fu]

It really shouldn't have to. Part of a sysdamin's job is to stay current patches. It's not hard to check once a day for all the OSes you manage. More, just about every venurability should be a non-issue if you configure your damn server right in the first place. The only venurability that has actually needed to be patched on any of my Windows webservers in the last couple years was the Code Red one. This SQL bug, the NetBIOS bug and so on were all not relivant since those ports are not available to the Internet or the service is simply shut off since it isn't needed. I patched them anyways of course, but still.

With a good inital security setup and vigilant upkeep system compramises can be basically eliminated. There is always a possability the a bug will slip through and not get patched quick enough, but generally you can stop 99% of problems by securing the system properly and the other 1% through daily patch monitoring.

Frankly, I consider this the job of a sysadmin and think you are remiss in your duties if you don't do it.

Re:wow yeah!

[j3ss]

there is no excure not to have your systems fixed

The fact that MS patches often break things is one excuse. If you are an overworked admin at a small shop with no test servers to install the patch on, you might simply not want to risk screwing up your machine by installing the patch.

If there is a 5% chance that not installing the patch will result in your machine getting owned and a 40% chance that installing the patch will screw up your machine then many people will simply not install the patch and pray for the best.

I am not saying that is how it should be, I am just saying that is how it is.

Ok now tell me

[vicviper]

how many quries at the root level are unnecessary. :)

Re:Ok now tell me

[DarkZero]

More today than yesterday.

First hand report

[AirLace]

Waking up at 2AM after falling asleep at work on a Friday evening, to be greeted by a wall full of router racks lit up like a wall-shaped christmas tree is a sobering experience indeed. Needless to say I've been working since then to apply appropriate firewall rules accross our network to block port 1434. Once this blows over, it's time to start some real PostgreSQL advocacy..

Re:First hand report

[bwalling]

Needless to say I've been working since then to apply appropriate firewall rules accross our network to block port 1434.

What you really need to do is to assess which ports you need to leave open, and to which hosts they correspond. You need to block everything, and then set rules to enable only the ports/hosts that are necessary (open ports 80/443 to webserver, etc).

Otherwise, you'll be doing the same thing for the next worm.

Re:First hand report

[essdodson]

No, once this blows over it's time to apply the fucking patch. It's been available for six months mind you.

Re:First hand report

[Dynedain]

No, once this blows over it's time to apply the fucking patch. It's been available for six months mind you.

The patch does not affect routers stupid. Just because his routers are all lit up with massive amounts of traffic, does not mean that his servers are unpatched!

My link was down for 4 hours from the flooding with everything all lit up, and I'm not even running an SQL server.

ZDNet and Yahoo stories

[tigress]

ZDNet and Yahoo.

Whoever puts their database server

[cscx]

Outside a firewall for no apparent reason is a tool. That being said, we live in a world of idiots. Why?

NGSSoftware alerted Microsoft to this problem on the 17th of May 2002 and
they have produced a patch that resolves these issues.

This is January 25 2003 if I'm not mistaken. Are these the same people that leave their cars unlocked with the keys in the ignition?

Re:Whoever puts their database server

[cyb97]

Are these the same people that leave their cars unlocked with the keys in the ignition?
A real idiot would leave the car locked witht the keys in the ignition...
I guess they learn something at MSCE courses ;-)

how bad is it?

[chevelleSS]

What does this worm rank compared to other DDOS in the past?

CNN & AP Beat Slashdot

[Anonynmous Cow]

I was very surprised to discover both AP and CNN beat Slashdot to this story.

Very disappointing.

Timely is as important as accurate SlashEditors. Many of us look to you when big events occur...

Especially considering this all began about 8 hours ago!

Re:CNN & AP Beat Slashdot

[LinuxParanoid]

It was covered by the Slashdot masses on another security-related thread earlier this morning.

If you want an non-editor-controlled story queue, with story selection subject to user moderation, try submitting/reading here; the capability is now possible on Slashdot. It's not as simple as it could be, and it's only a week old, but it works without you having to leave Slashdot.

--LP

Turn your SQL server off?

[blowdart]

If you run Microsoft SQL Server, make sure the public internet can't access it.

What a pathetic overkill response. If you're running SQL server, make sure it's patched. When the last set of bind exploits came out no-one said "Unplug all your DNS servers", why is this any different?

SQL is easy to secure, and the guidelines are well known

• Make sure you do not have a blank SA password. You can either run SQL in NT authentication mode (preferred) or mixed mode. Mixed mode exposes you to password attacks.
• MSDE (The desktop edition) is installed, by default with a few pieces of software, including Visio Enterprise, MacAfee's centralised virus admin thingy (hey, I've only just woken up, I can't remember the name ), FlipFactory (an automated video encoding system) and others. There is no user interface to MSDE, you'd have to install SQL tools from a "grown up" installation, then add it as a new server, then set the SA password.
• Consider dropping built in stored procedures like xp_cmdshell, xp_regwrite.
• Run SQL as a limited service account, not as localsystem

And of course, patch it when patches appear

Re:Turn your SQL server off?

[Zocalo]

What a pathetic overkill response.

No, it's a very reasonable one. Yes, you still need to patch, use non-blank SA passwords and the other things you suggest, but if you have an SQL server (any SQL server) directly visible to the Internet then you are either a fscking moron or have a very abnormal circumstance. A database server is a backend server, and should be completely hidden from the Internet by not one but two layers of firewalls.

Basically, in this day and age, your setup from the Internet in to your internal LAN, should be (as a minimum):

Internet router(s) => Firewall(s) => Web servers (HTTP, mail relays, proxies, VPN termination, etc.) => Firewall(s) => backend servers (SQL, internal mail etc..) => Internal network.

Some of these networks can quite easily be different ports on the same physical firewall, but I'm limited by ASCII. Alternatively, if you have no backend servers, that segment can obviously be omitted altogether.

Firewall rulesets can, and should, apply to outbound as well as inbound traffic and allowing traffic to flow cleanly accross multiple firewalls should be limited as much as possible. At a pinch, you could put your backend servers (if any) directly on the internal LAN, and get by with a single, three port firewall, but this should be the absolute minimum setup if you are hosting connections from the Internet. Sticking a two port firewall between your network and the Internet is simply not good enough anymore.

With resonable DMZ capable firewalls available for less than $500, either as a dedicated box, or old PC running the open source apps of your choice, there is no fiscal reason for even the smallest of companies not to be secure. As ever, the real reason is lack of a clue when it comes to matters of security.

Re:Turn your SQL server off?

[bruthasj]

When the last set of bind exploits came out no-one said "Unplug all your DNS servers", why is this any different?

Maybe because bind was built with the Internet in mind. Besides, who in their right mind (I know its redundant), would expose a database server to the Internet, whether that be Oracle, MySQL, PostgreSQL, MSSQL or anything of this nature. It should be hidden completely behind an application layer, preferrably behind a firewall.

Remember to all: This isn't about bashing Micro$oft per se, but rather bashing sysadmins who expose a database out on the net.

Re:Turn your SQL server off?

[Curt Cox]

Needlessly exposing a database to the Internet is a security policy so bad that not even Microsoft would recommend it.

Re:Turn your SQL server off?

[sloth jr]

Basically, in this day and age, your setup from the Internet in to your internal LAN, should be (as a minimum): Internet router(s) => Firewall(s) => Web servers (HTTP, mail relays, proxies, VPN termination, etc.) => Firewall(s) => backend servers (SQL, internal mail etc..) => Internal network.

I am not in agreement. Two layers of firewall will provide marginally better protection in a standard two-tier layout, but it is not necessary, and is expensive. (digression: your $500 example is suitable only for very lightly loaded networks - it may be able to handle your first layer firewall, but almost certainly will saturate at the second layer: a PIX 525 firewall, at approx $30k for a redundant pair can handle about 370Mbits/second. So, I've got 6 webservers with Gigabit ethernet trying to talk to twelve back-end database servers, also gigabit ethernet. Look into prices for firewalls that can handle even 1000Mbps sometime and you'll see my point.)

Anyway, unnecessary: a database that has only open ports 22 and, say, 3306 (I like MySQL) is going to look very similar to a a machine behind a firewall that only lets port 22 and 3306 through. There are a few classes of DoS attack that could be stemmed through use of a firewall, but really, the value of your environment is your data. Run a sniffer on a compromised webserver, and you've almost certainly got the information you need to make backend connections to the database servers.

sloth jr

Another look at the worm

[valdezjuan]

From digitaloffense: A new worm which exploits a vulnerability in MS SQL Server is bringing the core routers to a grinding halt. The speed of the propagation can be attributed to the attack method and simplicity of the code. The worm sends a 376-byte UDP packet to port 1434 of each random target, each vulnerable system will immediately start propagating itself. Since UDP is connection-less, the worm is able to spread much more quickly than those using your standard TCP-based attack vectors (no connect timeouts). Some random screen shots and information about the worm can be found HERE.

Whoever...

[wulffi]

Whoever puts a database outside a firewall? and then leave its external port open???

Sysadmins like that should be dragged into the street and shot.

Re:Whoever...

[radish]

I have three letters for you:

V P N

There is NO excuse for leaving BACKEND services like DBs, appservers, or whatever else visible on the public net. NONE WHATSOEVER. I work on a major website with multiple different data servers and backend applications, all distributed (and load balanced) over 4 physical sites on 2 continents. We use private circuits to handle the inter-site traffic, you could use VPN just as well. But everything vulnerable is buried from the internet behind several layers of firewall. Anything else is sheer lunacy.

Crappy admins bring this kind of attack on themselves, and alas, on the rest of us too.

Been waiting for this

[tigress]

...the Slashdot article, that is. I've been watching this since I got up this morning (about five hours ago, local time). There's been plenty of discussions about this on various mailinglists, including NANOG and NordNOG, as well as several IRC channels I frequent. I'm surprised it took this long for Slashdot to post anything about it.

According to unconfirmed sources on NANOG, the worm seems to eat up bandwidth at line rate (even at GigE links), is rumored to amplify itself via Cisco routers, and is the creation of Saddam Hussein.

My journal on the worm.

best writeup

[numatrix]

Best writeup I've seen is over at iss.net. They were the first to update their internet status homepage alerting of the vulnerability as far as I can tell.

Some Links

[Isomer]

Reachability issues caused by the worm:
http://average.matrixnetsystems.com/Daily/markR.ht ml
http://mrtg.nac.net/switch9.oct.nac.net/3865/switc h9.oct.nac.net-3865.html

The advisory announcing the flaws:
http://www.nextgenss.com/advisories/mssql-udp.txt Various disassemblies and discussions: http://www.snafu.freedom.org/tmp/1434-probe.txt http://www.digitaloffense.net/worms/mssql_udp_worm / http://www.boredom.org/~cstone/worm-annotated.txt

Writeups:
http://www.cnn.com/2003/TECH/internet/01/25/intern et.attack.ap/index.html
http://news.bbc.co.uk/2/hi/technology/2693925.stm
http://story.news.yahoo.com/news?tmpl=story&u=/ap/ 20030125/ap_wo_en_po/na_gen_internet_attack_2
http://bvlive01.iss.net/issEn/delivery/xforce/aler tdetail.jsp?oid=21824

problem still around

[Dynamic Drive]

I've been watching this havoc unfold all night as well. I wonder how long it's going to take for the entire problem to clear. Most sites that were previously unaccessible are for me are now, except some of our own. Makes me wonder if something else is going on in these datacenters.

Collected info:

[Anonymous Coward]

There's a stream of related info in the comments of Slashdot's Cross-Site TRACE story.

Some snippets from there:

Mabu's message says: Here's what we've been able to learn, at 4:30am Central time.

We have reason to believe that something called the "SQL Worm" is in play. Some sort of DDOS attack which creates overwhelming traffic on port 1434. This is all preliminary stuff, so take it as such but I have one link up and 3 others down.

I don't have confirmation or details on what systems are affected but we have information to indicate that the following networks are currently affected: Quest, Cable & Wireless, Broadwing, Sprint (partially). My Worldcom link seems to be unaffected (which is why I can post). Note that the connectivity interruptions may be regional but that's what we are dealing with in the South Central area of the US. This has been going on now for about 4-5 hours.

What we are seeing is a major outage due to DDOS on port 1434, on portions of the Internet backbone. At this point, the exact pattern of the outage has not been clarified.

Expect the problem to potentially be addressed when the backbone providers start filtering port 1434. However, it's taken them at least four hours to figure this out.

We just got notice (a few moments ago) that Quest finally started filtering port 1434 and everything went back up. So now we need to figure out what vulnerability this was. My information indicates that port 1434 is MS SQL server resolution service (see related CERT advisory [cert.org]. My initial impression is that while this vulnerability was discovered awhile back, someone just recently figured out a very effective exploit using the vulnerability. I am looking forward to hearing more about what people find out.

The issue currently happening, from what anyone can tell at any rate is that a flaw in MSSQL has been found, due to everyone noticing a lot of traffic on 1434.. MSSQL port anyhow, I was running MSSQL earlier and my dns crapped out ctrl+alt+del'd and saw 85% cpu used by mssql server, killed it and boom everything was okay, possibly a worm traveling around, http://internethealthreport.com/ UUnet seems absolutely destroyed ;)

I'm watching my firewall logs fill up even as I type, and all the 1434 hits are coming from different IPs... no dupes yet that I can see (maybe there are... but I'm not planning on sitting here all night reading logs).

http://www.nextgenss.com/advisories/mssql-udp.txt is an advisory about port 1434

http://average.matrix.net/Daily/markR.html shows a vivid picture of overall net health due to this

SQLServer listens to 1434 to accept incomming connections. SQLServer 7 would then normally transfer these connections to 1433 by default. SQLServer 2000 would transfer the connection to a random port.

It's best to 'hide' the SQLServer from the internet, and/or disable TCP/IP listening for SQLServer totally when it's connected to the Internet. MS also suggests SQLServer should never be exposed to the Internet directly. You can hide SQLServer (2000) directly, using the Server network utility, shipped with SQLServer. You can there first deselect TCP/IP as a protocol that's active, and if you need it, you can select 'hide' to hide the server on the internet, however it's better to disable TCP/IP totally, since you do not need it when you work with SQLServer from the same box (f.e. a website running on the same box accessing the SQLServer).

Oh, of course it should be mentioned, there is a patch for this available at MS' technet site.

http://www.kb.cert.org/vuls/id/370308 may be the CERT article related to this vuln.

Resent-From: mbac@romulus.netgraft.com
From: Michael Bacarella Date: Fri Jan 24, 2003 11:11:41 PM America/Los_Angeles
Resent-To: bugtraq@securityfocus.com
To: nylug- talk@nylug.org, wwwac@lists.wwwac.org, linux-elitists@zgp.org
Subject: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!

I'm getting massive packet loss to various points on the globe. I am seeing a lot of these in my tcpdump output on each host.
02:06:31.017088 150.140.142.17.3047 > 24.193.37.212.ms-sql-m: udp 376
02:06:31.017244 24.193.37.212 > 150.140.142.17: icmp: 24.193.37.212 udp port ms-sql-m unreachable [tos 0xc0

It looks like there's a worm affecting MS SQL Server which is pingflooding addresses at some random sequence. All admins with access to routers should block port 1434 (ms-sql-m)!

Everyone running MS SQL Server shut it the hell down or make sure it can't access the internet proper! I make no guarantees that this information is correct, test it out for yourself!

-- Michael Bacarella 24/7
phone: 646 641-8662
Netgraft Corporation http://netgraft.com/
"unique technologies to empower your business"
Finger email address for public key. Key fingerprint: C40C CB1E D2F6 7628 6308 F554 7A68 A5CF 0BD8 C055

Al-Qaeda

[tigress]

It's those darn Al-Quaeda, I tell you! Them and Saddam Hussein! Damn them for retaliating against our Righteous Attacks!

Such floods can be easily stopped.

[Krapangor]

The only problem is that most of responsible people are computer scientists and sometimes even only with a BS in CS and therefore have no clue of harmonic analysis and advanced probability theory.
If you project your network system in the C^n- space of markovian probability measures and with to the frequency domain, you can easily see that our system represents a compact manifold of superharmonic measures. And malign overflow is just a upper bound in this set, therefore harmonic. It's well known that the only harmonic functions on compact manifolds are constant. So going back into the time domain this means that you must just analyze the frequency of the packets. All packet streams with a constant frequency are malicious by the above calculation and therefore should be dropped. Of course there are some minor points with the frequency reflection on edges etc. but this is very basic stuff and can be easily solved.
If think there was a paper of Lorgajev and Starniktov in the 80ies about this, but I'm not really sure.

Re:Such floods can be easily stopped.

[platypus]

You forgot to mention something about algorithms of complexity O(n*log(n)), and the sig:

Wagner LLC Consulting Co. - Getting it right the first time

If I took you for someone else, please accept my apology.

Re:Such floods can be easily stopped.

[yeOldeSkeptic]

I agree. However I also suggest that packets streaming into any port under a gaussian bell curve probability and/or a poisson distribution also be filtered out. I heard that the newest version of the linux kernel has mechanisms for thermodynamically analyzing all packets for signs of randomness. As all computer scientists and mathematicians know, humans are not random and it is therefore unlikely that packets sent from a client will arrive at any given server randomly. Richard Stallman in his PhD thesis ``The Statistical Thermodynamics of Software Evolution'' says as much. Please read the paper for details.

Sorry, I don't have the URL. I'm not a karma whore.

the problem is monoculture again

[g4dget]

While part of the problem is that Microsoft software sucks particularly badly when it comes to security, something like this can happen with other software as well. The real problem is that we have a software monoculture: we need many more, different, independently implemented software systems. They will all have bugs, but as long as they all have different bugs, we are mostly OK. And that's the real reason why Microsoft's market dominance, in particular on large numbers of small machines run by non-experts, is a problem.

Re:the problem is monoculture again

[mlyle]

I don't think it's fair to say this is due to a software monoculture. MS SQL Server only has a 18-19% RDBMS marketshare (38% or so of the Windows database market).

The argument could be made that with more different types of software, there is a greater risk of DDoS that could cripple the net (although cleanup will be easier in that case, too).

Open the gates...

[Tyreth]

...let the mandatory "this wouldn't happen if sysadmins upgraded" comments begin!

Seriously though, you should have upgraded!

Re:One at our site cut itself off from the net...

[cyb97]

That router must be fairly undersized...
No point in having a router that can't sustain max-traffic on the network it's put on...
What if your campus get slashdotted ? Kinda boring if the router shutsdown because of legit traffic ;-)

My guess is that some MSCP caught panic when he saw the load on the mssql-server and pulled the plug...
It's happened to me... (and he wasn't even MSCP just vanilla dumb...)

How to get control of your box again

[rolandbm]

It looks like if you stop the proccess sqlservr.exe it will take all of the CPU proccess back down to normal. Obviously you dont want to delete this file, but with it stopped you can at least get the box on the network to trouble shoot this stuff. So far from what we can tell, when you restart SQL the load stays down, but that could also just be that its sitting there idle waiting to be activated again. Hope this helps.

Alchemy Support
Alchemy Communications

leaving that port open...

[smartfart]

I agree, it ought to be closed. However, our beloved MySQL also leaves its port open, listening on all NICs in a box.

Gr.... All the more reason to run a host firewall on every machine.

Who said anything about turning it off?

[Chuck Chunder]

Any server that doesn't need to be accessed from the public internet in the course of it's normal use should be firewalled off from it. That's just common sense.

Dissassembled & annotated

[ediron2]

http://www.boredom.org/~cstone/worm-annotated.txt has a great annotated geeks-eye-view of this worm.

Kudos to cstone@boredom. Interesting & educational, with a nutty crunchy flavor.

Do ya REALLY think all servers have active SA's?

[caboosesw]

So, every colocated server has a system admin checking it?

All servers that were placed up there years ago to host one silly site get checked regularly?

All companies (or individuals) who host sites pay to have them maintained?

All sysadmins are competent and on top of their patches ... outside of their regular duties which may include making coffee or sorting mail (depending on the size of the organization)?

There are alot of servers and alot of sites. There aren't alot of "great" admins IMHO. And, often, patches are bundled together when you upgrade a server which may be once EVERY TWO TO FOUR YEARS.

Reality folks.

Re:What's inside ?

[AirLace]

There are no SQL commands in the worm. It just initiates a bouncing ping between two MS SQL servers that continues until the network or one of the servers is brought down. An annotated dissection of the worm is provided here.

Yow! Good call /.

[JasonUCF]

I groggily stumble up to my computer, it being a normal enough sort of Saturday AM, and as I sit down I cast a lazy eye at my firewall counter.

Woah! What's.. uh.. 150 inbound requests.. doing.. today.. worm?

I start to fire up /. -- a lengthy process due to my dumbass ISP not having reverse DNS entries -- so I sniff around my logs.

*clickity click*

1434? The hell is 1434. Worm?

*slashdot shows*

Ah ha! Ve haf comprehension.

*groggily shuffle off to get coffee, oooo black gold*

For what it's worth, a majority of the packets so far have been mostly US servers -- .edu's with cute names like 'staging3', 'testing1', and, no joke, 'snoogans'.

This is inside...

[dark-br]

Disassembly of the 404 bytes being sent by affected systems

Fox News

[avalys]

Heh...on the Fox News Channel's ticker, they had the following tidbit of information:

"The virus spreads using a Microsoft vulnerability known as "SQL Server""

Re:Fox News

[Kashif Shaikh]

Heh...on the Fox News Channel's ticker, they had the following tidbit of information:

Well, on CNN's headline newsticker they have:

"[Microsoft][ODBC SQL Server Driver]Operation canceled

[Microsoft][ODBC SQL Server Driver]Timeout expired

ODBC: Msg 0, Level 16, State 1

Communication link failure

Connection Broken"

Re:Why would anyone use anything else?

[sporty]

Postgresql and oracle are like screw drivers. Do you use one screw driver for all tasks? No. There are some things that oracle really kicks ass at that postgres really plain sucks at. Vice versa as well.

Re:Yow! Good call /.

[caluml]

This one has surprised me most so far:
tybclbsqla02.listbuilder.com

Hmm. Lists equal large databases.
Large databases usually mean a DBA.
DBAs should know better.

whois listbuilder.com

Technical Contact:
Microsoft (EJSEHEQUAO)
msnhst@MICROSOFT.COM
Microsoft
One Microsoft Way
Redmond, WA 98052
US
425-882-8080

Not just your needs...

[fmaxwell]

No, firewalls are for use as your needs require.
I, for instance allow no incoming, but don't restrict outgoing.

Firewalls are not just for your needs. They are also for the protection of others, too. It's the all-ports-open-on-outgoing stuff that allows worms like this to spread and wreak so much havoc. It's dial-up Internet providers leaving port 25 open on outgoing that allow spammers to use throwaway accounts for spamming.

I don't think you should tell people what firewall rules they should be running.

Hey, if it's my network being affected by your lack of rules, I've got a moral right to tell you what rules your firewall needs.

What's the DNS connection?

[Alien Being]

Is this thing directly targetting root/tld servers? Is the worm doing dns lookups as opposed to just picking an ipaddr? Is it the PTR servers which are being hammered by loggers doing reverse lookups?

Did someone jump to a bad conclusion based on ping stats?

Re:What's the DNS connection?

[Gothmolly]

Because some of the roots are on very clogged backbones. Welcome to the Internet. What don't you understand today?

Has this affected Microsoft?

[Raven-sama]

I don't know if anyone else has had the same problem, but xxx@msn.com email addresses seem to not be working on Hotmail. I doubt they're related, but has anyone else had the same problem, and is this likely to be the cause? By the way, xxx@hotmail.com accounts work fine.

The whole Internet has been Slashdotted

[Runny]

This is what would happen if /. ever became a search engine.

totally deserved...

[smash]

Anybody who puts an SQL server of any kind out in the open, let alone one with such a colourful security history as MS-SQL server, deserves whatever they get.

I'm not justifying behavior of the assholes who release these worms, but leaving the SQL server visible to the public internet is just slightly retarded.

If these boxes actually have someone employed as admins, they should get fired, plain and simple

smash.

Re:One at our site cut itself off from the net...

[weave]

Looks like this post to bugtraq explains why that router at my college died from this:

"Tier 1 backbones are reporting a bad night: routing instabilities, one major dropped most of its peering for a while, the volume from this triggers the Cisco netflow switching bug and is causing routers to lock up at places, etc."

Re:The Fix?

[TheGreek]

They'll sell it to us over six months ago.

For free.

Asshead.

50% from Colleges???

[Gothmolly]

About half of the sources I've seen have been either .edu sites or sites in other countries which belong to colleges (ualberta.ca, etc.). Is there some sinister corellation here? Perhaps colleges get free MS-ware, and let the students run the networks?

Re:50% from Colleges???

[diamondc]

like the posters above said, you can get Microsoft software for less than 20 dollars on college campuses that have deals with Microsoft.

From my experience, whenever I email a college/university asking them to check out a computer that is packeting they don't reply back (last case being asu.edu).

Re:50% from Colleges???

[sean23007]

Or perhaps the schools have copies of the MS software and the students take it to their dorms and run their own MS servers from their rooms. I saw an article in Business Week about a year ago that said MCSE students are one of the largest reasons for the insecurities of the web and the spread of worms, because they take home the discs for the software they're learning about and install it at home and fail to properly set it up and patch it. I wouldn't be surprised if the same thing was happening at these colleges.

I just hope MS doesn't point out that half of the sources of the worm are pirated copies of the software...

A bug in CISCO routers is helping to control this!

[weave]

A post to bugtraq by George William Herbert, notes that the floods caused by this worm is causing many cisco routers to shut down, which helps contain the damage ironically enough. I've seen this happen at one of my work sites that is admined by someone else. The infected box, according to MRTG, was nailing its closest router at 100 megabits/sec for about an hour, then the router itself went down. Sweet...

"...the volume from this triggers the Cisco netflow switching bug and is causing routers to lock up at places, etc."

DB vendor more at fault

[0x0d0a]

Are these the same people that leave their cars unlocked with the keys in the ignition?

If this were a fair analogy, the *auto maker* would be at fault for leaving spare sets of keys attached to the outside of the car...and you'd simply be (much less) at fault for not having removed the latest set of spare keys the auto maker decided to tell you about.

not quite free

[Anonymous Coward]

The MS educational site license is a flat $40 per year for every computer, including Apples and Suns.

For that, a school can install any and every MS product where ever they please. Not only that, MS supplies training and testing materials and answer keys with that. So the classes are pre-written, too, and a GTA or undergrad can run them.

So yes, MS SQL is all over the place, and they've got lab assistants and volunteers admining them.

Re:this reason

[Iamthefallen]

That doesn't mean that Amazon's DB servers have public IPs you know. There is no reason to have a DB connected to the internet, unless you just wanna see what happens...

PostgreSQL keeps .org up /MS-SQL brings down net

[HighOrbit]

What was that about mission critical applications?

This will continue

[NineNine]

Worms that do this sort of thing will continue ad infinitum. The reason is that there's no financial detriment to having one of your own boxes act as a zombie and send out tons and tons of packets. None whatsoever. There's no central accountability. That's the way the Net is set up. I don't see any way around it.

please stop ms access to root nameservers

[kipple]

given also this previous slashdot story, the root servers must join and sue microsoft for DDOS attacks against them.
Windows clients send TOO much shit to any dns - check your dnscache log to see that. Don't have a dnscache? Bad! You're flooding your preferred DNS server with a shitload of useless or meaningless queries.
Looks like they have read some websites some years ago and then decided to steal words like "domain", thus confusing a nt-domain and a REAL domain name. The rest is pure mess because nt-domains are queried with DNS. Pretty crappy isn't it?

Look at that (dnscache log):
@400000003e329b973170f1bc tx 0 33 _kerberos._tcp.dc._msdcs.[mydomain]. . 97010201
@400000003e329b973874c81c tx 0 33 _kerberos._tcp.dc._msdcs.[mydomain]. . 97010201 97010101
@400000003e329b981c3f8394 tx 0 33 _kerberos._tcp.dc._msdcs.[mydomain]. . 97010101

this is a laptop trying to find a network share on the server (which is called server2000.[mydomain].it). It is querying [mydomain], not [mydomain].it as I set up the laptop (default domain, network identification). Imagine if I did not have a dnscache but set up all PCs to use an external dns server....

billg has no uniform; therefore illegal combatant

[Swordfish]

billg cannot be an enemy combatant because he
does not wear a military uniform.
So he must be an _illegal_ combatant.
Therefore, if guilty, he will have to go to
Guantanamo Bay for a few years to "help with
investigations".
Of course, proof cannot be given for his guilt
because that might jeopardize national security.
Therefore no trial until terrorism is defeated.
Can't afford to take chances with them terrorists!

Re:How about some story on open source flaws?

[croftj]

If a unix vulnerability was ever exploited to the levels that this sql one or nimbda or sircam were, I'm sure one of you AC's would let us know!

It's amazing how many people just don't feal they have to upgrade their machines. Im stil getting nimda hits. The sql exploit is using a vulnerability 6mos old!

Show's you the real vulnerability is the image the MS has palmed off on the public for 20 years! With our system you don't need to worry about good administration! It just works and works and works! Why pay for an admin when you can by MS Win-X?

It can get inside a firewall

[codepunk]

Yes it can indeed get inside a firewall. Say you got bonehead web developer front page dude at home running the developer version. It is no doubt infected with the worm since said developer is using front page and MS SQL on his home xpeeee box. He thanks you by logging in via VPN into your network and spreads the joy. Priceless.....

Ironic timing...

[weave]

Gates pledges better software security (btw, isn't this basically a repeat of what he spammed out last July?)

Gates acknowledged that the technology industry must make significant improvements, adding that, "Microsoft has a responsibility to help its customers address these concerns, so they no longer have to choose between security and usability."

How about easier ways to apply hotfixes remotely to desktop computers? (There are ways apparently, but requires installing IIS and SQL ironically, to run something called SUS.) I'd prefer the hotfix to simply have an option like '-m\\machine' to apply to domain machines in a domain admin context so I can script the installs to my tastes and needs. No need to get overly complex. Besides, I'd rather not have an IIS server at my site if I can help it. Apache runs everything. Just another damn thing to learn for something that should be simple.

Also, the hotfixes themselves only have about 10 different ways of applying at the command line unattended. How about standardizing the hotfix installers too...

Example, this is what is run after an XP desktop install with SP1 at our location...

q329834 -u -n -z
q323255 -u -n -z
q329048 -u -n -z
start /wait q328310 -u -n -z
start /wait vm-sfix3 /q /r:n
start /wait q324929 /q /r:n
q329115 -u -n -z
q329390 -u -n -z
q810565 -u -n -z

It doesn't include latest javavm fix, which for some reason won't install right during the guirunonce part of an install, so I have to script to reboot the machine TWICE before running...

start /wait msjavwu.exe /q /r:n

Think that's bad? Here's some pre sp1 hotfix command lines from an earlier script..

Msjavx86.exe /c:"javatrig.exe /exe_install /l /qq" /q:a /r:n
vbs56nen /q /r:n
msxm /q /r:n
start /wait q318202 /q /c:"dahotfix /q /n"

And the syntax to install unattended is never easy to find on their site. I usually have to use google to search microsoft.com to find what I need, their search engine really sucks. Others must feel the same way since there is a dedicated google page for this at http://www.google.com/microsoft

Attention! You must have SP3 or MS039!!

[Anonymous Coward]

I've been a call all morning and we are sure now that SP2 does NOT protect your server from this attack...YOU MUST APPLY MS-039 to protect your server

Re:Attention! You must have SP3 or MS039!!

[RedWolves2]

Full description on NAI web site http://vil.nai.com/vil/content/v_99992.htm#Removal Instructions

Need both MS02-034 and MS02-039 MS02-034 must be included on SP3.

Report from Europe

[skillet-thief]

I'm in France. I have 1434 in my logs all morning, but nothing since about 11:30 greenwich. The source IP's are about half and half Europe/US.

A few things are down over here, like my university's network, but haven't noticed any major crashing.

10 packets per minute, my ass !!!

[CptMatt]

I slapped a line on our access list in our BGP routers this morning at around 8:30 A.M. Even though our firewall was blocking this port, figured it would be better to block in silicon rather than at the O/S level. In almost 2 hours, we have recieved over 190,000 packets from this wurm. I have a feeling its going to get a lot worse before it gets better

While there are some dumb admins

[RodeoBoy]

There are a lot of home users/business that have SQL server installed and no firewall set up. Just like code red this thing is infecting personal boxes, therefore adding to the high volumes we see. I have SQL on one of my machines at home, behind two linux based firewalls, and when I use any tool to connect to a database I am given all sorts of choices. Most of the IP addys I see belong to other cable users. I wonder how many have kept up on their patches? The problem is any fool without any training can install this stuff on their computers, I think home users are the main reason that simple worms like this are so successful.

Re:UUNET woes?

[RazzleDazzle]

I work for an ISP and I just got home from work where we had to deal with this madness. It was absoultely horrible people. We got word from UUNET that it is port 1434/udp traffic and they are adding that to their egress filters. We just blocked 1434/udp altogether, at least initially.

We have many many colocated customers, many of whom run msql. This issue is horrible in that it is causing massive packet loss and when packets do get through the latency is around 500ms and up and that is for an all ethernet network segment. Our core router was getting slammed and cpu utilization would hang out at around 100%.

When we started unplugging switches from the routers, traffic would return to normal. We then pinpointed it down to all of our colo customers and disconnected just the sql servers from the network. Effing pain in the ass though.

Goddamned MS and their crappy no-password-requirement for the sql admin user and the moron admins who don't patch their system. Are people this trusting of MS that their servers are safe and/or this stupid they just don't apply patches until they get screwed?

Whatever, I am soooo tired... g'night

Re:Get Webmin and Usermin

[clifyt]

I've used Webmin before (never saw Usermin...have to check that out) but it occasionally screws up as much as it helps.

Still, I couldn't trust my Window's folks to touch my Unix servers even if its something this simple. For instance, a few months ago the latest version of GCC killed MySQL. I had to go back and recompile quite a bit of crap to use GCC and MySQL STILL didn't work right. It took a few days to get all of this right...

I don't think Webmin is going to give me the knowledge to fix this kind of problem or even troubleshoot it. Windows is moronic enough that most folks can troubleshoot it enough to get it in a working state...again, most of its point and click. We make fun of that on /. without realizing that most folks can't memorize volumes and volumes of information. Even the little knowledge I have just so I can hit Usenet and troubleshoot from there (not a Unix expert by any means of the word) is more than most Windows admin...and face it, computers are needed everywhere and the average intelligence of the public isn't going to rise any just because of job requirements...thus we will have a very small group of people that are capible of taking care of system administration in a way that is required to manage ALL the computers in the world. Maybe Sun is right...maybe THEY need to be running all of our servers for us :-)

clif

Re:PostgreSQL keeps .org up /MS-SQL brings down ne

[tshak]

Insightful? How? If you haven't patched PostgreSQL within the last 6 months you are vulnerable to multiple buffer overflow/remote root exploits. If PostgreSQL had the volume of boxes that MSSQL had on the 'net, you can be sure that there'd be a large number of idiot sysadmins who A) don't patch and B) don't know how to use a firewall to protect their systems.

Slightly ironic . . .

[aaronhurd]

I guess even Gates saw this coming. ;-)

"New security risks have emerged on a scale that few in our industry fully anticipated," Gates wrote in a 1,500-word e-mail distributed late Thursday to about 1 million people. (Full article at CNN.com)

DOH!

Re:.org and postgress must be smiling today

[PhreakinPenguin]

Another ignorant post because people insist on attacking the wrong person. EVERY protocol has vulnerabilities, that's the facts. The patch was release almost a year ago for this same issue. If you want to blame anyone, blame the shitty admins who don't filter out traffic if they must use MSSQL over the internet, or flat out block it if they don't. I know people think it's cool to bash MS, but in this case it's directed at the wrong person. Besides, last time I checked the root-servers weren't running Windows and they went down like a date on prom night.

Re:Why would anyone use anything else?

[John Hasler]

And today we are seeing the one thing at which Microsoft products really kick ass...

Re:grep -c 1434 log_firewall

[anticypher]

Whoever puts a database outside a firewall

24,432 fuckwits have done so, counting the hits on my firewall. 1 hit on port 1434 yesterday, 0 on thursday.

Wait, there are some dups, it seems that each machine hits the same addresses over and over again, about once every 4 to 12 minutes. grep|awk|sort|uniq gives 11,901 unique IP addresses in my firewall logs.

Quickly scanning a statistical sampling of machines which have probed my IP space, I see that most of them are wide open to the internet. Ports 137/139, 25, 1029, etc. are all available, and 3 of the 11 show BackOrifice on port 31337.

I have a friend (oracle expert) over trying to set up a vulnerable MS Sqweal server so we can study the worms actions on an isolated test network. I want to see which addresses does it scan, rate of repetition, and other things, since the code is pretty simple and just hashes the addresses (low cyclical rate) over and over again. I've also learned some new bad Vlamsk (dutch) language today.

I've got a packet that might crash vulnerable MsSqueal server processes using the same buffer overflow technique. Could be a good return packet to send to scanning machines to get them to shut up until the admins get around to patching/rebooting their fucked windoze machines.

But first I will test it on my own machines, I really don't believe in affecting other's machines on the internet, even if the owners are fuckwits. But after yet another microshit worm fucking things up for everyone else, I've moved my limit closer to their processes.

the AC
I'm also waiting for the first few variants with better IP address scanning routines, which will be much more virulent. Monday will be a *fun* day

Re:Who's fault?

[HaverOfPeculiarBox]

Microsoft can patch until they're red in the face, and they do. But it doesn't change the fact that they released a server with a very major and potentially viral vulnerability. Not everyone in the world is going to do their patches the second they're released. Granted, security holes like this are inevitable, but it's just a question of "how much is too much?" Microsoft consistently releases vulnerable products. And if you're going to pay so much more to run an M$ platform, there should at least be some payoff in the area of so-called "trustworthy computing".

Given that a patch has ben available for so long..

[constantnormal]

... I wonder if evil-doers might be mining the Microsoft patch libraries, looking for exploits that already have fixes, but depending upon the cluelessness of Microsoft site admins to fail to implement them...

Why go to all the trouble to invent a problem, when there is a large population of targets and a database of vulnerabilities?

Will PostgreSQL make you smart

[RodeoBoy]

I think not. There were three simple things that would have saved your ass, first apply the patch, second don't allow everyone in the world to connect to your database server, and last turn off the box if you don't know how to secure it. I also work for a company that uses SQL Server for the backend of our web apps, but I don't have any interesting stories for you. I think our admin was asleep in bed when this all when down, but that is because he did all the hard work ahead of time.

Don't think MS is to blame? Read this:

[Featureless]

OK, help me out here.

1. The first and foremost way we should have stopped this worm was with firewall rules and the "Server Network Configuration." You don't want to be running anything like this open to the network. Fine.
   
   The bad assumption people are making here is that there's "no reason to break this rule." Well, unfortunately, this is just not so.
   
   In my case, a project involved upsizing a client's access database, and then transferring it from my dev machine to an ISP's SQL Server instance. The client has a dynamic IP address, and they would never even consider the cost of using a VPN. My SQL Server ports were open for only 3 weeks, during the transition period, and would have been shut down next week.
   
   
2. Everyone is saying "it's your fault - you didn't install the patch."
   
   I kept up on service packs (I was up to SP2), and had installed every SQL Server security patch I could find. I had a non-guessable sa password. I got it anyway.
   
   So why is that? I'm not sure. But I have some observations about the manner in which you're supposed to keep SQL Server (and other MS applications for that matter) current which bear seriously on the issue:
   
   
   1. First, there's the "fine print" phenomenon on Microsoft patches. Aside from service packs, these are usually just utterly simplistic "unzip and spray files" installers, occasionally with a few scripts thrown in. Install them in the wrong order, or fail to obey some other 8pt type caveat (and there can be dozens) and you render yourself unprotected again, while maintaining the appearance of being protected. It's likely this is why I wasn't protected despite believing I was.
      
      
   2. Where is the complete list of all patches, with downloaded links? What part of Microsoft's site is it prominently displayed on? Where's the order they need to be installed in, with concise instructions?
      
      Anywhere? I can't find it today. Maybe it exists and I just didn't notice it. That would be atrocious site design. Or maybe a simple, centralized "MS SQL Server 2000 Security Page" with ordered patch list and instructions doesn't even exist. That's just atrocious.
      
      All I can find is top-level references to service packs and an unqualified link to an all-microsoft download search page. When you select SQL Server 2000 in it, you get everything, not in order, patches thrown together with samples, evaluation downloads, etc.
      
      And I'm supposed to check here... every week? Sounds sensible on the surface, but if they really wanted to prevent trouble:
      
      
   3. Two words: WINDOWS UPDATE! What the hell is wrong with these people that if they have a patch for SQL Server 2000, they can't just throw it into Windows Update? It does a little check - do you have SQLSvr installed? Yes? Do you have the patches installed?
      
      IT'S SO BLOODY SIMPLE. Yet they didn't bother.
      
      Compare this to redhat, where there's one tool, up2date, and it works for everything. And you are trivially notified by email when there's an update.
      
      
   4. I believe there's a tool that lets you examine your installation to see what service packs are installed and which aren't. I remember vividly running it last summer and discovering that I was up to date. Tellingly, I can't even find it in their site today.
      
      
   5. Yes, the service packs. I notice SQL Server 2000 SP3 protects you against this buffer overflow. I also notice this service pack came out last week.
      
      At any rate, we can at least tell people a convenient fix - go install SQL Server 2000 SP3.
      
   
   

What's the bottom line? I had a reason to have the port open. And I had a not-for-nothing false sense of security that I was protected against this vulnerability. And most of all, if this was RedHat (for instance) I would never have had this problem - because I would have been notified the moment the patch was available, and would have installed it in a heartbeat, through their single, consistent, easy-to-use interface; and so would tens of thousands of others.

Re:.org and postgress must be smiling today

[the eric conspiracy]

last time I checked the root-servers weren't running Windows and they went down like a date on prom night.

Actually NONE of the root nameservers went down, either during this worm incident, or during the Oct 21 incident. The network nameservers are generally highly overprovisioned, and do a very good job of responding to every request they receive, even under abnormal load.

What happened is that the increase in network traffic staturated some of the feeds to the root name servers making it impossible for requests to reach the name servers. This is the real danger of these attacks.

And as far as blaming negligent sysadmins for not patching their servers, well, sure. But sysadmins are not the only players in this game. Companies often have policies regarding software patches and validation that restrain what a sysadmin can do. And the fact is that the sysadmin did not put the vulnerability in the software, nor is this the first time a Microsoft product has servered as the vector for something like this.

Related attacks (whitehouse)

[Spazmania]

Starting around the same time, www.whitehouse.net began receiving about 100 times the normal requests for the home page and its associated graphics. Most of the offending hosts are in China thought at least a few aren't. So far, there are at least 1000 distinct addresses spread accross their entire IP space that reloaded the page at least 30 times.

I have no direct evidence this is related to the worm, but it begs coincidence.

www.whitehouse.net is a privately-owned parody of the US White House web site.

Source samples with counts include:

3302 61.171.37.209
2443 218.17.216.111
2037 218.4.128.50
1962 218.25.204.219
1527 61.187.169.160
1336 61.131.48.222
1183 218.58.69.26
1079 68.37.179.107

DDOS to some, maintenance window to others

[packnet]

We were joking, but while the barrage of UDP traffic taxed our front-end, we figured it might a great time to take systems down for maintenance - WTF, we were up, nobody could hit our site, no explanation to management!

"Our site was down"

"It was the worm, sir."

"I like the new layout. Did the worm do that?"

"Uh... yes?"

dissem and NOTES

[hfx_ben]

A nice collection of data and NOTES.TXT here.

Re:Yow! Good call /.

[DarkZero]

My funniest, I shit you not, is "isecureserver.smsu.edu". Apparently some "I" at Southwest Missouri State University did not secure their server as well as they thought. At first I actually wondered if it was a practical joke.

Got hit hard

[SassyDave]

My network got hit hard this morning. The article claims 10 packets per minute. We were getting 10 packets in about 1 nano second. It sent our firewall to a load average of 10+ and brought our entire network (inbound and outbound traffic) to a halt. We found a single Windows host causing all the problems _behind_ our firewall. After disconnecting it all was well again. Thank you MS.

Buffer overflows a general C/C++ problem

[paulko]

Buffer overflows as a security hole aren't only a Microsoft problem -- although you would think they could afford better code reviews -- they are an almost universal C/C++ problem.

First, using fixed-size buffers for strings (and other arrays) seem almost to be encouraged by the language design, or at least by common practice.

Second, strings (and other arrays) unfortunately do not have a size inherently associated with them in the language, and null-terminated strings can be slow to check for length.

Third, the stack layout of typical C/C++ implementations makes it *possible* to overwrite the return address. Some other programming languages I have used had implementations with the return address below the local variables, making it essentially impossible to overwrite.

But then, years ago, nobody ever seemed to think about security issues in language design.

Microsoft hotfix testing tool

[dr_db]

Here is a program they have for the NT/2000/XP line that lists hotfixes that have not been applied. It certainly is more comprehensive than the windows update site.... Hotfix Checker at MS

No they don't...

[kwenda]

Hotmail still has *nix at it's base, so it's still up.....

No
It
Doesn't.

The site www.hotmail.com is running Microsoft-IIS/5.0 on Windows 2000.

Whats interesting...

[Anonymous Coward]

... is that our Corporate IT has *outsourced* all control of our firewalls (to a company which recently filed chapter 11, if I recall), and so can't update them on the fly...

And, on top of this, our "corporate IT security" just sent out an email that some of their *internal* machines were infected (so obviously *something* was accessable through the firewall) and now we who are connected to corporate via a T1 must apply the patches. So much for the firewall.

This also happened with Code Red two years ago. Big panic, everyone patching their systems, because corporate had holes in the firewall.

Yet, we have our own firewall to a customer site (which we've managed on our own for years, and which corporate now wants to take over) which we have *never* been infected via. Go figure.

Not saying that we shouldn't have been up on it, but we have noone dedicated to IT Security (funny, since we do DOD work) in our building, and we are all so swamped with other stuff we rarely have the time to keep up with it.

At my *last* job, however, we setup a new box and immediately port-scanned it... knew what every service was on the box, and if we didn't, closed it down. And that *wasn't* DOD... e-commerce. And we kept on top of patches.

So... you credit card number was *really* safe at my old job... but our nation's secrets may not be at the new job.

Go figure.

We shouldn't blame MS... no wait, yes we should.

[strAtEdgE]

My intial thought on this was that this isn't MS's fault and we shouldn't be bashing them for this worm; almost every os and daemon out there has had it's holes and exploits and MS has already put out the fix so it's in the admins hands now.

But on second thought, when I look at the serious impact of the worms that have been created for MS products and their vulnerabilities the last few years, the obvious becomes apparent: admins of MS OS's and processes on them are a LOT slower to patch than any of their counterparts (read: stupider). And the thing is, MS knows this, they specifically market to the stupid/lazy admins. They're the "easy" OS, they sell their products by telling people that you just install them and never worry about them again. I've taken too many MS courses (I am an MSCE and MSCDBA if they haven't expired on me, but I couldn't care less) and not once was patching the operating systems or server processes ever mentioned during all those courses, which is amazing to me.

And hey, to each their own I guess... apparently there aren't enough intelligent or well read admins around so there is a demand for these products and this approach. But if that's the case, then I think it has to be said that MS has a greater responsibility to create products free from exploits than anyone else, if they're marketing and teaching the idea that you don't need to patch.

It's by creating that laissez faire attitude towards administration that MS is directly responsible for the proliferation of these worms.

Re:Who's fault?

[Junta]

Yes, but I know a lot of sites that wait on the full service packs. Testing every hotfix that comes out of MS is not time effective. The policies I generally see is that companies first wait a month after release to see if anything bad happens with the SP, then take a couple of weeks in a test configuration to make sure nothing site-specific should happen, then install SP if fine. The SP3 was only released recently.

The problem is that with MS, there are two levels of fixes, hotfixes and service packs. hotfixes could be anything from a slight cosmetic bug that isn't worth the time to worry about in a professional environment, to a critical vulnerability. There really isn't a huge sense of urgency at the word 'hotfix'. They really need a separate category of 'critically needed patch' for stuff that can cause problems of this scale if left unpatched.

Some more info

[mnmn]

Funny how the site www.internettrafficreport.com is being slashdotted right now. In the last 5 min alone, the global traffic index went from 85 to 65, apparently a new wave of attacks as the worm discovers new ground. My 5-domain webserver hasnt received a packet yet, but Im keeping my eye on it. Glad to be using Postgres with its ports blocked from the Internet.

Holy cow! Israel is completely down according to the site.. all routers with 100% packet loss.

What's in a name?

[bobdotorg]

SQL Slammer? A worm virus? Sounds more like a shooter at Hooters on geek night.

Funny, Internet designed to survive nuke attack...

[sunking7]

... but it can't survive Microsoft's software

Does that mean that Redmond is in possession of somehthing *worse* than WOMD???

We demand IMMEDIATE soure code inspections!!!

Or there will be severe consequences.

someone want to start a petition?

Re:my naked-to-the-net sqlserver2000 box is aok

[Queuetue]

Uhm.. you're probably completely susceptible to this. You see, that little clicky thingie you clicked in the thingie was written by the same people that sent you that software with the bug that causes this problem.

You, and the rest of you non-engrossed, non-technical people who don't have $15.00 to put a NIC in a 486 firewall that you can pick up at the dump, but plenty of money to shell out system upgrades every few years... You're causing this problem. You, personally.

First, by buying and deployng a server OS by an untrustworthy organization, followed by not even complying with thier reccomendations of protecting, securing, and updating that server.

Then, by saying "Whew! Dodged that bullet" after you CLICKED ON A CHECK BOX is not quite the same as.. oh.. patching it, securing it behind a firewall and testing it for packet traffic... THESE are the "basics" of your box and the internet. Not what your manual, the context sensitive help, or what MS' Marketing department tell you.

Was that non-technical enough for you? Stop being smug, and stop being part of the problem.

Re:waiting for patches is hardly good security pol

[sjames]

Sounds like a damn good advice to me. Why the hell should either of those be exclusive?

It's very BAD advice! What happens when you blindly apply the patch and find out your mission critical app won't run anymore? A little QA testing would show you that on a test system instead of your live servers. If a firewall rule can protect you, use that, then QA the patch and apply if it is safe.

Consider that sometimes, the 'security patch' just disables a feature that 'nobody uses anyway' (except for your mission critical app, that is). Other times, it doesn't fix the hole, it just changes it's shape a little. In that case, you go from a hole you know about and can guard against at the firewall to one you don't know exists that has less information about it available.

It's not purely a dig at MS (though their track record for quality patches is spotty), any sudden change to widely deployed software runs the risk of causing a problem for sombody's configuration.

Slashdot hits Drudgereport.com

[jlrowe]

A link to this thread has hit drudgereport.com, 2nd link from the top. I think this is the first time I've ever seen that!

ATM's out...

[Maditude]

Heh, looks like it took out a big portion of Bank of America's ATM (cash) machines! Link

Re:ATM's out...

[redwoodtree]

I couldn't agree with you more. This is just bullshit, our economy is now dependent on M$ crap. There's just so many things wrong with that I can't even begin to possibly list them. Why the hell are banks using public interent for ATM connections in the first place? Why would ALL the ATMs be effected? We need answers, answers.

Re:PostgreSQL keeps .org up /MS-SQL brings down ne

[bovinewasteproduct]

If you haven't patched PostgreSQL within the last 6 months you are vulnerable to multiple buffer overflow/remote root exploits.

remote root???? Just about EVERY postgresql system runs as a normal user, how the hell do you get root out of that?

By default postgresql does NOT even support IP connections, you have to turn it on by either the -i option to postmaster or in the config file.

I think your looking at the Mordred buffer overflows from about 5 months ago. ALL of these require a valid user account to exploit. NONE were remote. Please post the location/posting of a REMOTE for a recent release of PostgreSQL. Versions 6.X, 7.1.X and 7.2.0 do count.

BWP

If it isnt broken, dont fix it.

[IMNTPC]

I think that the reason that a lot of these patches do not get applied is due to the "If it isn't broken, don't fix it" mentality. I know that many Microsoft Security patches in the past have caused say 1 out of 10 small volume custom applications to fail in some way after they were applied. The business being conducted by the application may have justified say a 50K dollar initial investment to have it written by a developer. However, the month-to month return does not justify paying a Maintenance fee in order to keep a developer up to speed on your code base. Microsoft has been releasing patches for either IIS, or SQL Server, or OS on roughly a schedule of 2-4 a month. Your average 10-50 man company that had an application written for their specific need is not going to be willing to pay you $4000.00 a month to maintain a secondary system with their application installed, 10-20 hours to test every single function, etc every time Microsoft releases a batch of patches. In their minds it's built, it works, and it's done and they are not going to pay a dime more. If you are lucky, they might do that when something like today's situation comes up. That is why most systems (I will even say Linux/Apache/XSQL systems) don't get every single patch that comes down the pipe applied. In a perfect world you would not accept the work unless there was a good maintenance fee included, but in the real world you take the work that people will give you and deal with the ongoing maintenance on a case-by-case basis. The only contracts where you get that kind of commitment is when there is EXTREMELY good revenue involved and the companies business absolutely relies on the application.

!!!ATTENTION MS ADMINS!!!

[spongman]

!!!ATTENTION MS ADMINS!!!

You should be using the Microsoft Baseline Security Analyzer to ensure that ALL the machines on your network are properly patched and locked down. It's so easy to run there should be no excuse for attacks like this.

!!!ATTENTION MS ADMINS!!!

Re:!!!ATTENTION MS ADMINS!!!

[Sheetrock]

I fully agree.

My only question is that if this is so important, why do they banish it to parts unknown (pardon, the depths of their Technet site) rather than placing it in everybody's Start menu? Cheers to their security consciousness, jeers to their halfassed methods of information deployment.

Re:!!!ATTENTION MS ADMINS!!!

[jpop32]

My only question is that if this is so important, why do they banish it to parts unknown (pardon, the depths of their Technet site) rather than placing it in everybody's Start menu?

Actually, we already did this bit on Slashdot. It was back when MS released SP3 for Win2k which basically did just that (installed an automated patch collection/installation system, placed it in the start menu and system tray). And, IIRC, back then the consensus was that it's A Bad Thing(tm). :-)

Anyways, it's there if you want it. Ignorance is no excuse.

Another Vulnerability ?

[turingsfool]

The current DDOS attack caused by a worm that exploits a known vulnerability (for which a patch was already available) raises the following questions :

a. Is this a test or preparatory exercise carried out before a serious of massive attacks due during the time US invades Iraq ?
b. Is there another vulnerability(ies) (probably bigger gaping holes) in the patch available for the current vulnerability which the group is hoping to exploit, during their second phase of attacks ?

These are just questions. I think administrators should be doubly sure about this patch before they apply it.

A Massive DDOS attack during the gulf war could cause:

a. Less or no information
b. With DNS servers down (5 down this time around) a massive disinformation campaign can be launched (Say the CNN site giving false information for a couple of hours)

These are just possibilities. So was September 11th.

Mod parent up!!!!

[moncyb]

I was just about to post the same thing! Moderators: mod this one up! People need to read this otherwise they'll think their cracked box is safe!

From securiteam.com: ..It can be configured such that clients can use named pipes over a NetBIOS session (TCP port 139/445) or sockets with clients connecting to TCP port 1433 or both. Whichever method is used the SQL Server will always listen on UDP port 1434. This port is designated as the Microsoft SQL Monitor port and clients will send a message to this port to dynamically discover how the client should connect to the Server.

Read further into the report. The exploits use the vulnerability in the code which listens to UDP port 1434. You can't turn this off!

Go easy on the sysadmins

[plnrtrvlr]

OK.... so at least half of the problem is the sys admins, though some of you seem to think it's all their fault for not patching the systems... You must all have nice cushy jobs where they pay you to stay on top of things! The problem is, not every sys admin gets paid to do what he'd like, and not every one of those ppl have been with a company long enough to FIND everything that needs fixing, never mind FIX it all. They don't get paid enough or else told "no overtime" and things just don't get done... Sure blame the admins, the guy who just took over the mess that was left for him when the last guy quit two weeks ago is surely to blame, especially since he's so digusted with the task he's found himself mired in (not to mention the low salary for 24/7 service or else a NO OVERTIME policy) that he's pondering his next resume and cover letter... And no, I'm not a sys admin, I'm a physics student, a self taught computer junkie and a former construction worker, disabled from being a grunt. i just know scapegoating when I see it, and it's all too easy to blame "the man" when in fact, he's getting screwed just like the rest of us.