ZDNet UK / News and Analysis / Security / Security Management

SQL Slammer worm wreaks havoc on Internet

By Matt Loney, ZDNet.co.uk, 26 January, 2003 10:58

Daily Newsletters

Sign up to ZDNet UK's daily newsletter.

Topics

Microsoft, code red worm, sql worm, Slammer

NEWS
A worm that attacks Microsoft's database software spread through the Internet over the weekend, causing cash machines to stop issuing money, taking most of South Korea offline, and slowing down the Internet. The worm, known as SQL Slammer, takes advantage of a bug that was discovered last July in Microsoft's SQL Server database software. Although a patch has been available since then, many system administrators have failed to install the patch, leaving their computers vulnerable. The result: chaos. Bank of America said 13,000 of its ATMs refused to dispense cash. In South Korea, the country's largest ISP KT Corp said all almost all its customers lost their connections during the attack. Chinese computer users saw sites freeze and a dramatic slowdown in download speeds, as the worm's effects hit the Internet's nameservers -- the computers that translate Web addresses into numerical Internet Protocol addresses. And all this in just 376 bytes of code, meaning the entire SQL Slammer worm code is about half the length of this paragraph. Antivirus firm F-Secure said the effects were so marked because the worm generates massive amounts of network packets, overloading servers and routers and slowing down network traffic. "As many as five of the 13 Internet root nameservers have been downed because of the outbreak," said the company in an alert. SQL Slammer's code instructs the Microsoft SQL Server to go into an endless loop, continually sending out data to other computers, in effect performing a denial of service attack, F-Secure said, comparing the slowdown to the impact of the Code Red virus, which brought internet traffic to a halt in the summer of 2001. The worm has been rated as critical by Microsoft and by antivirus companies because of the damage it has caused, although it is not thought to damage data on infected machines. It does not spread through email and will not affect most home users' computers directly, said experts, although PCs that use the Microsoft SQL Server 2000 Desktop Engine, such as Visual Studio .Net and Office XP Developer Edition, are also vulnerable, according to Microsoft chief security strategist Scott Charney. The first reported attacks of SQLSlammer were recorded around 05:30 GMT on Saturday morning, and it has been subsequently reported in many countries across the globe, said antivirus firm Messagelabs. Unlike mass-mailing worms, SQL Slammer does not write files to a computer's hard disk, but resides in memory. While this makes it easy to remove -- a computer simply has to be rebooted -- it also makes it difficult for antivirus software to detect it, said Messagelabs. And as soon as a rebooted computer is reconnected to the Internet, it will be vulnerable to reinfection unless it has first been patched. Microsoft said it became aware several hours later at 00:30 Pacific time "of an Internet attack causing a dramatic increase in network traffic worldwide." Calling the release of the worm a criminal act, Microsoft said it was "working around the clock to ensure our affected customers are protected." But even as some Microsoft executives urged companies to download patches, others admitted that this was not as easy as it sounded. Microsoft spokesman Rick Miller was quoted in USA Today as confirming that Internet congestion was interfering with administrators trying to download the patch. "The same congestion also completely prevented consumers from contacting Microsoft over the Internet to unlock the anti-piracy features of its latest products, including the Windows XP and Office XP software packages," said the paper. System administrators who are unable to download the patch should block UDP port 1434, said experts. This will prevent external attacks from exploiting the vulnerability. UDP port 1434 is used by the SQL Server Resolution Service, which provides a way for clients to find a particular instance of SQL Server on a machine. It is this Resolution Service that contains the flaw exploited by SQL Slammer. SQL uses a keep-alive mechanism to distinguish between active and passive instances, but the flaw means that if a particular data packet is sent to the SQL Server 2000 keep-alive function, it will reply to the sender with an identical packet. Under normal circumstances this is not a problem, according to Microsoft, but by spoofing the source address of such a packet, it would be possible to cause two SQL Server 2000 systems to start an endless cycle of packet exchanges. This is how SQL Slammer operates. In its original description of the flaw, Microsoft explained the sequence of events: "Suppose there were two SQL Servers with the vulnerability, Server 1 and Server 2. Now suppose the attacker created the needed keep-alive packet and modified the source address so that it contained Server 1's address, then sent the packet to Server 2. This would initiate the exchange, because Server 2 would reply to Server 1, which would reply to Server 2, ad infinitum." However, system administrators do appear to have acted quickly -- at last. By late Saturday, the worm appeared to have passed its peak, said antivirus firms. Charney said the widespread effects of SQL Slammer could have been avoided. "The unfortunate thing about this is when you know that this was a problem and they (customers) hadn't updated," Charney said, "That's a bit frustrating." "It was a vulnerability. We knew about it, but someone is exploiting it. We want our customers to be as secure as possible and install the patches." Click here to find out more about how to protect your system from the worm. Reuters contributed to this report.
For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Security News Section. Let the editors know what you think in the Mailroom.

Related stories

Microsoft patches SQL Server 2000 database

Windows XP, Office and SQL Server open to new attacks

Microsoft warns of new server vulnerabilities

Hybrid DDoS worm strikes Microsoft SQL Server

Data leaks cost Midlothian a record £140k fine

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

  • Login

Will not be displayed with your comment

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

Get ZDNet UK's daily newsletter

Enter your email address to sign up

ZDNet UK Live

fgvrg56

Unfortunately main issue is that ASUS is refusing to accept that they make some mistake on this version of asus Transformer prime. 1 - GPS sensor...

56 minutes ago by fgvrg56 on Asus Eee Pad Transformer Prime Wi-Fi & GPS problems?
Ben Woods

@Marcus A fair question. Just talked with Archos which said it was working on an announcement for next week....

2 hours ago by Ben Woods on Archos confirms G9 Ice Cream Sandwich update schedule
Marcus Karlsson

Any update on this, considering the claimed "first week of February"?

3 hours ago by Marcus Karlsson via Facebook on Archos confirms G9 Ice Cream Sandwich update schedule
apexwm

Bill Goodrich : Just as al_langevin pointed out, with Windows Server 2008 there is no Services for Macintosh anymore. It's gone, not available....

11 hours ago by apexwm on Windows Server 2008 drops the ball for Mac compatibility
txtrainguy

Replying to an old topic that I'm currently facing with my CEO (who is on a Mac). Our servers are primarily Windows Servers, office is about...

18 hours ago by txtrainguy on Windows Server 2008 drops the ball for Mac compatibility
k0tcs3

Sure, that makes perfect sense. Pay wrong-doers money and thank them for breaching your security and pointing out your flaws, that would surely...

18 hours ago by k0tcs3 on US indicts Romanian over NASA climate change hack
Random_Error

I think he's referring specifically to Android apps, as Apple do regulate their App Store, but Google seem to let any old crap onto the Android store!

18 hours ago by Random_Error on RIM: BlackBerry will keep 'garbage' apps out of store
Paul Fezziwig

Keep the crap apps out?! How will they compete with Android and Apple's claim to fame of having so many life changing apps? I wonder if the media...

24 hours ago by Paul Fezziwig via Facebook on RIM: BlackBerry will keep 'garbage' apps out of store
Aigars Mahinovs

It has been shown time after time that if there is an author store that sells the songs at even 1$ per song and gives you a high-quality digital...

1 day ago by Aigars Mahinovs via Facebook on Copyright isn't working, says European Commission
awbMaven

""As a result of Butyka's alleged conduct, researchers were unable to use the computers for more than two months while NASA removed the malicious...

1 day ago by awbMaven on US indicts Romanian over NASA climate change hack
subhorup

It simultaneously worries me and uplifts me that a self-proclaimed group of internet activists name themselves after Indian mythical figures....

1 day ago by subhorup on Anonymous activists release PCAnywhere source code
naviathan

It's actually far easier to work anonymously on the internet than you think. With tools like Tor bouncing your traffic around the world before...

2 days ago by naviathan on Anonymous activists release PCAnywhere source code
Agnostic_OS

1000272134 and bluedalmatian with you both there but then I'm still in 10.04 land (and happy with it)

2 days ago by Agnostic_OS on Ten factors that make Ubuntu 11.10 a hit
apexwm

Interesting article and definitely see your points on the products mentioned. One of the top products for our Help Desk (approximately 20% of all...

2 days ago by apexwm on Ten flawed products that derail productivity
Paul Hutchinson

Absolutely - this should obviously not be handled my isp - but handled by their hosting operator. What's been suggested here is that my isp police...

2 days ago by Paul Hutchinson via Facebook on MPs urge ISPs to take down terrorist material
Techs UK

Looks like a great phone. I don't notice any deficiencies in WP7. used IOS before, that's pretty good. I don't spend much time in Apps, all i need...

2 days ago by Techs UK on Nokia pins US 're-entry' hopes on Lumia 900
Larry Bloggy

Now with the help of these apps you are always synced with MS outlook while on the move. Just download apps like xobni or outlookreflex and get...

2 days ago by Larry Bloggy via Facebook on Outlook Social Connector beta 2 and the LinkedIn connector
mike40g123

Your details are wrong. The version currently being made is the one with 2 USB ports, 256MB RAM and a network port. This is the Model B. The...

2 days ago by mike40g123 on Raspberry Pi boards set to go on sale
Moley

The thing that has been puzzling me for quite a while is how Anonymous can remain anonymous whilst not only being active on the Internet but also...

3 days ago by Moley on Anonymous activists release PCAnywhere source code
Don Dilly

If what Semantec is saying is rue, that is even worse and shows a complete disregard for thier users. If what Anonymous claims is true and the...

3 days ago by Don Dilly via Facebook on Anonymous activists release PCAnywhere source code

Latest in Security Management

Data leaks cost Midlothian a record £140k fine

Google-backed DMARC system aims to block phishers

Ten ways to take the sting out of IT disasters

Featured white papers

2012 Olympics: Is your business prepared?

Symantec.cloud

2012 Olympics: Is your business prepared?

The Olympics are coming to London, and this factsheet can help businesses to get ready for the... Read more

10 safety tips for business in 2012

Symantec.cloud

10 safety tips for business in 2012

From cloud computing to remote working, your business should consider these ways to keep your business secure as traditional IT... Read more

Keeping safe from organised cybercrime

Symantec.cloud

Keeping safe from organised cybercrime

As cyber-criminals become increasingly coordinated in their cross-medium attacks, a solid, communicating and... Read more

Inside ZDNet UK

Microsoft reveals Windows On ARM will bind developers

Microsoft reveals Windows On ARM will bind developers

2012 Predictions: VCE FastPath, VI SAN Probe & Hadoop

2012 Predictions: VCE FastPath, VI SAN Probe & Hadoop

BlackBerry Bold 9790

BlackBerry Bold 9790

Case study: How cloud enables growth

Case study: How cloud enables growth

Ten factors that make Ubuntu 11.10 a hit

Ten factors that make Ubuntu 11.10 a hit

Toshiba Portégé Z830-10P Review

Toshiba Portégé Z830-10P Review

BT's archive: Pictures from the vault

BT's archive: Pictures from the vault