If you have any trouble reading this technical update, please visit the online version by clicking here.

Sterling Communications, Inc.  
Sterling Communications, Inc.Big enough to do the job, small enough to care.
 
www.sterling.net

January 25, 2003

Technical Update: SQL Worm (a.k.a. Sapphire Worm, W32.Slammer)

Friday evening, about 10:30pm Pacific Time, a massive Distributed Denial of Service (DDOS) Attack occurred across the Internet. Many Tier-1 providers were affected, and various bandwidth providers experienced difficulty communicating and delivering data. This attack is very similar to the CODE-RED virus that occurred last year. The first attack infiltrates the servers and seems to have little impact on individual computers. The second phase (coming 2 weeks later in the CODE-RED case) had a massive, devastating impact on the end-users, using the infected servers to deliver the final payload.  The second wave in the CODE-RED attack was also known as the NIMDA virus.

The virus that hit the Internet Friday night had a severe impact on the Sterling network.  Starting at 9:54am Saturday morning, the infected servers among Sterling's client base started to take their toll.  By 10am all of the available bandwidth on the high-speed DSL and Frame Relay connections was consumed and the supporting routers began to fail.  The engineering staff began working on the problem immediately and finally snuffed out the last intruder at 6pm Saturday evening. The Sterling servers were unaffected, however the combined impact of the servers that were infected among the Sterling clients brought the connections to a halt.

The Internet is still reeling from the impact of this virus, and we will probably see waves of trouble all next week as Internet technicians continue to work on repairing the devastation.  We all need to be on high alert, as Phase-2 of this virus may be coming in the next few weeks (if it is a Code-Red knock-off).  

Be assured that the staff at Sterling is doing it's best to prevent any impact these viruses have on our network, on your network and on the reliability of your Internet access.   If you would like to learn more about this virus, and the far reaching effects it had Saturday, take a look at the following links. At the bottom of this email is a link that lets you know how to protect yourself, and how to patch the security hole that the intruders found in the SQL server code.

The CERT® Coordination Center (CERT/CC) is a center of Internet security expertise, located at the Software Engineering Institute, a federally funded research and development center operated by Carnegie Mellon University.  CERT Explanation: http://www.cert.org/incident_notes/IN-2002-04.html

CERT Update: http://www.cert.org/advisories/CA-2003-04.html

Internet Health Report Page: http://www.internethealthreport.com

More News: http://lists.netsys.com/pipermail/full-disclosure/2003-January/003718.html

Microsoft Patch Information: Click Here 

Best regards;

 

Sterling Communications Inc.
18678 SW Boones Ferry Rd.
Tualatin, OR 97062
www.sterling.net
info@sterling.net
(503) 885-8908 Voice
(503) 885-0150 fax

Copyright © 2003, Sterling Communications, Inc. 
Website, Newsletter and Contents. All Rights Reserved.