RE: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!

From: Jeff Mills (Jeff.Millsat_private)
Date: Sat Jan 25 2003 - 00:59:12 PST

Next message: Mike Tindor: "Re: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!"

Previous message: George William Herbert: "Re: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!"
Maybe in reply to: Michael Bacarella: "MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!"
Next in thread: Mike Tindor: "Re: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

 
> I'm getting massive packet loss to various points on the globe.
> I am seeing a lot of these in my tcpdump output on each
> host.
> 
> 02:06:31.017088 150.140.142.17.3047 > 24.193.37.212.ms-sql-m:  udp 376
> 02:06:31.017244 24.193.37.212 > 150.140.142.17: icmp: 
> 24.193.37.212 udp port ms-sql-m unreachable [tos 0xc0
> 
> It looks like there's a worm affecting MS SQL Server which is
> pingflooding addresses at some random sequence.

It seems you're right.
My firewall is taking alot of hits on port 1434 since about 4pm Australian
Eastern Daylight Saving Time:

Jan 25 16:30:31 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
eth870.sa.adsl.internode.on.net:1310 (376 data bytes)
Jan 25 16:32:35 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
dev1.cinemas.ch:1683 (376 data bytes)
Jan 25 16:34:21 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
216.179.192.248:4161 (376 data bytes)
Jan 25 16:34:41 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
sql.webcoretech.com:3113 (376 data bytes)
Jan 25 16:34:42 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
hds-connected.hds.com:3967 (376 data bytes)
Jan 25 16:35:34 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
216.95.164.23:1141 (376 data bytes)
Jan 25 16:35:56 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
134.210.1.226:3975 (376 data bytes)
Jan 25 16:36:54 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
211.104.36.123:2550 (376 data bytes)
Jan 25 16:38:30 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
cts21612069172.cts.com:1031 (376 data bytes)
Jan 25 16:38:31 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
216.109.150.210:3462 (376 data bytes)
Jan 25 16:39:02 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
207.102.74.40:4605 (376 data bytes)
Jan 25 16:39:05 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
66.189.0.11:4198 (376 data bytes)
Jan 25 16:39:20 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
dnsup1.biz.rr.com:3915 (376 data bytes)
Jan 25 16:39:50 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
211.139.140.18:3623 (376 data bytes)
Jan 25 16:40:24 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
210.91.85.200:1113 (376 data bytes)
Jan 25 16:40:26 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
criminal.justice.state.mn.us:1335 (376 data bytes)
Jan 25 16:40:37 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
server4.hostu.net:1038 (376 data bytes)
Jan 25 16:40:45 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
61.135.134.154:3935 (376 data bytes)

That is only a very small portion of the log. There are hundreds more
entries.




********************************************************* 
** P&O - Celebrating 150 Years in Australia: 1852-2002 ** 
*********************************************************

Next message: Mike Tindor: "Re: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!"
Previous message: George William Herbert: "Re: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!"
Maybe in reply to: Michael Bacarella: "MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!"
Next in thread: Mike Tindor: "Re: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sat Jan 25 2003 - 05:18:11 PST