January 2003 - Test - lists.nanog.org

New worm / port 1434?
by Avleen Vig 25 Jan '03

25 Jan '03

It seems we have a new worm hitting Microsoft SQL server servers on port 1434.

22 25

Re: Level3 routing issues?
by Gregory Hicks 25 Jan '03

25 Jan '03

> From: "Jack Bates" <jbates(a)brightok.net> > To: "Avleen Vig" <lists-nanog(a)silverwraith.com>, "Bill Woodcock" <woody(a)pch.net> > Cc: "Mikael Abrahamsson" <swmike(a)swm.pp.se>, <nanog(a)merit.edu> > Subject: Re: Level3 routing issues? > Date: Sat, 25 Jan 2003 11:28:59 -0600 > > > From: "Avleen Vig" > > > > <snip> > > Let's not blame MS for admins who don't know how to secure their > > boxes :-) > > A patch was released mid-2002 and was also part of SQL Server SP3 > > Actually, I think a patch has been around since 1996 or so... See CERT advisory posted much earlier last night. Regards, Gregory Hicks > Has it been verified that the mid-2002/SP3 patches work? I haven't > heard anything difinitive on this yet. > > Jack Bates > Network Engineer > BrightNet Oklahoma > --------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3479 San Jose, CA 95134 | Internet: ghicks(a)cadence.com Never attribute to malice that which is adequately explained by ignorance or stupidity. Asking the wrong questions is the leading cause of wrong answers "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

1 0

MSSQL Server Worm CERT Advisory
by Tim Wilde 25 Jan '03

25 Jan '03

CERT has now posted CERT Advisory CA-2003-04 MS-SQL Server Worm at http://www.cert.org/advisories/CA-2003-04.html detailing their analysis of the worm. -- Tim Wilde twilde(a)dyndns.org Systems Administrator Dynamic DNS Network Services http://www.dyndns.org/

1 0

Re: UDP 1432
by Lou Katz 25 Jan '03

25 Jan '03

Another data point - I get connectivity through sonic.net (Santa Rosa). This vanished between Fri Jan 24 21:30:00 PST 2003 and Fri Jan 24 21:35:00 PST 2003. At that time, connectivity on other circuits through ALTER.NET, megapath.net and mfnx.net were still ok. All circuits seem to be up now (for us). Fortunately, we don't have any MSQL servers. -- -=[L]=-

1 0

RE: Level3 routing issues?
by Kevin Welch 25 Jan '03

25 Jan '03

I am seeing similar traffic loads on my network at this hour, one of our MS SQL servers seemed to be sending a large amount of traffic out to the Internet. Still looking into it but too similar for me to avoid sending an e-mail. ------------------------------------------------- Kevin Welch kevinw(a)iserv.net Network Engineer The Iserv Company Desk Ph: 616.493.0577 Cell Ph: 616.437.3861 -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Alex Rubenstein Sent: Saturday, January 25, 2003 1:04 AM To: hc Cc: nanog(a)merit.edu Subject: Re: Level3 routing issues? I dunno about that. But, I am seeing, in the last couple hours, all kinds of new traffic. like, customers who never get attacked or anything, all of a sudden: http://mrtg.nac.net/switch9.oct.nac.net/3865/switch9.oct.nac.net-3865.ht ml We are seeing this on ports all across out network -- nearly 1/2 our ports are in delta alarm right now. Anyone else? I will dig more to look at the traffic. On Sat, 25 Jan 2003, hc wrote: > > Anyone seeing routing problems with Level3 at this hour? I just > witnessed tons of prefixes behind level3's network withdraw. Any > information on what is happening (if you know) would be great. Thanks! > > -hc > > > -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --

7 7

FW: Worm / UDP1434
by Freedman David 25 Jan '03

25 Jan '03

-----Original Message----- From: Freedman David To: 'nanog(a)nanog.org' Sent: 1/25/03 1:44 PM Subject: Worm / UDP1434 Anybody here on list using Extreme products (Summit/Alpine/Blackdiamond)? They sure don't like this traffic one bit. It causes them to not only drop traffic, but spew out every available error message under the sun... Extreme are apparently assembling an "advisory TAC" on this, from our point of view, since we use the devices to do l3 aggregation (for colo and such) we've used an ACL to try and combat the offending traffic, but its not doing much good..... -- Email Disclaimer can be viewed at: http://www.netscalibur.co.uk/email.html --

3 2

BBnow 24.219/16
by Jim Hickstein 25 Jan '03

25 Jan '03

My cable-modem provider, bbnow.net (AS 8092), is apparently entirely off the air. Even their customer-support number (888 674 8282) changed its main OGM to say that their upstream was having a problem, and they will "not be able to provide Internet service" to their subscribers until Monday. They estimate. They're sorry for the inconvenience. So I'm wondering: What upstream? What problem? This started long before the jolly happy MS SQL server thing, so I think it's unrelated. Can anyone shed any light on this for me? How does it take until Monday for a not-tiny ISP to fix "the" upstream? Did they not pay their bill?

2 1

RE: New worm / port 1434?
by Marcos R. Della 25 Jan '03

25 Jan '03

For those that are interested, here are a couple disassemblies of the worm. At least it was a non-persistant worm and didn't also damage the MSSQL servers. Could have been much worse... We could all not only be filtering routers And cleaning up switches, we could also be explaining to customers why their Entire database of "stuff" disappeared or was stolen... http://www.digitaloffense.net/worms/mssql_udp_worm/NOTES.TXT http://www.boredom.org/~cstone/worm-annotated.txt http://www.snafu.freedom.org/tmp/1434-probe.txt Marcos -- mdella(a)cstone.com | http://www.geekstyle.net -----Original Message----- From: Peter van Dijk [mailto:peter@dataloss.nl] Sent: Saturday, January 25, 2003 3:35 AM To: Avleen Vig; nanog(a)nanog.org Subject: Re: New worm / port 1434? On Sat, Jan 25, 2003 at 08:05:33AM +0000, Gary Coates wrote: > > Duplicated info.. But this is an old worm ;-( > > http://www.cert.org/advisories/CA-1996-01.html This is not the worm that's spreading now. Greetz, Peter -- peter(a)dataloss.nl | http://www.dataloss.nl/ | Undernet:#clue

1 0

nanog list delayed again
by Mikael Abrahamsson 25 Jan '03

25 Jan '03

Received: by trapdoor.merit.edu (Postfix) id 583239179A; Sat, 25 Jan 2003 08:45:38 -0500 (EST) Delivered-To: nanog-outgoing(a)trapdoor.merit.edu Received: by trapdoor.merit.edu (Postfix, from userid 56) id 5C94B9166E; Sat, 25 Jan 2003 06:11:11 -0500 (EST) Does it really have to be this time everytime something happens and it actually would be nice to get the information out quickly? -- Mikael Abrahamsson email: swmike(a)swm.pp.se

2 1

dos of the week? was RE: Level3 routing issues?
by Joshua Smith 25 Jan '03

25 Jan '03

my transit traffic doubled (luckily it is the low time of the night for me) from 10-12ish "Kevin Welch" <kevinw(a)iserv.net> wrote: > > I am seeing similar traffic loads on my network at this hour, one of our > MS SQL servers seemed to be sending a large amount of traffic out to the > Internet. Still looking into it but too similar for me to avoid sending > an e-mail. > > ------------------------------------------------- > Kevin Welch kevinw(a)iserv.net > Network Engineer The Iserv Company > Desk Ph: 616.493.0577 Cell Ph: 616.437.3861 > > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Alex Rubenstein > Sent: Saturday, January 25, 2003 1:04 AM > To: hc > Cc: nanog(a)merit.edu > Subject: Re: Level3 routing issues? > > > > I dunno about that. But, I am seeing, in the last couple hours, all > kinds > of new traffic. > > like, customers who never get attacked or anything, all of a sudden: > > > http://mrtg.nac.net/switch9.oct.nac.net/3865/switch9.oct.nac.net-3865.ht > ml > > > We are seeing this on ports all across out network -- nearly 1/2 our > ports > are in delta alarm right now. > > Anyone else? > > I will dig more to look at the traffic. > > > > > On Sat, 25 Jan 2003, hc wrote: > > > > > Anyone seeing routing problems with Level3 at this hour? I just > > witnessed tons of prefixes behind level3's network withdraw. Any > > information on what is happening (if you know) would be great. Thanks! > > > > -hc > > > > > > > > -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- > -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net -- > > "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

2 1