January 2003 - Test - lists.nanog.org

Re: Level3 routing issues?
by hc 25 Jan '03

25 Jan '03

Okay this is getting bad.. one of our routers just locked up from udp 1434's. Can't even telnet to it now. -hc Joel Perez wrote: >My firewalls are going nuts with hits on UDP port 1434 also from everywhere! > > -----Original Message----- > From: Aaron Burnett [mailto:listkeep@yet-another.com] > Sent: Sat 1/25/2003 1:19 AM > To: Alex Rubenstein > Cc: hc; nanog(a)merit.edu > Subject: Re: Level3 routing issues? > > > > > > On Sat, 25 Jan 2003, Alex Rubenstein wrote: > > > > > > > I dunno about that. But, I am seeing, in the last couple hours, all kinds > > of new traffic. > > > > like, customers who never get attacked or anything, all of a sudden: > > > > http://mrtg.nac.net/switch9.oct.nac.net/3865/switch9.oct.nac.net-3865.html > > > > > > We are seeing this on ports all across out network -- nearly 1/2 our ports > > are in delta alarm right now. > > > > Anyone else? > > > > Yep. Since about 12:30 am. Getting pounded on UDP port 1434 from all over > the world to any address on my network. > > > > >

8 7

final analysis of worm
by Len Rose 25 Jan '03

25 Jan '03

You might wish to read this.. It would seem to explain what we saw on various networks as well with some Cisco 7200 series routers. http://lists.netsys.com/pipermail/full-disclosure/2003-January/003729.html

1 0

Snort rules for "Sapphire" Worm
by James-lists 25 Jan '03

25 Jan '03

alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"HELL-SQL Worm Scan";content:"|684765745466b96c6c|";classtype:attempted-admin;) alert udp $HOME_NET any -> $EXTERNAL_NET 1434 (msg: "SQLSLAMMER"; content:"dllhel32hkernQhounthickChGetTf"; classtype:bad-unknown;) alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"MS-SQL Slammer Worm Activity";content:"|04 01 01 01 01 01 01 01|"; classtype:bad-unknown; sid:9994; rev:1;) alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"W32.SQLEXP.Wormpropagation"; content:"|68 2E 64 6C 6C 68 65 6C 33 32 68 6B 65 72 6E|";content:"|04|"; offset:0; depth:1;) alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"MS-SQL Slammer WormActivity";content:"|81f10301049b81f101|"; classtype:bad-unknown; sid:9994; rev:1;) Swap external and home net to see both vectors for this worm. james

1 0

W32.SqlSlammer
by Drew Weaver 25 Jan '03

25 Jan '03

By the way, I know you guys probably don't care but McAfee is saying that if you have SP3 on your windows2000 server you will not be infected with SQLSlammer, this is absolutely NOT true, I have a box with sp3 and it IS infected. -Drew

8 7

OK, this is rich
by Alex Rubenstein 25 Jan '03

25 Jan '03

http://www.cnn.com/TECH/ Main story: Electronic attack hits Net A fast-moving computer worm slowed down Internet access Saturday for about 22,000 servers, according to the Internet security firm Symantec. Oliver Friedrichs, a senior manager with Symantec, said the "SQL" worm was taking advantage of a vulnerability detected six months ago in Microsoft sequel servers, used mainly by companies to store information. Then, first tombstone: MORE NEWS Gates pledges better software security HAHAHAH (props to troy corbin for this) -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --

2 1

Re: Tracing where it started
by Pete Ashdown 25 Jan '03

25 Jan '03

>It might be interesting if some people were to post when they received >their first attack packet, and where it came from, if they happened to >be logging. > >Here is the first packet we logged: >Jan 25 00:29:37 EST 216.66.11.120 A quick followup to my previous message. I found an earlier attempt in the *:29 window on my home firewall. I don't know if this is due to Cisco logging lag or what. In any case, its interesting how relatively close it is to Phil's IP, but they are different networks. Again the time is in MDT: Jan 24 22:29:25 chariot kernel: fp=UDP-FORWARD:1 a=DROP IN=eth0 OUT=eth3 SRC=216.64.162.15 DST=166.70.201.243 LEN=404 TOS=0x00 PREC=0x00 TTL=111 ID=4917 PROTO=UDP SPT=2958 DPT=1434 LEN=384

1 0

How to find the first occurrance of the worm.
by Ray Burkholder 25 Jan '03

25 Jan '03

Ray Burkholder -----Original Message----- From: McDonald, Dan [mailto:Dan.McDonald@austinenergy.com] Sent: January 25, 2003 17:05 To: 'flow-tools(a)splintered.net' Subject: [flow-tools] w32.sqlexp.worm In case anyone needs it, here is the flow-tools nfilter that I've found to match the worm that hit us... filter-primitive mssql type ip-port permit 1434 default deny filter-primitive wormsize type counter permit eq 404 default deny filter theworm match src-ip-port mssql match octets wormsize that with a flow-print -f 5 gave me the time of the first infection... Daniel J McDonald, CCIE #2495, CNX Lan/Wan Integrator Austin Energy 1.512.322.6739 dan.mcdonald(a)austinenergy.com _______________________________________________ flow-tools(a)splintered.net http://www.splintered.net/sw/flow-tools

1 0

RE: W32.SqlSlammer
by Bender, Andrew 25 Jan '03

25 Jan '03

Can you confirm / forward a trace of what is affecting a supposedly patched & rebooted machine? Thanks, Andrew taqua.com > -----Original Message----- > From: Drew Weaver [mailto:drew.weaver@thenap.com] > Sent: Saturday, January 25, 2003 1:21 PM > To: 'nanog(a)merit.edu' > Subject: W32.SqlSlammer > > > > By the way, I know you guys probably don't care but McAfee is > saying that if > you have SP3 on your windows2000 server you will not be infected with > SQLSlammer, this is absolutely NOT true, I have a box with > sp3 and it IS > infected. > > -Drew > >

1 0

FW: FYI - Cisco - Status as of Sat Jan 25...Global worm attack seems related to SQL 2000...see below for patches from Microsoft (available as of 7/17/02).]
by Jeffrey Meltzer 25 Jan '03

25 Jan '03

-----Original Message----- From: [mailto:@cisco.com] Sent: Saturday, January 25, 2003 2:13 PM To: Recipient list suppressed Subject: FYI - Cisco - Status as of Sat Jan 25...Global worm attack seems related to SQL 2000...see below for patches from Microsoft (available as of 7/17/02). FYI - According to this article from the Associated Press: <http://story.news.yahoo.com/news?tmpl=story2&ncid=716&e=3&u=/ap/2003012 5/ap_on_hi_te/internet_attack> http://story.news.yahoo.com/news?tmpl=story2&ncid=716&e=3&u=/ap/20030125 /ap_on_hi_te/internet_attack "The attack sought to exploit a software flaw discovered by researchers in July 2002 that permits hackers to seize control of corporate database servers. Microsoft deemed the flaw to be "critical" and offered a free repairing patch, but it was impossible to know how many computer administrators applied the fix." Symptoms that may be seen, detected and may be causing alerts on Cisco devices include, but are not limited to high CPU and traffic drops on the input interfaces. The Microsoft Security advisory specifies that this vulnerability is specific to SQL 2000. Microsoft first published the fixed patch on 7/17/2002. Please insure that you are at the correct patch levels for all your servers that use SQL 2000. Microsoft Security Bulletin MS02-039 http://www.microsoft.com/technet/treeview/default.asp?url=/technet/secur ity/bulletin/MS02-039.asp This is basically the same attack as code red using the same UDP port numbers to for the attack. If you have applied patches for the code red virus they are most likely covered protected. The attached link from CNN does a nice job of explaining the similarity. http://www.cnn.com/2003/TECH/internet/01/25/internet.attack.ap/index.htm l Cisco utilizes a security harden OS for servers running our services such Call Manager 3.3. Though SQL 2000 is used by Cisco Unity and Call Manager 3.3, it is still appropriate and best practice to keep all servers current with the latest patches to avoid known vulnerabilities and protect against future re-occurrences. Cisco's Host Intrusion Detection System (HIDS) can be used on servers to detect "unknown" attacks, as was Code Red prior to patches being available. Thanks, Cisco ================================================================== TECHNICAL INFORMATION - There is a Global attack going on around the world which is a WORM that is attacking the Microsoft SQL server on UDP port 1433 & 1434. Cisco TAC has the following PSIRT that can be used to help our Customer. ************************************************************************ ********************************* Summary: Cisco customers may currently be experiencing attacks due to a new worm that has hit the Internet. The signature of this worm appears to be high volumes of UDP traffic to port 1434. Affected customers have been experiencing high volumes of traffic from both internal and external systems. Symptoms that can be seen & detected on Cisco devices include, but are not limited to high CPU and traffic drops on the input interfaces. Details: UDP port 1433 and 1434 are used for SQL server traffic. A new worm has been targeting this port and attempting to exploit a buffer overflow vulnerability in Microsoft's SQL server. Microsoft has issued a security advisory about this issue, the details are here: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/secur ity/bulletin/MS02-039.asp For infected servers, MS recommends downloading Service Pack 3 for SqlSvr, located here: http://www.microsoft.com/sql/downloads/2000/sp3.asp?SD=GN <http://www.microsoft.com/sql/downloads/2000/sp3.asp?SD=GN&LN=en-us&gssn b=1> &LN=en-us&gssnb=1 Symptoms: You may see instability in networks due to increased load. The traffic load generated by this DoS is very high, with some customers experiencing traffic loads as high as 20 Megabits per second combined egress and ingress rates. Workarounds until patches can be applied: Thus far the best mitigation is to block inbound and outbound traffic destined to UDP port 1434. Care must be taken in regards to the impact on mission critical services as 1434/udp and 1433/udp are used by Microsoft SQL Server. Before blocking traffic to that port completely make sure that the possible effects on your network are understood. PLEASE NOTE: These workarounds block both ports 1433 and 1434, although we have received no evidence yet that blocking port 1433 has any affect on the attack. If your network requires traffic to flow on port 1433 please leave that portion of the ACL out and monitor your results closely. **** VACL config on 5500/6500 - confirmed that this drops the CPU load on the MSFC as well. set security acl ip WORM deny udp any eq 1433 any set security acl ip WORM deny udp any any eq 1433 set security acl ip WORM deny udp any any eq 1434 set security acl ip WORM deny udp any eq 1434 any set security acl ip WORM permit any commit security acl WORM set security acl map WORM **** ACL for IOS access-list 115 deny udp any any eq 1433 log access-list 115 deny udp any any eq 1434 log access-list 115 permit ip any any int ip access-group 115 in ip access-group 115 out **** If you have any new information that would be of use to us, please send email to psirt(a)cisco.com General information regarding strategies for protecting against Distributed Denial of Service attacks may be found at http://www.cisco.com/warp/public/707/newsflash.html ******************************************** ________________________________________________________________ Cisco Systems

1 0

Re: New worm / port 1434?
by Eric Gauthier 25 Jan '03

25 Jan '03

Woot! We made the front page of CNN.com: Electronic attack slows Internet http://www.cnn.com/2003/TECH/internet/01/25/internet.attack/index.html Guess that USD10 goes to some unnamed reporter at CNN Eric :)

4 3