Fw: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!

Yes, the 150DaySQLwurm (my new name for it, since we all get to make up
names today) does affect MSDE. And there's no SP3 for MSDE, but I've
installed the latest wrap-up patch and the resolver patch and either one
seemed to do it. You have to be careful that you:

1. Make sure SQL Server is not running while you copy over the files
that install the patch

2. Copy of the files onto all the instances of SQL server you have
installed

3. Reboot before restarting SQL Server

You should be careful (on both MSDE and SQL Server 2000) not to install
just the patch for the resolver overflow, since you will then still be
vulnerable to the Hello bug. Of course, if you're still vulnerable to
either, you are most definately already owned, and likely should
reinstall Windows to unload whatever kernel trojans are fighting over
your internal data.

If anyone writes a worm for the Hello bug, I hereby pre-name it the "Yo
G! What's up! SQL!" worm.

Dave Aitel
Immunity, Inc.


On Sat, 25 Jan 2003 13:56:36 -0500
"trent dilkie" <trent@dilkie.com> wrote:

> Can anybody confirm that this worm is spreading on the Desktop Engine
> too?(MSDE)
>
> Thanks,
> Trent.
>
> -----Original Message-----
> From: H D Moore [mailto:sflist@digitaloffense.net]
> Sent: Saturday, January 25, 2003 6:49 AM
> To: bugtraq@securityfocus.com
> Subject: Re: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!
>
>
> A worm which exploits a (new?) vulnerability in SQL Server is bringing
> the
> core routers to a grinding halt. The speed of the propagation can be
> attributed to the attack method and simplicity of the code. The worm
> sends a 376-byte UDP packet to port 1434 of each random target, each
> vulnerable system will immediately start propagating itself. Since UDP
> is
> connection-less, the worm is able to spread much more quickly than
> those using your standard TCP-based attack vectors (no connect
> timeouts).
>
> Some random screen shots, a copy of the worm as a perl script, and a
> disassembly (sorry, no comments) can be found online at:
>
> http://www.digitaloffense.net/worms/mssql_udp_worm/
>
> -HD
>
> On Saturday 25 January 2003 01:11, Michael Bacarella wrote:
> > I'm getting massive packet loss to various points on the globe. I am
> >
> > seeing a lot of these in my tcpdump output on each host.
> >
> > 02:06:31.017088 150.140.142.17.3047 > 24.193.37.212.ms-sql-m: udp
> > 376 02:06:31.017244 24.193.37.212 > 150.140.142.17: icmp:
> > 24.193.37.212 udp port ms-sql-m unreachable [tos 0xc0
> >
> > It looks like there's a worm affecting MS SQL Server which is
> > pingflooding addresses at some random sequence.
> >
> > All admins with access to routers should block port 1434 (ms-sql-m)!
> >
> > Everyone running MS SQL Server shut it the hell down or make sure it
> >
> > can't access the internet proper!
> >
> > I make no guarantees that this information is correct, test it out
> > for yourself!
>
> -------------------------------------------------------
>
>
>

Even more disturbing then the fact that they use the internet and not there
own subnet is that they are running Windows, and on top of this MS SQL.
Unfortunatly American Express is also having problems. After not being able
to check my account, I called them and they to have locked down services for
the time being.

PEOPLE PATCH YOUR SYSTEMS REGULARLY!

--
Best Regards.

eM

----- Original Message -----
From: "Brian McGrogan" <brian@encinc.com>
To: "Richard M. Smith" <rms@computerbytesman.com>
Sent: Saturday, January 25, 2003 8:08 PM
Subject: RE: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!


> The fact that the nations largest banking institution relies on the
> Internet for ATM transactions is disturbing. I personally experienced
> this while at a Bank of America ATM today. I will never use Bank of
> America because of a statement like that.
>
> -brian
>
> On Sat, 25 Jan 2003, Richard M. Smith wrote:
>
> > However, this worm might not be so harmless as it appears because of
> > collateral damage:
> >
> > Bank of America ATMs Disrupted by Virus
> >
> > http://story.news.yahoo.com/news?tmp...id=569&u=/nm/2
> > 0030125/tc_nm/tech_virus_dc
> >
> > "SEATTLE (Reuters) - Bank of America Corp. said on
> > Saturday that customers at a majority of its 13,000
> > automatic teller machines were unable to process
> > customer transactions after a malicious computer worm
> > nearly froze Internet traffic worldwide."
> >
> > Richard M. Smith
> > http://www.ComputerBytesMan.com
> >
> > -----Original Message-----
> > From: Jason Coombs [mailto:jasonc@science.org]
> > Sent: Saturday, January 25, 2003 4:41 PM
> > To: Jay D. Dyson; Bugtraq
> > Subject: RE: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!
> >
> >
> > Jay Dyson wrote:
> > > And to think...up until tonight, I thought the vulnerabilities
> > > that paved the way for Nimda were the worst that Microsoft could do
> > > to the net.community. They've really topped themselves this time.
> >
> > As of now we don't know who wrote the worm, but we do know that it looks
> > like a concept worm with no malicious payload. There is a good argument
> > to
> > be made in favor of such worms. Whomever did write this worm could have
> > done
> > severe damage beyond unfocused DDoS and chose not to do so. One would
> > expect
> > intelligence agencies in developed countries to write and release
> > precisely
> > this type of concept worm as a form of mass inoculation against
> > malicious
> > attacks.
> >
> > Before you get upset at your vendor, or anyone else's, consider the
> > bigger
> > picture and recognize the increased security hardening the Internet just
> > received. Belief in this silver lining shouldn't be taken too far, of
> > course, but flaming anyone over an event like this is misplaced
> > considering
> > the number of infosec experts who would probably have agreed to write
> > this
> > worm if approached by their nations' government with proof that an
> > adversary
> > was planning to cause severe harm by exploiting the W32/SQLSlammer
> > vulnerability.
> >
> > Sincerely,
> >
> > Jason Coombs
> > jasonc@science.org
> >
> >
>

On Sat, Jan 25, 2003 at 11:40:48AM -1000, Jason Coombs wrote:
> As of now we don't know who wrote the worm, but we do know that it looks
> like a concept worm with no malicious payload.

The payload may not have been malicious to the host, but this does
not imply a lack of malice. It certainly caused, and is causeing
a large ammount of grief in the network sense.

Given the steps taken to randomise the target IP address, it is
highly likely that this worm was targetted at networks, not hosts.

> There is a good argument to be made in favor of such worms.

I'm afraid that your argument doesnt hold up to scrutiny. There is no
logical reason why the rest of the non MS-SQL using world being
affected by an MS-SQL bug (and an inadequecy on the part of MS-SQL
admins) should be a good thing.

If the worm had a malicious (in your terms) payload, it would have
caused networks just as many problems (so no gain there), and more harm
to MS-SQL users. Using your logic, surely this much more damaging
experience would have cause MS-SQL admins to be more responsible in
keeping up to date ? Or rather, more fearful of future exploits.

As it is, MS-SQL admins may feel that since this bug did not affect
them in any serious way (if you can follow that certain line of
thought), they may assume the same thing about future exploits.

When viewed from that perspective, this exploit is as malicious as
possible to general internet infrastructure. Benign to the people who
can do something about it, malicious to those who cannot.

--
colmmacc at redbrick.dcu.ie

Jason Coombs propagated the following meme:
>
> As of now we don't know who wrote the worm, but we do know that it looks
> like a concept worm with no malicious payload. There is a good argument to
> be made in favor of such worms.

There are many arguments against them, too.

1) They have the potential to seriously disrupt delivery of important
services.

2) It takes one bug in the worm to turn it from "mostly harmless" into
"crippling", and nobody has a spare Internet to test a worm on
before releasing it.

3) They cause enormous problems even for those who are not directly
to blame. Consider a co-location. You can keep your own systems
up to date, but that's really no consolation if some idiot in the
same facility hasn't patched their SQL Server boxen, and they melt
the router.

4) They feed a cycle of short, sensationalist incidents that target a
single vulnerability, and then fade into the background.

5) It feeds the myth that it is "good enough" to be reactive when it
comes to security.

6) It has no appreciable long-term benefit. Last year, it was Code Red
and Nimda. Everyone patched their IIS servers. There was the Apache
mod_ssl worm (to a lesser extent) that reminded everyone to patch
their Apache servers. This year, there's Sapphire, and everyone patches
their SQL Server boxes. Next vulnerability, next worm, even if it's in
IIS, Apache or SQL Server again, will catch the _same_ people, _again_.

The solution isn't defensive worms. The solution lies in the recognition
(seldom expressed, lest we later regret it ourselves), that the failure
to patch a seven-month bug is NEGLIGENCE, the failure to firewall non-
essential open ports on network servers is NEGLIGENCE. In other matters,
the failure to implement egress filtering is negligence. We could
probably come up with a pretty good baseline of what is obvious systems
administration negligence when it comes to security.

Few worms exploit vulnerabilities that are new and unknown. Most exploit
those that have been known for months. That it is cheaper for negligent
administrators to wait until the worm hits, suffer a day of disruption
and then fix the problem du jour is simply unacceptable. The only solution,
however, is to somehow make it more expensive to be negligent than it is
to be diligent.

This is difficult. Tort law really isn't very good at handling cases where
a lot of people each do small amounts of damage to a lot of other people.
Even though the aggregate effect is significant, you can't really put your
finger quite firmly enough on who did what to whom. And since the Internet
is decentralised, you can't be slapped down by some authority in charge of
keeping the 'net healthy.

There's always the doomsday scenario. Maybe if this worm had caused major
data-loss, there _would_ be some lasting effect? Or maybe the admins would
have just restored from backup. Who knows?

Charles Miller

--
"Bill Gates reports on security progress made and the challenges ahead."
-- Microsoft's Homepage, on the day an SQL Server bug crippled large
sections of the Internet.

Brian McGrogan <brian@encinc.com> writes:

> The fact that the nations largest banking institution relies on the
> Internet for ATM transactions is disturbing.

The trend to rely more and more on the Internet for our most critical
infrastructures won't change. Quite the opposite, I'm afraid. It's
analog (to a certain degree) to the way we began to rely on the
telephone network (POTS) years ago.

We'll just have to do a better job at securing the Internet, its
infrastructure and applications.

> I personally experienced this while at a Bank of America ATM today. I
> will never use Bank of America because of a statement like that.

I see your point, but a large-scale incident like today's can also
affect private networks (although less likely, of course.)

Eloy.-

The fact that the nations largest banking institution relies on the
Internet for ATM transactions is disturbing. I personally experienced
this while at a Bank of America ATM today. I will never use Bank of
America because of a statement like that.

-brian

On Sat, 25 Jan 2003, Richard M. Smith wrote:

> However, this worm might not be so harmless as it appears because of
> collateral damage:
>
> Bank of America ATMs Disrupted by Virus
>
> http://story.news.yahoo.com/news?tmp...id=569&u=/nm/2
> 0030125/tc_nm/tech_virus_dc
>
> "SEATTLE (Reuters) - Bank of America Corp. said on
> Saturday that customers at a majority of its 13,000
> automatic teller machines were unable to process
> customer transactions after a malicious computer worm
> nearly froze Internet traffic worldwide."
>
> Richard M. Smith
> http://www.ComputerBytesMan.com
>
> -----Original Message-----
> From: Jason Coombs [mailto:jasonc@science.org]
> Sent: Saturday, January 25, 2003 4:41 PM
> To: Jay D. Dyson; Bugtraq
> Subject: RE: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!
>
>
> Jay Dyson wrote:
> > And to think...up until tonight, I thought the vulnerabilities
> > that paved the way for Nimda were the worst that Microsoft could do
> > to the net.community. They've really topped themselves this time.
>
> As of now we don't know who wrote the worm, but we do know that it looks
> like a concept worm with no malicious payload. There is a good argument
> to
> be made in favor of such worms. Whomever did write this worm could have
> done
> severe damage beyond unfocused DDoS and chose not to do so. One would
> expect
> intelligence agencies in developed countries to write and release
> precisely
> this type of concept worm as a form of mass inoculation against
> malicious
> attacks.
>
> Before you get upset at your vendor, or anyone else's, consider the
> bigger
> picture and recognize the increased security hardening the Internet just
> received. Belief in this silver lining shouldn't be taken too far, of
> course, but flaming anyone over an event like this is misplaced
> considering
> the number of infosec experts who would probably have agreed to write
> this
> worm if approached by their nations' government with proof that an
> adversary
> was planning to cause severe harm by exploiting the W32/SQLSlammer
> vulnerability.
>
> Sincerely,
>
> Jason Coombs
> jasonc@science.org
>
>