Slashdot Log In
MS SQL Server Worm Wreaking Havoc
Posted by
pudge
on Sat Jan 25, 2003 07:43 AM
from the no-man-will-know-the-day-or-the-hour dept.
from the no-man-will-know-the-day-or-the-hour dept.
defile writes "Since about midnight EST almost every host on the internet has been receiving a 376 byte UDP payload on port ms-sql-m (1434) from a random infected server. Reports of some hosts receiving 10 per minute or more. internetpulse.net is reporting UUNet and Internap are being hit very hard. This is the cause of major connectivity problems being experienced worldwide. It is believed this worm leverages a vulnerability published
in June 2002. Several core routers have taken to blocking port 1434 outright.
If you run Microsoft SQL Server, make sure the public internet can't access it. If you manage a gateway, consider dropping UDP packets sent to port 1434." bani adds "This has effectively disabled 5 of the 13 root nameservers."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Terrorism, must be (Score:5, Interesting)
It said the shutdown was triggered by "apparent cyber terror committed by hackers".
http://news.bbc.co.uk/1/hi/technology/2693925.stm [bbc.co.uk]
Re:Terrorism, must be (Score:5, Funny)
Parent
billg has no uniform; therefore illegal combatant (Score:5, Funny)
does not wear a military uniform.
So he must be an _illegal_ combatant.
Therefore, if guilty, he will have to go to
Guantanamo Bay for a few years to "help with
investigations".
Of course, proof cannot be given for his guilt
because that might jeopardize national security.
Therefore no trial until terrorism is defeated.
Can't afford to take chances with them terrorists!
Parent
As I said in a previous post... (Score:5, Informative)
It's only the fact the traffic is all destined for a certain destination port that makes it easy to filter.
You are filtering it out on your firewalls, aren't you?
This could have been a lot lot harder to filter out. I expect we'll see ThisWorm v2 soon.
I dread the day someone finds a hole in Apache, Sendmail or something really popular and writes a worm like this...
Re:As I said in a previous post... (Score:5, Informative)
You are filtering it out on your firewalls, aren't you?
Exactly. From the MS Security bulletin:
The risk posed by the vulnerability could be mitigated by, if feasible, blocking port 1434 at the firewall.
What the heck was it doing open in the first place?
Parent
Re:As I said in a previous post... (Score:5, Insightful)
As far as I'm concerned, boxes SHOULD be able to stand on their own without firewalls. A firewall just adds another layer.
Sounds like you're advocating armadillo security to me - hard on the outside, soft on the inside.
Parent
Re:As I said in a previous post... (Score:5, Insightful)
"Oh, it's OK because it's behind the firewall..."
I think firewalls make people lazy. Imagine if we didn't have firewalls. We'd have to keep our passwords good, our services minimal, and make sure we were running the latest, most secure daemons.
Parent
Re:As I said in a previous post... (Score:5, Interesting)
I have argued for many years that people tend to get the idea that a firewall is some kind of +8 amulet of protection they just strap on which will protect them from pretty much anything.
However there are real benefits to using firewalls and NAT boxes. Unfortunately there are some members of the IESG who are confused on this point but thats because they are blinkered by the end-to-end dogma. I'll note here that Steve Bellovin, the new security AD knows a thing or two about firewalls.
There are actually two end-to-end principles. Applied to networking it meant put the intelligence at the ends, not in the middle of a communication. This was applied to security to mean the same thing.
End-to-end is appropriate to the design of network protocols, it is inappropriate as a guide to operational security. Many protocols are not designed securely, most protocol implementations have flaws.
Another dogma that is inappropriate to operational security is the 'security through obscurity' trope. A design that relies on security through obscurity is broken. This does not mean that operators should divulge all the details of their operations to attackers in the hope this will improve security, it will not. Argument of this type was used to block the introduction of shadow passwords on UNIX for years after the vulnerability to dictionary attacks was widely known and being exploited by attackers.
A firewall and NAT box provides a significant degree of security at low cost. NAT provides a means of concealing the internal structure of the network. This does not eliminate the possibility of attack but raises the bar significantly. If you are running a site that is considered attractive to hackers a technology that weeds out the knob turners and dimmer script kiddies has value.
What we need to move to is security in depth, recognizing that design security and operational security are different and that both are important.
Parent
Re:As I said in a previous post... (Score:5, Interesting)
These people are just as likely to say things like "I'm 3DES encrypting my data, so there's no way anybody can read it", because they fail to understand the meaning of statements like "cracking 3DES is computationally infeasible". When you try to explain to them that their webserver and applications are much more likely to be their weakness than their encryption algorithm, they give you blank looks and mutter about the Computerworld article that said 3DES is "unbreakable encryption". It's not a problem with 3DES (or any strong algorithm); it's a problem with people not understanding that any security measure can be negated by poor design in other parts of their architecture.
It's the same thing with firewalls. Only the unknowledgable would drop in a firewall and then go off to the bar to celebrate their newly "secure" network. That doesn't mean that the firewall is useless; it is still a crucial tool for securing one's network. The problem is the people who have no idea how to use the tool properly, and no concept of what a real-world attack actually looks like.
Parent
Re:As I said in a previous post... (Score:5, Funny)
Locks promote softer security.
"Oh, I'm OK because I have locked doors and windows..."
I think door locks make people lazy. Imagine if we didn't have deadbolts, or doors for that matter. We'd have to sit in front of the front door, with a shotgun, never sleeping for more than a few moments.
Parent
Re:As I said in a previous post... (Score:5, Informative)
When the SQL Server 2000 client Net-Libraries connect to an instance of SQL Server
2000, only the network name of the computer running the instance and the instance
name are required. When an application requests a connection to a remote computer,
Dbnetlib.dll opens a connection to UDP port 1434 on the computer network name
specified in the connection. All computers running an instance of SQL Server 2000
listen on this port. When a client Dbnetlib.dll connects to this port, the server
returns a packet listing all the instances running on the server. For each instance,
the packet reports the server Net-Libraries and network addresses the instance is
listening on. After the Dbnetlib.dll on the application computer receives this
packet, it chooses a Net-Library that is enabled on both the application computer and
on the instance of SQL Server, and makes a connection to the address listed for that
Net-Library in the packet.
So the UDP 1434 port is open when the SQL Server is started to listen all the clients
with any IP address on this port. SQL Server only receives the packet from the client
on this port to determine which instance the client attempts to access and return the
related information of the SQL Server to the clients. Then, the clients can create
the connection to the SQL Server with the protocol enabled on the server side.
Parent
Re:As I said in a previous post... (Score:5, Informative)
with any IP address on this port. SQL Server only receives the packet from the client
on this port to determine which instance the client attempts to access and return the
related information of the SQL Server to the clients. Then, the clients can create
the connection to the SQL Server with the protocol enabled on the server side.
There is a difference between a port being open on the machine the service is on and the port being open to the world. You should not leave this port open to the world. If people outside your firewall need access to your internal MSSQL server, you leave TCP 1433 open to selective hosts.
Parent
Re:As I said in a previous post... (Score:5, Insightful)
Parent
Re:As I said in a previous post... (Score:5, Informative)
I bloody hope no-one is specifically blocking this port. That's not how firewalls are supposed to be used. First you block everything then only open the specific ports you need. In most cases, these are 80 and 22 and maybe 25. There's no reason a database server's protocol port should ever be exposed to the public Internet!
Parent
Re:As I said in a previous post... (Score:5, Insightful)
Parent
Re:As I said in a previous post... (Score:5, Informative)
Parent
Re:As I said in a previous post... (Score:5, Informative)
Parent
Re:As I said in a previous post... (Score:5, Interesting)
I, for instance allow no incoming, but don't restrict outgoing. It's not a huge corporation, it's a R + D lab, where the overhead and hassle I'd cause by restricting outbound traffic would stiffle the lab users productivity. Still, I added the block to that specfic port in the slim chance that an internal box was infected (lord knows how) that it would be a localised problem, not contributing.
I don't think you should tell people what firewall rules they should be running.
Parent
Re:As I said in a previous post... (Score:5, Insightful)
Parent
Re:As I said in a previous post... (Score:5, Insightful)
That's what VPNs are for, my friend.
Parent
Re:As I said in a previous post... (Score:5, Interesting)
As far as I can see that's nonsense. If he or she had the worm wouldn't work as well as it did.
Parent
Re:As I said in a previous post... (Score:5, Interesting)
Um, like the original Internet Worm [nasa.gov] which started all this trouble in the first place? :-)
This was the incident that sparked the creation of CERT/CC [cert.org]. Every time I see another worm, I wonder why we still haven't learned [mit.edu].
Dave
Parent
been watching this all night (Score:5, Informative)
Collected a packet disasembly and some urls here [freedom.org].
Everyone seems to be assuming this is a new use of an old (July) hole; I'm not certain of that. Any facts welcomed, see above url.
Re:been watching this all night (Score:5, Funny)
the fun's almost over now"
I sincerely thank you, Sir or Madam. I previously thought that I was the most sad, laughable figure in the entire world, but now, having read your post, which conjures up images of someone sitting in front of their monitor, snacks in hand, gasping in amazement at the output of tail -f on their firewall log all night, I know that there is yet hope for me.
graspee
Parent
Patch (Score:5, Informative)
Re:Patch (Score:5, Funny)
Gates pledges better software security
Electronic attack slows Net
Now if they would only address security before they released their products we might not see these issues.
Parent
wow yeah! (Score:5, Interesting)
Someone really has carefully crafted this worm to try to bring down the net.. and what better time then on a Saturday morning when all admins are away and not planing to work the next day!
Re:wow yeah! (Score:5, Insightful)
AND verisign will be down for certain hours while
Parent
Re:wow yeah! (Score:5, Funny)
What's it matter? It's not like you people have gone to work since last July [microsoft.com] anyway.
Parent
Ok now tell me (Score:5, Funny)
Re:Ok now tell me (Score:5, Funny)
Parent
First hand report (Score:5, Interesting)
Whoever puts their database server (Score:5, Insightful)
NGSSoftware alerted Microsoft to this problem on the 17th of May 2002 and
they have produced a patch that resolves these issues.
This is January 25 2003 if I'm not mistaken. Are these the same people that leave their cars unlocked with the keys in the ignition?
Re:Whoever puts their database server (Score:5, Funny)
A real idiot would leave the car locked witht the keys in the ignition...
I guess they learn something at MSCE courses
Parent
Information about the worm (Score:5, Informative)
Whoever... (Score:5, Insightful)
Sysadmins like that should be dragged into the street and shot.
Re:Whoever... (Score:5, Insightful)
V P N
There is NO excuse for leaving BACKEND services like DBs, appservers, or whatever else visible on the public net. NONE WHATSOEVER. I work on a major website with multiple different data servers and backend applications, all distributed (and load balanced) over 4 physical sites on 2 continents. We use private circuits to handle the inter-site traffic, you could use VPN just as well. But everything vulnerable is buried from the internet behind several layers of firewall. Anything else is sheer lunacy.
Crappy admins bring this kind of attack on themselves, and alas, on the rest of us too.
Parent
best writeup (Score:5, Informative)
Some Links (Score:5, Informative)
http://average.matrixnetsystems.com/Daily/markR.h
http://mrtg.nac.net/switch9.oct.nac.net/3865/swit
The advisory announcing the flaws:m / [digitaloffense.net]
http://www.boredom.org/~cstone/worm-annotated.txt [boredom.org]
http://www.nextgenss.com/advisories/mssql-udp.txt [nextgenss.com] Various disassemblies and discussions: http://www.snafu.freedom.org/tmp/1434-probe.txt [freedom.org] http://www.digitaloffense.net/worms/mssql_udp_wor
Writeups:n et.attack.ap/index.html [cnn.com] / 20030125/ap_wo_en_po/na_gen_internet_attack_2 [yahoo.com] r tdetail.jsp?oid=21824 [iss.net]
http://www.cnn.com/2003/TECH/internet/01/25/inter
http://news.bbc.co.uk/2/hi/technology/2693925.stm [bbc.co.uk]
http://story.news.yahoo.com/news?tmpl=story&u=/ap
http://bvlive01.iss.net/issEn/delivery/xforce/ale
Collected info: (Score:5, Informative)
Some snippets from there:
Yow! Good call /. (Score:5, Funny)
Woah! What's.. uh.. 150 inbound requests.. doing.. today.. worm?
I start to fire up
*clickity click*
1434? The hell is 1434. Worm?
*slashdot shows*
Ah ha! Ve haf comprehension.
*groggily shuffle off to get coffee, oooo black gold*
For what it's worth, a majority of the packets so far have been mostly US servers --
Re:Yow! Good call /. (Score:5, Funny)
tybclbsqla02.listbuilder.com
Hmm. Lists equal large databases.
Large databases usually mean a DBA.
DBAs should know better.
whois listbuilder.com
Technical Contact:
Microsoft (EJSEHEQUAO)
msnhst@MICROSOFT.COM
Microsoft
One Microsoft Way
Redmond, WA 98052
US
425-882-8080
Parent
Fox News (Score:5, Funny)
"The virus spreads using a Microsoft vulnerability known as "SQL Server""
50% from Colleges??? (Score:5, Interesting)
A bug in CISCO routers is helping to control this! (Score:5, Informative)
"...the volume from this triggers the Cisco netflow switching bug and is causing routers to lock up at places, etc."
This will continue (Score:5, Insightful)
Ironic timing... (Score:5, Informative)
Gates acknowledged that the technology industry must make significant improvements, adding that, "Microsoft has a responsibility to help its customers address these concerns, so they no longer have to choose between security and usability."
How about easier ways to apply hotfixes remotely to desktop computers? (There are ways apparently, but requires installing IIS and SQL ironically, to run something called SUS.) I'd prefer the hotfix to simply have an option like '-m\\machine' to apply to domain machines in a domain admin context so I can script the installs to my tastes and needs. No need to get overly complex. Besides, I'd rather not have an IIS server at my site if I can help it. Apache runs everything. Just another damn thing to learn for something that should be simple.
Also, the hotfixes themselves only have about 10 different ways of applying at the command line unattended. How about standardizing the hotfix installers too...
Example, this is what is run after an XP desktop install with SP1 at our location...
It doesn't include latest javavm fix, which for some reason won't install right during the guirunonce part of an install, so I have to script to reboot the machine TWICE before running... Think that's bad? Here's some pre sp1 hotfix command lines from an earlier script.. And the syntax to install unattended is never easy to find on their site. I usually have to use google to search microsoft.com to find what I need, their search engine really sucks. Others must feel the same way since there is a dedicated google page for this at http://www.google.com/microsoft [google.com]Re:Who did this I wonder????? (Score:5, Funny)
I investigated into this matter, and came up with the following theory.
Port 1434 = 1+4+3+4 = 12
12 is the number of the month when Steve Gibson got hired as a consultant [grc.com]. Coincidence? I think not!
SQL (alphabet numbered) = S(19) + Q(17) + L(12) = 48
48 is the number of states which are connected together on US map. That means that attack came either from Hawaii or Alaska.
Using the search on a popular site called Google, I was able to track down [google.com] the perpetrator.
So at the end we are left with one answer: Steve Gibson is just hax0ring back, in an elaborate revenge plan to outlaw port 1434 and raw sockets.
Parent
Re:What's inside ? (Score:5, Informative)
Parent
Re:Turn your SQL server off? (Score:5, Insightful)
No, it's a very reasonable one. Yes, you still need to patch, use non-blank SA passwords and the other things you suggest, but if you have an SQL server (any SQL server) directly visible to the Internet then you are either a fscking moron or have a very abnormal circumstance. A database server is a backend server, and should be completely hidden from the Internet by not one but two layers of firewalls.
Basically, in this day and age, your setup from the Internet in to your internal LAN, should be (as a minimum):
Internet router(s) => Firewall(s) => Web servers (HTTP, mail relays, proxies, VPN termination, etc.) => Firewall(s) => backend servers (SQL, internal mail etc..) => Internal network.
Some of these networks can quite easily be different ports on the same physical firewall, but I'm limited by ASCII. Alternatively, if you have no backend servers, that segment can obviously be omitted altogether.
Firewall rulesets can, and should, apply to outbound as well as inbound traffic and allowing traffic to flow cleanly accross multiple firewalls should be limited as much as possible. At a pinch, you could put your backend servers (if any) directly on the internal LAN, and get by with a single, three port firewall, but this should be the absolute minimum setup if you are hosting connections from the Internet. Sticking a two port firewall between your network and the Internet is simply not good enough anymore.
With resonable DMZ capable firewalls available for less than $500, either as a dedicated box, or old PC running the open source apps of your choice, there is no fiscal reason for even the smallest of companies not to be secure. As ever, the real reason is lack of a clue when it comes to matters of security.
Parent