[Threshold]

Slashdot Article

Originally Posted by Since about midnight EST (1/25/03) almost every host on the internet has been receiving a 376 byte UDP payload on port ms-sql-m (1434) from a random infected server. Reports of some hosts receiving 10 per minute or more. internetpulse.net is reporting UUNet and Internap are being hit very hard. This is the cause of major connectivity problems being experienced worldwide. It is believed this worm leverages a vulnerability published in June 2002. Several core routers have taken to blocking port 1434 outright. If you run Microsoft SQL Server, make sure the public internet can't access it. If you manage a gateway, consider dropping UDP packets sent to port 1434. This has effectively disabled 5 of the 13 root nameservers.

Additional links and information:

The MSFT SQL vulnerability

Originally Posted by Microsoft's database server SQL Server 2000 exhibits two buffer overrun vulnerabilities that can be exploited by a remote attacker without ever having to authenticate to the server. What further exacerbates these issues is that the attack is channeled over UDP. Whether the SQL Server process runs in the security context of a domain user or the local SYSTEM account, successful exploitation of these security holes will mean a total compromise of the target server and its data.

And:

More on the DDoS Attack

Originally Posted by We are monitoring massive Distributed Denial of Service attacks all over the U.S. tonight starting at around 11:30 PM CST. As many as 5 of the 13 root nameserver have been down, up to 10 with massive packet loss (xx%):

Yuck. MSFT's crappy, insecure code strikes again.

A direct copy-paste from slashdot.

Woo.

[Threshold]

Originally Posted by Ingham wrote: A direct copy-paste from slashdot. Woo.

Um..... The first paragraph was, as was noted by the "Slashdot article" link.

The rest of the information was quoted from other sites.

Do you have a good reason for being insulting when I was sharing information of value to mudders?

A lot of people's net access was affected by this, and I imainge some people might have been wondering why their favorite mud seems to have disappeared (with 5 of 13 nameservers down) or perhaps wondering why their connectivity was poor (since UUnet is the largest backbone provider in the US).

[Dulan]

As an aside - this inormation is actually not valuable to MUDders, Threshold.

It is, at best, of indirect value to most people on this board, of which I believe the majority of mudders could hardly give a fsck about.

(It is of direct value to me, I must admit. But, I don't want reposted slashdot articles on these boards. And let's not even get into the issues of plagarism, even with quoted stuff. Slashdot got into trouble with it themselves )

-D

[Bastien]

I appreciated it, myself, Thresh. Rock on, thanks for caring, all that.

On a related note, Could God make a Santa hat so big that he himself could not wear it?

[Valg]

I cannot understand the appeal of hanging around waiting to flame someone who posts a heads-up with useful information. I had periodic disconnects last night, and the above information lets me know that I don't need to contact my ISP about problems- it's big enough that they're aware. MUDders tend to be online a good bit, and (depending on your style of MUD) small bursts of lag/disconnect can severely impact your ability to play.

If the information isn't useful to you, personally, feel free to move along and read the next post.

[Orion Elder]

Originally Posted by (Ingham @ Jan. 25 2003,12:00) A direct copy-paste from slashdot. Woo.

I'm still not quite sure how that was 'insulting.' ####, he may have liked that it was posted from Slashdot... and was patting you on the back.

[Azhon]

<posted in wrong thing, sorry>

Originally Posted by (Orion Elder @ Jan. 25 2003,15:47) I'm still not quite sure how that was 'insulting.' ####, he may have liked that it was posted from Slashdot... and was patting you on the back.

I'm an avid slashdot reader myself, hence why I knew the article was from there...

Ah well, port 1434 shouldn't be open in the first place...

[Samson]

Sheesh. Some people. I know I was certainly doing some head scratching last night when everything just stopped working for no reason. Was only able to access things on my ISP, and so I emailed them. Now at least I know the extent of things was much MUCH larger than anything local. Now I have something I can point my clients to and say "See, it wasn't my fault!"

And Dulan, I fail to see how it wasn't important to mudders. Obviously it was, and to other net users in general. When an attack cripples the net like this, most people think in terms of what they're not able to get to. Mudders who can't mud become irritable people as any host who deals with them should be able to tell you

[Threshold]

Ingham: I interpreted your statement as meaning it was lame to share the information from slashdot. If you weren't trying to flame, I apologize for my response (though please note that about 3/4 of my post was not copied and pasted from slashdot).

Dulan,

How can a major internet problem not be of interest to mudders and admins?

As has been made clear by multiple posts in this thread, the problem affected a lot of people. Since those people have already thanked me for sharing the information, I'd say it is plainly evident that the information WAS in fact useful.

As an example, before I posted it here, I asked on Threshold if there were people having trouble, and some of them HAD been having difficulties since last night. I would imagine many other mud player bases were similarly affected.

Furthermore, any DDoS that is reported to be majorly affecting UUnet can potentially affect almost everyone.

UUNet has 93,000 miles of fiber optic cables on 6 continents. It is the largest bandwidth provider in the world. 50 percent of all the e-mails in the world pass through UUNet backbone, as well as 70 percent of those that travel within the United States.

Additionally, when 5 of 13 root nameservers go down, that means many people might think their mud "disappeared", when in truth they just cannot reach it by name.

That kind of information is very valuable and helpful to mudders and mud admins.

Originally Posted by (Threshold @ Jan. 25 2003,19:24) Ingham: I interpreted your statement as meaning it was lame to share the information from slashdot. If you weren't trying to flame, I apologize for my response (though please note that about 3/4 of my post was not copied and pasted from slashdot).

That's all okay, never meant to flame you.

[AlazlamBL]

Just wanted to say thanks for the heads up. It's helped relieve some confusion.

[Threshold]

Originally Posted by Ingham wrote: That's all okay, never meant to flame you.

Then once again, I am sorry. Flaming happens so often for apparently no reason (see Dulan's post in this thread), it is easy to see flames where there is not even smoke!

Originally Posted by AlazlamBL wrote: Just wanted to say thanks for the heads up. It's helped relieve some confusion.

You're welcome. I am glad the post explained what was going on yesterday to a number of people.