[prev in list] [next in list] [prev in thread] [next in thread]
List: isn
Subject: [ISN] Internet Worm Hits Airline, Banks
From: InfoSec News <isn () c4i ! org>
Date: 2003-01-27 11:04:13
[Download RAW message or body]
http://www.washingtonpost.com/wp-dyn/articles/A46928-2003Jan26.html
By Brian Krebs
washingtonpost.com Staff Writer
January 26, 2003
An Internet worm unleashed on Saturday impaired key systems in the
U.S. government and private sector, delaying operations at one major
airline and several media organizations, and knocking banks' cash
machines offline.
At least 160,000 computers worldwide have been infected since the worm
debuted early Saturday morning, said Peter Allor, operations director
of the Information Technology Information Sharing and Analysis Center.
"That's really a conservative estimate," Allor said. "We'll know about
the extent of this attack in a few days."
The effects of the worm -- known variously as "Sapphire," "Slammer"
and "SQ-Hell" -- have diminished in many parts of the world since
Saturday. Major Internet service providers were able to block traffic
destined for servers running a vulnerable Microsoft Corp. database
program called SQL Server 2000.
The FBI is investigating the attack, a spokesman for the bureau's
National Infrastructure Protection Center said.
Bank of America Corp. said Saturday that most of its 13,000 automatic
teller machines could not process customer transactions for part of
the day because of the bug.
Other banks also struggled this weekend with the effects of the worm,
said Suzanne Gorman, chairman of the Financial Services Information
Sharing and Analysis Center, which represents some of the nation's
largest financial services companies.
"There were a lot of our members affected by this," said Gorman, who
declined to give more details.
The worm caused flight delays and cancellations for Houston-based
Continental Airlines after it overwhelmed the company's online
ticketing systems and electronic kiosks that travelers use to check
in, said company spokesman Jeff Awalt.
Continental brought the ticketing and kiosk stations back online by
mid-afternoon Saturday, but the airline's Web site was down for most
of Sunday, causing wait times on its reservations hotline to soar to
more than 140 minutes.
The attack also interfered with computer networks at the Atlanta
Journal-Constitution, which had to delay the publication of its Sunday
first edition, the newspaper said. News updates to the paper's Web
site also were delayed by the worm. The Associated Press and the
Philadelphia Inquirer also experienced publishing problems as a result
of the worm.
E-mail and Web traffic move around the Internet using a standard that
breaks the data up into tiny packets of information before sending
them on to their destinations. The data flood produced by a worm or
virus often crowds out some of these packets, resulting in returned --
or "bounced" -- e-mails, and slowed Internet traffic.
The average packet loss at the height of Saturday's attack was a
debilitating 20 percent, according to a senior executive at Matrix
NetSystems, a Web monitoring firm based in Austin, Texas.
"When routers are dropping one-fifth of their packets, you're going to
see mail servers hammered, and in many cases (e-mail) attachments will
be lost in the sending," said Tom Ohlsson, vice president of marketing
and business development.
Major Web site delays occurred at more than 45 times the normal level
at numerous government sites Saturday, including the Departments of
Agriculture and Commerce, the firm reported. Several Defense
Department sites were particularly hard hit, including the Defense
Logistics Agency, the DoD Teleprocessing Center and the Defense
Information Systems Agency, which acts as the computer network
operations center for military Web sites.
A spokeswoman for the Defense Department's Strategic Command in Omaha
declined to discuss the affected Web sites, or provide details on what
action the department is taking against the worm, but said there was
"minimal impact on the DoD domain."
The worm, in its structure and method, resembled Code Red, a worm
released on the Internet in the summer of 2001 that attacked the White
House Web site.
The worm unleashed Saturday did not delete files or harm computers,
but overwhelmed systems with huge numbers of requests for information.
The speed and efficiency with which the worm randomly scanned Internet
addresses for other vulnerable systems caused network degradation over
much of the Internet, said Alfred Huger, senior director of
engineering at Symantec Security Response.
Many businesses that blocked access to Microsoft SQL servers likely
will experience a few problems adjusting their firewalls to allow
legitimate traffic from affiliates and off-site offices that need to
draw information from their parent company's database servers, Allor
said.
"It's probably not going to be business as usual, as companies work
through patching their systems and figuring out exactly which parts of
their business needs to have access to these servers," he said.
South Korea sustained the most damage from the worm, losing almost all
of its Internet service. With 70 percent of its households connected
to the Internet, South Korea is one of the world's most wired nations.
Businesses in South Korea are among the first to open for business in
the new work week, and could face complications caused by lingering
infections, experts said. Overall, however, network traffic associated
with the worm has dropped off nearly 90 percent, according to
Symantec.
-
ISN is currently hosted by Attrition.org
To unsubscribe email majordomo@attrition.org with 'unsubscribe isn'
in the BODY of the mail.
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic