New worm burrows into Aust systems

By Patrick Gray
28 January 2003 12:20 PM
Tags: sql slammer, telstra, worm, sapphire, slammer worm, gray, patrick, viruses
The Slammer worm wreaked havoc on Australian networks over the long weekend as it raged through the Internet.

Allan Bell, senior marketing manager with Network Associates (NAI), makers of McAfee anti-virus software, said the company received reports of infection from a large number of Australian companies. But he was quick to point out that the number of infected servers globally was huge.

"250,000 servers were compromised world-wide at Slammers' peak, but we're down to around 20 percent of that now," he said.

Bell says that the congestion had caused general packet loss rates across the Internet to rise from below one percent to around 20 percent at the height of the worm's spread.

Daniel Zatz, security spokesperson for Computer Associates, believes it is too early to determine the worm's impact on Australian systems.

Zatz also said that the number of security updates issued by Microsoft meant many end-users simply missed the patch, failing to protect themselves against the six-month old SQL Server security bug exploited by the Slammer worm.

"Microsoft released the patch back in July, but they released 72 alerts last year, and it's difficult for an end user to keep up them all," he said.

Australian telecommunications heavyweight Telstra was hit by the worm, with some of their servers running the SQL Server software becoming infected. Stuart Gray, a spokesperson for Telstra, admitted that Slammer was able to penetrate the Telstra network.

"The worm did get into our SQL servers, as it did worldwide." he said.

Gray said that Telstra technicians worked through Saturday night to clean up the effects of the worm.

"The clean up began straight away, and was complete by Sunday morning." He would not comment when asked if the servers affected by the worm, contained any sensitive customer data.

Telstra dial-up customers were affected as well. The worm caused so much congestion on the Internet that Telstra dial-up customers were not able to log on, Gray said.

"Users who had already logged on didn't experience any difficulties, but dial-up customers weren't able to authenticate".

Gray says that broadband customers were not affected.

Australians did have a part in alerting the world to the worm. A network operations centre in Adelaide run by global IT services company EDS was the first to report Slammer to the FBI, claimed Brian Finn, communications manager for services giant EDS.

"The EDS network centre in Adelaide detected the attacks at midnight US central standard time and notified the FBI," he said.

Although Finn would not comment on individual EDS customers who may have been infected, he did say that the worm caused a "...wide effect experienced by most customers across the Internet including networks that EDS manages".

Computer Associates have set up a hotline for user who have been infected by the worm. The number is 1800 224 636.

Advertisement

Talkback 2 comments

    What EDS forgot to mention is ...Anonymous -- 28/01/03

    What EDS forgot to mention is that they had not learnt from Nimda. The SQL servers they get paid to administer had not been patched.

    Just as well the T(H)elstra En ...Keith Styles (A very,very disgruntled user) -- 28/01/03

    Just as well the T(H)elstra Engineers who are responsible for their servers, weren't working for me. They would have been given their marching orders for their incompetence.. A failure to maintain server software with all the security patches from M$oft is irresponsible and demonstrates an indifference to their employer and their customers, which is totally unacceptable.

Add your opinion

Latest Videos

Sponsored content

Power Centre - Content from our premier sponsors

Blogs

  • Suzanne Tindal Sick of broken tender sites
    Some of the state governments desperately need to invest in more user-friendly tender sites so that looking for information on government tenders doesn't have to be a game of blind man's bluff.
  • Array Cyberwar: What is it good for?
    In this week's episode, Cyberwar. What is Australia's place in the world of digital warfare? What are the implications for the NBN?
  • Array Is wholesale-only backhaul just a pipedream?
    The potential acquisition of Pipe Networks by SP Telemedia has raised the question about whether vertically integrated backhaul providers will mean higher wholesale prices for ISP customers.
  • More blogs »

Tags

Back to top

Featured