[48051] in North American Network Operators' Group
'SQLsnake' Worm Blamed For Spike In Port 1433 Scans
daemon@ATHENA.MIT.EDU (blitz)
Wed May 22 06:11:21 2002
Message-Id: <5.1.0.14.2.20020522060406.00aa8d30@mail.macronet.net>
Date: Wed, 22 May 2002 06:09:39 -0400
To: nanog@trapdoor.merit.edu
From: blitz <blitz@macronet.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Errors-To: owner-nanog-outgoing@merit.edu
>
'SQLsnake' Worm Blamed For Spike In Port 1433 Scans
>http://www.newsbytes.com/news/02/176701.html
>
>By Brian McWilliams, Newsbytes
>SAN MATEO, CALIFORNIA, U.S.A.,
>21 May 2002, 11:04 AM CST
>
>A mounting trail of evidence has security experts warning that a new
>Internet worm targeting Microsoft SQL servers could be on the loose.
>
>Since Monday, a sharp spike in remote probes of TCP port 1433, which
>commonly is used by Microsoft's SQL database, has been reported by
>many server administrators, according to SecurityFocus, which operates
>an incident-reporting system called ARIS.
--snipped for brevity, full article at url above.
