[55098] in North American Network Operators' Group
Re: New worm / port 1434?
daemon@ATHENA.MIT.EDU (Dr. Mosh)
Sat Jan 25 08:58:27 2003
Date: Sat, 25 Jan 2003 00:38:51 -0800
From: "Dr. Mosh" <nanog@zeromemory.com>
To: Pete Ashdown <pashdown@xmission.com>
Cc: Avleen Vig <lists-nanog@silverwraith.com>, nanog@nanog.org
In-Reply-To: <20030125070306.GA29619@xmission.com>; from pashdown@xmission.com on Sat, Jan 25, 2003 at 12:03:06AM -0700
Errors-To: owner-nanog-outgoing@merit.edu
We had to go through each VLAN to determine which boxes were compromised,
looks like W2K SQL.
This thing is spreading fast.
-D
0. Pete Ashdown <pashdown@xmission.com> farted:
>
> * Avleen Vig (lists-nanog@silverwraith.com) [030124 23:50] writeth:
> >
> >It seems we have a new worm hitting Microsoft SQL server servers on port
> >1434.
>
> Affirmative. Be sure to block 1434 UDP on both the inbound and the
> outbound. Infected servers are VERY NOISY.
--
--------------
http://www.zeromemory.com - metal for your ears.
