RE: [cobalt-users] SQL Worm

[aljuhani <aljuhani@xxxxxxxxx>]

Our provider's two data centers located in two different geographic locations 
were un-reachable for about 7.5 hours from 0500 HRS GMT to 1230 HRS GMT. 
Emails were delayed for 3 to 5 hours from some networks.

What caused this?? Ask Microsoft?
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bu
lletin/MS02-039.asp

Time to go linux..

http://www.eweek.com/article2/0,3959,845164,00.asp

Al-Juhani
aljuhani@(NoSpam)zajil.net

>===== Original Message From cobalt-users@xxxxxxxxxxxxxxx =====
>DT> Date: Sun, 26 Jan 2003 11:52:27 -0600
>DT> From: Mailing List (David Thurman)
>
>
>DT> I think this hit about midnight EST and crippled the net
>DT> pretty bad. UUNet seemed to take a big knock
>DT> http://www.internetpulse.com showed red for all UUNet Sat
>DT> most the day. All seems back to normal now.
>
>0530 GMT Saturday morning.  Many providers began blocking it
>fairly quickly; UUNet was blocking UDP/1434 within an hour of
>the attack.  Most people noted a substantial decrease in worm
>traffic a few hours after the attack began, as port filtering
>was implemented by various networks.
>
>However, there were networks that were slow to respond.  Some
>routers crashed, and many BGP sessions flapped.  Both of these
>had cascading effects on latency and packet loss.  Situations
>like these are where it's a good idea to have OOB access.
>
>As much as I dislike WorldCom as a company, UUNet has an
>_excellent_ security department.  Chris, Brian, and the others
>are very clueful and responsive.  If all networks had guys like
>them, we wouldn't have problems like this.
>
>Okay, this is OT.  Bottom line:  Yes, the worm caused much
>traffic disruption.  Packet loss wreaks havoc.
>
>
>Eddy
>--
>Brotsman & Dreger, Inc. - EverQuick Internet Division
>Bandwidth, consulting, e-commerce, hosting, and network building
>Phone: +1 (785) 865-5885 Lawrence and [inter]national
>Phone: +1 (316) 794-8922 Wichita
>
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>Date: Mon, 21 May 2001 11:23:58 +0000 (GMT)
>From: A Trap <blacklist@xxxxxxxxx>
>To: blacklist@xxxxxxxxx
>Subject: Please ignore this portion of my mail signature.
>
>These last few lines are a trap for address-harvesting spambots.
>Do NOT send mail to <blacklist@xxxxxxxxx>, or you are likely to
>be blocked.