Security News > 2003 > January > Internet Worm Hits Airline, Banks

http://www.washingtonpost.com/wp-dyn/articles/A46928-2003Jan26.html By Brian Krebs washingtonpost.com Staff Writer January 26, 2003 An Internet worm unleashed on Saturday impaired key systems in the U.S. government and private sector, delaying operations at one major airline and several media organizations, and knocking banks' cash machines offline. At least 160,000 computers worldwide have been infected since the worm debuted early Saturday morning, said Peter Allor, operations director of the Information Technology Information Sharing and Analysis Center. "That's really a conservative estimate," Allor said. "We'll know about the extent of this attack in a few days." The effects of the worm -- known variously as "Sapphire," "Slammer" and "SQ-Hell" -- have diminished in many parts of the world since Saturday. Major Internet service providers were able to block traffic destined for servers running a vulnerable Microsoft Corp. database program called SQL Server 2000. The FBI is investigating the attack, a spokesman for the bureau's National Infrastructure Protection Center said. Bank of America Corp. said Saturday that most of its 13,000 automatic teller machines could not process customer transactions for part of the day because of the bug. Other banks also struggled this weekend with the effects of the worm, said Suzanne Gorman, chairman of the Financial Services Information Sharing and Analysis Center, which represents some of the nation's largest financial services companies. "There were a lot of our members affected by this," said Gorman, who declined to give more details. The worm caused flight delays and cancellations for Houston-based Continental Airlines after it overwhelmed the company's online ticketing systems and electronic kiosks that travelers use to check in, said company spokesman Jeff Awalt. Continental brought the ticketing and kiosk stations back online by mid-afternoon Saturday, but the airline's Web site was down for most of Sunday, causing wait times on its reservations hotline to soar to more than 140 minutes. The attack also interfered with computer networks at the Atlanta Journal-Constitution, which had to delay the publication of its Sunday first edition, the newspaper said. News updates to the paper's Web site also were delayed by the worm. The Associated Press and the Philadelphia Inquirer also experienced publishing problems as a result of the worm. E-mail and Web traffic move around the Internet using a standard that breaks the data up into tiny packets of information before sending them on to their destinations. The data flood produced by a worm or virus often crowds out some of these packets, resulting in returned -- or "bounced" -- e-mails, and slowed Internet traffic. The average packet loss at the height of Saturday's attack was a debilitating 20 percent, according to a senior executive at Matrix NetSystems, a Web monitoring firm based in Austin, Texas. "When routers are dropping one-fifth of their packets, you're going to see mail servers hammered, and in many cases (e-mail) attachments will be lost in the sending," said Tom Ohlsson, vice president of marketing and business development. Major Web site delays occurred at more than 45 times the normal level at numerous government sites Saturday, including the Departments of Agriculture and Commerce, the firm reported. Several Defense Department sites were particularly hard hit, including the Defense Logistics Agency, the DoD Teleprocessing Center and the Defense Information Systems Agency, which acts as the computer network operations center for military Web sites. A spokeswoman for the Defense Department's Strategic Command in Omaha declined to discuss the affected Web sites, or provide details on what action the department is taking against the worm, but said there was "minimal impact on the DoD domain." The worm, in its structure and method, resembled Code Red, a worm released on the Internet in the summer of 2001 that attacked the White House Web site. The worm unleashed Saturday did not delete files or harm computers, but overwhelmed systems with huge numbers of requests for information. The speed and efficiency with which the worm randomly scanned Internet addresses for other vulnerable systems caused network degradation over much of the Internet, said Alfred Huger, senior director of engineering at Symantec Security Response. Many businesses that blocked access to Microsoft SQL servers likely will experience a few problems adjusting their firewalls to allow legitimate traffic from affiliates and off-site offices that need to draw information from their parent company's database servers, Allor said. "It's probably not going to be business as usual, as companies work through patching their systems and figuring out exactly which parts of their business needs to have access to these servers," he said. South Korea sustained the most damage from the worm, losing almost all of its Internet service. With 70 percent of its households connected to the Internet, South Korea is one of the world's most wired nations. Businesses in South Korea are among the first to open for business in the new work week, and could face complications caused by lingering infections, experts said. Overall, however, network traffic associated with the worm has dropped off nearly 90 percent, according to Symantec. - ISN is currently hosted by Attrition.org To unsubscribe email majordomo () attrition org with 'unsubscribe isn' in the BODY of the mail.

News URL

http://www.washingtonpost.com/wp-dyn/articles/A46928-2003Jan26.html