chyangwa
01-26-2003, 00:12
http://tech.sina.com.cn/other/2003-01-25/2138163168.shtml
受不明病毒攻击 全球互联网今日部分瘫痪
--------------------------------------------------------------------------------
http://www.sina.com.cn 2003年01月25日 21:38 红网
红网1月25讯(记者王重浪) 受不明病毒攻击，全球互联网今日部分瘫痪。中国大部分互联网站也无法访问。
从25日中午开始，许多网友发现自己喜欢的网站打不开了。
记者旋即采访了红网技术部主任周明和网络管理员古铜，他们的介绍让记者更加
惊讶：全球internet root nameserver受到攻击！全球网络大部分瘫痪！只有OICQ可以使用。记者立即与全国各地的计算机专家取得联系，发现上海、北京、厦门、浙江、广东、安徽、四川等等，全国各地，同一时刻变得异常缓慢，一段时间后，很多据介绍，攻击来源于一种不知名的病毒。全球用于域名解析的主要dns服务器被感染，因此造成的后果是，电信的带宽被大量占用，大量的网站无法访问。
该病毒利用服务器的一个漏洞，伪造假地址向服务器发送大量访问请求，以此阻塞网络，造成无法访问。
下午14点，中国国内大部分网络陷入瘫痪。截至记者晚上20点为止，部分网络才开始恢复。
另据新华网18点14分报道，因受到黑客攻击，韩国的因特网服务从25日下午开始出现大面积中断，韩国情报通信部已经宣布进入紧急状态。在技术人员的努力下，一小时后，韩国10%的另据美国cnn网站报道，从美国东部时间早上7:11开始，全球互联网遭受不明病毒攻击，网速变慢。
但是，东方网也报道，上海的网速慢可能与上海到北京的光缆出现割接，造成上海地区出口拥堵有关，据“中国电信上海1000号综合服务热线”工号为451的值班班长介绍，他们正在进行紧张抢修。
chyangwa
01-26-2003, 00:39
全球互联网遭病毒袭击 无法访问或速度极慢(2)
--------------------------------------------------------------------------------
http://www.sina.com.cn 2003年01月25日 21:56 新浪科技
据CNN网站报道，北京时间今天上午，国际互联网在全球范围内遭受不明病毒攻击而变慢，从而影响到网民的浏览和email的发送。部分地区甚至一度出现了无法访问网站的情况。
监控互联网运行的多个网站都报告说发现全球范围内网络速度都变得缓慢。专家称这次的攻击与在2001年夏季造成互联网大面积中断的“红色代码”病毒攻击极其相似。
今天发生的这次攻击看来是利用了去年7月发现的微软SQL服务器2000软件上的漏洞。病毒利用服务器的一个漏洞，伪造假地址向服务器发送大量访问请求，从而阻塞了网络，造成用户无法正常访问网站。微软公司认为这个漏洞是“关键性的”而且提供了修补的程序，但是不知道到底有多少计算机管理员使用了修补程序。
著名的防病毒软件公司赛门铁克预计全球至少有2万2千个系统遭到了攻击。
赛门铁克公司的一位高级经理奥利佛-弗里德里希说：“互联网仍然不是很稳定，我们正在从一些用户那里得到关于他们的路由器被攻击的最新报告。”
eEye数字安全公司的工程师在接到关于攻击报告后立刻展开了研究，该公司一位主管马克-麦福瑞特形容这次的攻击就象“红色代码”病毒卷土重来。攻击迅速占用了大量的带宽，造成无法正常操作使用。
chyangwa
01-26-2003, 00:54
http://abcnews.go.com/wire/Politics/ap20030125_718.html
WASHINGTON Jan. 25 —
Traffic on the Internet slowed dramatically for hours early Saturday, the effects of a fast-spreading, virus-like infection that overwhelmed the world's digital pipelines and broadly interfered with Web browsing and delivery of e-mail.
Sites monitoring the health of the Internet reported significant slowdowns globally, although recovery efforts appeared to be succeeding.
Millions of Internet users in South Korea were stranded when computers at Korea Telecom Freetel and SK Telecom failed. Service was restored but remained slow, officials said. In Japan, NHK television reported heavy data traffic swamped some of the country's Internet connections, and Finnish phone operator TeliaSonera reported some problems.
"It's not debilitating," said Howard Schmidt, President Bush's No. 2 cybersecurity adviser. "Everybody seems to be getting it under control." Schmidt said the FBI's National Infrastructure Protection Center and experts at the CERT Coordination Center were monitoring the attack and offering technical advice to computer administrators on how to protect against it.
The FBI was searching for the possible origin of the latest attack, which experts variously dubbed "sapphire," "slammer" or "SQ hell." Some security researchers noted that the software unleashed in Saturday's attack bore striking resemblance to blueprints for computer code published weeks ago on a Chinese hacking Web site by a person who calls himself "Lion." An FBI spokesman said he couldn't confirm that.
Most home users did not need to take any protective measures. Experts said the attack bore remarkable similarities to the "Code Red" virus that struck the Internet during the summer of 2001.
The virus-like attack, which began about 12:30 a.m. EST, sought out vulnerable computers on the Internet to infect using a known flaw in popular database software from Microsoft Corp., called "SQL Server 2000." But the attacking software was scanning for victim computers so randomly and so aggressively sending out thousands of probes a second that it saturated many Internet data pipelines.
Schmidt said disruption within the U.S. government was minimal, partly because the attack occurred early on a weekend. The departments of State, Agriculture, Commerce and some units within the Defense Department appeared hardest hit within the government, according to Matrix NetSystems Inc., a monitoring firm in Austin, Texas.
"This is like Code Red all over again," said Marc Maiffret, an executive with eEye Digital Security, whose engineers were among the earliest to study samples of the attack software. "The sheer number of attacks is eating up so much bandwidth that normal operations can't take place."
"The impact of this worm was huge," agreed Ben Koshy of W3 International Media Ltd., which operates thousands of Web sites from its computers in Vancouver. "It's a very significant attack."
Koshy added that, about six hours after the attack started, commercial Web sites that had been overwhelmed were starting to come back online as engineers began effectively blocking the malicious data traffic. At the height of the attack, another company reported that computers were flooded with more than 125 megabytes of data every second.
"People are recovering from it," Koshy said.
Symantec Corp., an antivirus vendor, estimated that at least 22,000 systems were affected worldwide.
"Traffic itself seems to have leveled off a little bit, so likely only so many systems are exposed out there," said Oliver Friedrichs, senior manager with Symantec Security Response. The attacking software, technically known as a worm, was overwhelming Internet traffic-directing devices known as routers.
"The Internet is still usable, but we're definitely receiving reports from some of our customers who have had it affect their routers specifically," Friedrichs said.
The attack sought to exploit a software flaw discovered by researchers in July 2002 that permits hackers to seize control of corporate database servers. Microsoft deemed the flaw to be "critical" and offered a free repairing patch, but it was impossible to know how many computer administrators applied the fix.
The latest attack could revive debate within the technology industry about the need for an Internet-wide monitoring center, which the Bush administration has proposed.
During the Code Red attack in July 2001, about 300,000 mostly corporate server computers were infected and programmed to launch a simultaneous attack against the Web site for the White House, which U.S. officials were able to defend successfully.
Unlike that episode, the malicious software used in this latest attack did not appear to do anything other than try to spread its own infection, experts said.
AP technology writers Anick Jesdanun and Frank Bajak contributed to this story from New York.
On the Net: Technical details:
More details:
Microsoft fix:
Copyright 2003 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.