SQL sequel - worm rear its head after a decade

SQL Slammer,a fast-moving worm that generated a wave of distributed denial of service (DDoS) attacks in 2013, to the surprise it resumed high levels of activity in late 2016 after more than a decade of dormancy.

According to a company blog post Thursday, Check Point Software Technologies detected a " massive" surge in SQL Slammer attacks between Nov. 28 and Dec. 4, 2016. " What we' ve been seeing is not the actual worm, but its attempts to reach more servers," said Maya Horowitz, group manager, threat Intelligence at Check Point, in an email interview with SC Media." Therefore we cannot know for sure if any changes have been [made to] the worm or the vulnerabilities it exploits."

When it first surfaced in 2003, the worm managed to infect tens of thousands of servers and routers in a matter of minutes by exploiting a buffer overflow vulnerability (CVE-2002-0649) in Microsoft SQL Server 2000 or Microsoft SQL Server Data Engine 2000 &ndash both of which are no longer supported.

These infected, exploited machines would then bombard ransom IP addresses with an enormous stream of malicious packets that would infect other vulnerable systems, while simultaneously overloading Internet-based network devices with traffic.

" One theory to why it' s attempting to make acomeback is that cybercriminals are seeking easy ways to cause DoS and slow down the entire Internet, just like with the recent Mirai botnet," said Horowitz.