lol the interweb is under attack!

Fudgeman · Post by **Fudgeman** » Sat Jan 25, 2003 7:52 am

http://webhostingtalk.com/showthread.php?s=&threadid=107103

and

att, uunet, verio, qwest in ny, chg, lax, sfo and dfw are having issues according to
internap. they said some major dos.

lol i can't get on alot of pages including otf ?:darkstar:

NebZ · Post by **NebZ** » Sat Jan 25, 2003 7:56 am

i was wondering why i couldnt look at my surf forecast ?_?

roadeh · Post by **roadeh** » Sat Jan 25, 2003 7:58 am

yah wtf everything is slow tonight ;|

Fudgeman · Post by **Fudgeman** » Sat Jan 25, 2003 8:00 am

MORE LINX:

http://forums.military.com/1....1982416

(i must sleep but if anything more comes up in then next say 5 minutes ill post :naughty: )

NebZ · Post by **NebZ** » Sat Jan 25, 2003 8:04 am

TERRARIST ATTAX

roadeh · Post by **roadeh** » Sat Jan 25, 2003 8:12 am

<interweb> IM ABOUT TO BREAK!!!!

<haxorz> lol

Axe · Post by **Axe** » Sat Jan 25, 2003 8:25 am

MS SQL server is infected with something which is causing all servers running it to spit out HUGE amounts of traffic. As a result it's slowing down the internet for everyone. The destination port is 1434, check your router logs, I bet you'll see something.

I have hundreds of logs that look like this:

Saturday, January 25, 2003 12:44:16 AM Unrecognized access from 24.128.113.142:4405 to UDP port 1434
Saturday, January 25, 2003 12:44:21 AM Unrecognized access from 63.214.164.128:1502 to UDP port 1434

Saturday, January 25, 2003 12:46:10 AM Unrecognized access from 61.222.63.85:1719 to UDP port 1434

Saturday, January 25, 2003 12:47:32 AM Unrecognized access from 68.112.245.90:1032 to UDP port 137

Saturday, January 25, 2003 12:50:41 AM Unrecognized access from 66.35.203.100:2400 to UDP port 1434

Saturday, January 25, 2003 12:51:12 AM Unrecognized access from 216.24.174.182:1562 to UDP port 1434

Saturday, January 25, 2003 12:51:51 AM Unrecognized access from 217.57.54.226:3418 to UDP port 1434

Saturday, January 25, 2003 12:53:43 AM Unrecognized access from 62.73.196.52:4819 to UDP port 1434

Forumplanet runs a MS SQL server. They just got owned pretty badly. ^_^

roadeh · Post by **roadeh** » Sat Jan 25, 2003 8:52 am

I downloaded a program from teh sa that shows all traffic for 1434/UDP ports or wutever (where all teh h@xing is going on) and i've got 7 hits in teh last few minutes!

376 bytes from 130.94.96.247:10496 [sprocket.lockergnome.com]
Total hits = 2

376 bytes from 217.205.152.66:1330 [admin.tdksystems.com]
Total hits = 3

376 bytes from 213.114.49.174:29590 [c-ae3172d5.019-50-76786a10.cust.bredbandsbo
laget.se]
Total hits = 4

376 bytes from 63.236.2.218:4079 [LUNA-WEB-6]
Total hits = 5

376 bytes from 141.161.234.172:1171 [wkstn234-172.basic-sci.georgetown.edu]
Total hits = 6

376 bytes from 210.118.195.35:1130 [ONCOM]
Total hits = 7

376 bytes from 209.126.226.130:2581 [TP-WS-01]
Total hits = 8

ollool i really dont know what im talking about though

Stiffer · Post by **Stiffer** » Sat Jan 25, 2003 10:05 am

HAXED BY CHINESE?

obliterator · Post by **obliterator** » Sat Jan 25, 2003 11:42 am