London/Seoul, Jan. 27 (Reuters): A two-day-old computer worm that wreaked havoc on the Internet over the weekend appeared to slow to a crawl late today, fizzling out as quickly as it emerged.
Authorities vowed to investigate the “SQL Slammer” bug, seen as the most damaging Net attack in 18 months. The worm hit share trading in South Korea, the world’s most wired country, as investors shied away from placing orders on the Internet.
But security experts considered the US to be the final test for determining if the worm had run its course. When the Internet appeared to function as normal this morning, they said the worst could be over.
“Right now I would say the Internet is looking about as normal and benign as you’d see on any given day. I would say (the worm) is behind us,” said Tom Ohlsson, vice-president of marketing for Matrix NetSystems Inc., a US firm that monitors Internet traffic flows.
There were Internet slow-downs today, but they were scattered and seemed to tail off entirely as the day wore on. Earlier in the day, some firms reported problems as they scrambled to install fortifications against future intrusions. In Europe, security firms reported relatively fewer infected networks than in Asia and the US.
Raimund Genes, European president of security firm Trend Micro said it had logged 1,238 calls from US companies affected by Slammer compared to 40 in Asia and seven in Europe. Some web servers in India and China were also badly hit.
The worm spreads through network connections rather than via e-mail, the medium for previous high-profile virus attacks. The malicious code exploits a weakness in Microsoft Corp’s Windows 2000 SQL server database software, although it does not delete or otherwise touch data. It caused servers to crash and congested traffic on the global network.
Security advisors warned that the worm was designed to rapidly infiltrate networks and that it would continue to do so until servers were sufficiently patched.
Microsoft has developed a patch that can be downloaded at: http://www.microsoft.com/technet/treeview/default.asp'url=/technet/security/bulletin/MS02-039.asp.
Genes marvelled at the design of Slammer, noting that its tiny size of 376 bytes enabled it to spread quickly.