Micro Trend warns of new Internet virus attack

Taipei, Jan. 28, 2003 (CENS)--A new Internet virus is on the loose, Trend Micro Inc., Taiwan-based worldwide known anti-virus software firm, warned two days ago. The company said that a new virus called 'SQL Slammer' or 'Sapphire' has already triggered a major attack on the Internet.

The virus only attacks Internet systems using Microsoft SQL Servers 2000, which are vulnerable if Service Pack 3 (SP3) has not been installed. The virus exploits buffer overrun vulnerability in Microsoft SQL Server 2000, and spreads via UDP Port 1434, causing potential distributed denial of service (DDoS) attacks that lead to slowdown or failure of affected networks.

Trend Micro indicated that the virus began infecting servers last Sunday and was spreading worldwide on the same day. The company urged personal or corporate computer users to be alert to the virus and to prevent its further spread. Insiders estimated that the number of the infected servers so far ranged from 25,000 to 200,000, making this outbreak the most serious attack on the Internet since the "Code Red" virus in July 2001.

In Asia, South Korea was one of the worst hit areas by "SQL Slammer", with Internet service providers (ISP) being paralyzed and major portal sites shut down for hours. Incidents of the virus have also been reported in Japan, Taiwan, and mainland China over the past couple days.

Hinet, an affiliate of Taiwan's Chunghwa Telecom Co., has been influenced by the virus storm as some of its servers were attacked. The company said that the damaged servers have been repaired though it has not yet issued an estimate of damages.

Trend Micro received calls for help from more than a dozen corporations yesterday, including Internet service providers, Internet content providers, financial institutions and computer manufacturing companies.

Microsoft Taiwan said that the revised edition of SQL Server 2000 has been published on the Internet since last July, and those that have already installed the security patch would not be vulnerable to the virus. The company's updated SP3 edition can be freely downloaded from the Internet.