[Dshield] Increasing number of SQL_Slammer_Worm

Joel Esler eslerj at gmail.com
Sat Aug 13 11:47:05 GMT 2005


Using RealSecure eh?



On 8/12/05, Henderson, Henry <Henry.Henderson at oa.mo.gov> wrote:
> In the last couple of days we have been seeing a increasing number of
> SQL_Slammer_Worm attempts against our public sites.
> 
> A high number are from Asian countries, is anyone else seeing this.
> 
> 
> 
> Tag Name                                 Severity  Event Count Source
> Count Target Count  Object Count     Earliest Event            Latest
> Event
> 
> SQL_SSRP_Slammer_Worm      High      2,124334           1440
> 12654               1          2005-08-10 07:00:00 CDT
> 2005-08-12 12:00:00 CDT
> 
> 
> 
> Time                                                     Tag Name
> Event Count       Severity Source IP          Target IP           Object
> Name
> 
> 2005-08-11 07:43:57 CDT           SQL_SSRP_Slammer_Worm      726
> High      219.132.16.242  XXX.XXX192.162            1434
> 
> 2005-08-11 09:54:45 CDT           SQL_SSRP_Slammer_Worm      722
> High      222.73.0.234     XXX.XXX60.103              1434
> 
> 2005-08-11 09:37:12 CDT           SQL_SSRP_Slammer_Worm      718
> High      61.186.252.184  XXX.XXX209.153            1434
> 
> 2005-08-11 10:03:49 CDT           SQL_SSRP_Slammer_Worm      718
> High      218.89.170.120  XXX.XXX154.240            1434
> 
> 2005-08-11 09:44:43 CDT           SQL_SSRP_Slammer_Worm      715
> High      61.143.101.100  XXX.XXX51.122              1434
> 
> 2005-08-11 09:36:11 CDT           SQL_SSRP_Slammer_Worm      714
> High      219.159.73.220  XXX.XXX15.135              1434
> 
> 2005-08-11 09:40:40 CDT           SQL_SSRP_Slammer_Worm      708
> High      218.251.19.216  XXX.XXX67.67                1434
> 
> 2005-08-11 07:57:43 CDT           SQL_SSRP_Slammer_Worm      707
> High      220.210.112.244 XXX.XXX149.25             1434
> 
> 2005-08-11 09:48:02 CDT           SQL_SSRP_Slammer_Worm      705
> High      83.222.7.36       XXX.XXX114.183            1434
> 
> 2005-08-11 09:51:05 CDT           SQL_SSRP_Slammer_Worm      704
> High      218.251.19.216  XXX.XXX158.203            1434
> 
> 2005-08-11 09:38:13 CDT           SQL_SSRP_Slammer_Worm      703
> High      61.145.116.159  XXX.XXX122.60              1434
> 
> 
> 
> 
> 
> Henry Henderson
> Missouri Office of Administration
> Information Technology Services Division
> Information Security Managment Office
> 573-526-6923
> 
> 
> 
> 
> 
> ****************************
> CONFIDENTIALITY STATEMENT:
> This e-mail and any attachments are intended only for those to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure and unauthorized use under applicable law.  If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender.  If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.
> 
> _______________________________________________
> send all posts to list at lists.dshield.org
> To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list
>



More information about the list mailing list