Widespread denial-of-service attack on Internet today - toni

[Anonymous]

A very widespread denial of service attack is currently affecting parts of the Internet. Many major networks in the US and elsewhere are affected. This kinds of attack makes services (web, email, etc) slow or unavailable.

Our webcam shows (and also the chat room) are broadcast from a UK network which so far seems not to be directly affected; but distant users might still experience slow speeds or timeouts because of problems on other networks (e.g., AboveNet, which handles a lot of transatlantic traffic, is affected right now).

Our web pages (all except for pages on media.skymouse-productions.com) are hosted in the US and are slow or inaccessible. This includes the log in page for the webcam show. This means that (depending on each user's location) you might have different levels of difficulty reaching the webcam login page, and actually viewing the webcam and chatroom.

Obviously, we're hoping that today's DOS attack will be blocked soon, but because of the nature of these things (attacks launched from large numbers of locations simultaneously; every ISP independently having to identify and protect affected parts of their network) it can take a while. Meanwhile, please be aware that if the Internet remains affected tonight, these problems may affect the performance or accessibility of tonight's show for many users.

SM

[WD12]

My server is in a hi-tech facility near where I live and has been inaccessable or erratic since last night. But I haven't had any trouble at all accessing any part of your site. Hope the show isn't affected.

[Ger]

And as an additional message. We got emails that the Female Desperation site was not accessable or very slow even for fast connections. This has to do with this same "internet attack". So please stop emailing us.... we know it and can't help it. Good luck tonight Sky, let's hope it works OK.

Ger & Shara.

[Anonymous]

Sat 25 Jan: There has today been a denial-of-service attack on many parts of the Internet worldwide, and this has affected web and other Internet services for many users. We have been advised that some ISP's will still be having trouble by tonight. Therefore, to make sure that people don't miss our webcam because of remaining problems on their own ISP's and other networks, we have moved tonight's webcam to 00:30 GMT on Saturday morning, February 1 (or Friday night in USA and other regions west of GMT).

Please see The Webcam Diary Page (http://media.skymouse-productions.com/media/diary.asp) for the new schedule in your time zone.

SM

[Ger]

Woo Wee. That's not good news. I hope people can overcome this dry weekend. On the other hand, next week two days in a row 3 wet girls images/smiles/icon_smile.gif BTW, after 24 hours of verrrrrrrrrrrrrry slow internet and FTP connections, things seem to be OK again in the Netherlands.

Ger.

[ 25 January 2003: Message edited by: Ger ]</p>

[Anonymous]

This is bad news mate, the last show I tried to watch was postponed due to the models accident and your re-scheduled one was when I had gone on holiday, now I've come back the first one I try to watch is canceled again, that's four consecutive shows I've missed, I'm gutted Sky

MikeyH

[Anonymous]

I'm sorry that we have had to move tonight's show - I know that not every time chosen suits everybody, and the re-scheduled time for the show might be inconvenient for some. It is a difficult choice deciding whether to move an event that involves so much pre-planning, but in this situation we may have been broadcasting while the Internet was still not working properly for a lot of the audience.

SM

[Anonymous]

For those who are interested in the technical aspects of what happened on the internet today, you can read about it at

http://www.internetnews.com/xSP/article.php/1574691

If you run Microsoft SQL Server, you may want to make sure you have installed the Security Hotfix (http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-039.asp).

SM

[WD12]

Totally understandable Sky. You could quite justifably simply have cancelled. By rescheduling for a problem you had no control over you once again show how highly you value your subscribers.

We appreciate it, though to get all worked up and not have a show is disappointing I'm sure we all understand.

[WD12]

BTW, my server runs dozens of web sites, is running Apache server and Linux OS, and hasn't been sucessfully attacked or crashed in three years.

Not a rip on Sky, this attack in no way indicates he has been remis in attention to his server. He's running Apache on a Linux box too.

It's the Internet that has a problem, not Skys' server. In this attack I can't even blame Microsoft. The patch was put out there, network admins take note!

[Anonymous]

Here's a little more info for those of you who are interested in what happened. I was uploading files to my server Friday night when things all of sudden crashed. Thinking I had done something wrong, I immediately emailed my host. This morning, I received the following very informative reply:

<blockquote><font size="1" face="Verdana, Arial, Helvetica, sans-serif">quote:</font><hr> It appears that your web site and email are working properly now, and due to
the time at which the problem occurred it is likely that the problem was
brought about by an attack that occurred on the Internet Friday night.

As you may be aware, about, or shortly after, midnight eastern time Friday
night a widespread attack occurred on the Internet. This attack involved a
known vulnerability for Microsoft's SQL Server 2000 and the MS Desktop
Engine 1.0. Microsoft issued a patch for this vulnerability in the summer of
last year but, unfortunately, not all system administrators applied the
patch.

The attack involved a self-spreading virus-like program which attacked
vulnerable SQL Server 2000 (and MSDE) machines, causing them to also begin
sending the same malicious program in an attempt to infect other vulnerable
machines. As a result of the large amounts of data being sent by infected
machines, wide spread slow-downs and outages occurred on the Internet.

Note that all our servers are regularly patched to prevent such malicious
code from executing and that none of our machines were affected. However,
the large amount of Internet traffic generated by other machines on the
Internet that were infected caused slow-downs on our networks as well.

Most of the problem has been resolved as Internet backbone providers began
filtering the packets involved in the attack, and at this time most Internet
activity is back to near-normal performance.
<hr></blockquote>

I know this is Greek to many of you (myself included), but I thought some of you might find it interesting. It was also on CNN news this morning as well.

[WD12]

Not Greek at all. What it means is lots of sys admins had the opportunity to prevent this and were simply lazy or too stupid to implement the updates.

Your ISP is quite right in identifying the problem.

Now my swipe at MS. All these attacks are directed at servers running Microsoft server software. I am not aware of even ONE attack on Apache or a Linux based box.

Please correct me if I'm wrong.

[Anonymous]

&lt;&lt;&lt;I am not aware of even ONE attack on Apache or a Linux based box.&lt;&lt;&lt;

I don't think you are wrong - but that's just because MS is much more widespread and in focus. If Linux would be in the position MS is in, all these attacks would aim at Linux. And don't tell me it's more secure - there is always a way...