Slammer effect slight in NZ

The SQL Slammer worm, which hit some servers hard and congested internet links internationally over the weekend seems to have largely been a non-event in New Zealand.

The SQL Slammer worm, which hit some servers hard and congested internet links internationally over the weekend seems to have largely been a non-event in New Zealand.

According to Mike Spring of the Centre for Critical Infrastructure Protection, "we didn't see anything of it, the ISPs must have been blocking it”.

With Auckland being on an anniversary holiday today a lot of the major ISPs were not immediately available to report on how they fared. TelstraClear spokesman Matthew Bolland says the company had five engineers working on the problem from Saturday evening to early Sunday morning.

"We weren't affected as a business ourselves," he says, "we had all the proper patches in". However, a number of users were infected by the worm and sent large volumes of traffic onto the ISP's network.

"When we saw heavy traffic coming from particular customers, we just had to disconnect them from the internet."

Engineers will be contacting those people, helping them get rid of the worm and apply fixes against further infection.

"People on volume billing could get a shock when they see their charges over the weekend," Bolland says. TelstraClear will try to reach an accommodation over such charges; "but we're not sure really what the effect there will be yet," he says.

Wellington’s metropolitan local network Citylink experienced a huge traffic increase, "as much as five times our normal flow on some links" says technician Simon Blake. "But the network is built to handle that, so we didn't have to do anything."

A number of ISPs phoned Citylink to discuss the traffic increase, but Blake declines to speak on their behalf.

CCIP "had the heads-up" about it at around 1am Sunday (New Zealand time), says Spring. At that time the worm had been travelling the net for about four hours. CCIP put alerts out to businesses later in the morning. But that was several hours later than TelstraClear's preventative measures; it first saw the problem at about 6.30pm on Saturday, Bolland says.

Since the worm installs itself in memory, simply rebooting the SQL server gets rid of it, says Spring.

This reporter was using the internet on Saturday evening and from about 5am to 8am on Sunday morning on Paradise Net and experienced no noticeable degradation in performance or major increase in traffic volume.

Join the newsletter!

Error: Please check your email address.

Tags slammer

More about ParadiseTelstraClear

Show Comments
[]