SQL Slammer worm infects campus computers

By Gus Bode

University Housing loses Internet access during weekend

SIUC was hit by the SQL Slammer Server computer worm Saturday.

Wesley Will, network specialist for Information Technology, said the worm, also known as Sapphire, originated in Eastern Europe last week and has been infecting the world ever since, not excluding SIUC.

Advertisement

Will said the worm exploits vulnerabilities in Microsoft SQL 2000 servers and spreads by scanning the Internet for susceptible systems.

“It tries to find other machines that are vulnerable to this, and does it at such a rate that only one machine having this on campus is enough flooded traffic to shut the whole campus down,” Will said.

Will said the campus had 14 machines infected with the worm, saturating the network. The entire campus server connection was shut down Saturday and part of Sunday until the machines the worm were detected. He said it’s like trying to communicate a whisper in a room full of people screaming – impossible to be heard.

“We shot off the dormitory authentication system, Rez-net, to stop the [worm] from spreading,” Will said.

He said the campus had to wait for Cisco Inc. to make and provide the parts to fix the problem, and expects machines to be running today. Cisco makes a large percentage of the equipment that runs the Internet and created Rez-net.

“Nobody’s going home really in network engineering until this is fixed,” Will said. “They’ve been here all weekend.”

Charles Campbell, associate director for Information Technology, said network engineering had more than 20 hours of overtime during the weekend.

Advertisement*

Will said the department is understaffed because of the hiring freeze in the state of Illinois. Attempts to notify student resident assistants of the worm were successful in alleviating stress to customer service staff so more attention could be given to the situation.

Morris Library has its own section of the network and was able to get back online because is doesn’t use Microsoft servers. This brought an increased number of students to use the Internet at the library. Campbell said students can also access the Internet in the various public-school laboratories.

He said this will not be the last problem for Rez-net users.

“I encourage them to be patient, but once we get everything back up and running we still have the overall problem of bandwidth saturation primarily from the residence halls,” Campbell said. “A lot of this is attributed to the students running the peer to peer applications, such as Kazaa that are downloading music and music videos.”

Fixing the virus will not fix the bandwidth congestion problems that students experience, which is not related to the worm. Campbell said the virus added to this problem.

Major companies using servers have also lost access to the Internet.

“This is going to be a major economic smack in the head,” Will said. “Some websites that are now shut down lose thousands of dollars per minute every minute they are down.”

Reporter Carrie Roderick can be reached at [email protected]

Advertisement