Yesterday vnunet.com warned of an increase in attacks on the port used by Microsoft's SQL server. Experts now suspect that a worm may be to blame for the rapidly increasing traffic on this port.
Late yesterday, security experts released details of a worm infecting internet-facing SQL servers in the wild.
Over the last 48 hours the SQLsnake, as it is known, has gone from accounting for 49 per cent of all internet attacks to 66 per cent of malicious traffic.
Today, 1433 is the most common port being probed on the internet and reports going up on security mailing list Bugtraq have noted people "getting slammed with requests trying to exploit this."
Because the SQLsnake exploits servers with a blank administrator password, Marc Fossi, of the SecurityFocus website, warned: "If any of you have MS SQL servers with blank SA account passwords, you might have a long day ahead of you."
Statistics from the Sans Institute show that over 1,500 boxes appear to have been infected, with the main offenders in North America, Europe and Korea.
The biggest culprit, which appears to be an IP address registered to an Earthlink DSL connection at a hotel in Atlanta, has already sent out around 152,000 attacks.
Once it has infected a host, the main aim of SQLsnake is to email a list of captured passwords and configuration information to a free email account in Singapore.
Because the worm is multithreaded it can scan with up to 100 threads. But it also contains some sort of counter which may be used to trigger some other functionality of the worm in the future.
So far there appears to be no evidence of the worm abating. Experts are still trying to determine the motive behind the attacks.
Using photocatalysts to convert carbon dioxide into usable energy such as methane or ethane
Trained on curated data from Moorfields Eye Hospital, the neural network also shows clinicians how it reached its judgement
Yokohama National University demonstrate technology that could lead to a fault-tolerant universal quantum computer
Top-of-the-range Threadripper 2990WX now available from Scan, Ebuyer, Overclockers, Novatech and Amazon