New Worm Virus Paralyzed Internet for a While

On the 25th afternoon, the country`s wire and wireless Internet infrastructure has been paralyzed for nine hours in South Korea and almost all telecommunication was stopped.

There were some cases that access to a certain internet site failed because of hacking or virus, but this is the first time internationally that Internet traffic of a whole nation has been stopped. In addition, it is special procurement season of the New Year’s Day, so it is estimated that Internet shopping malls, on-line traffic reservation service, PC rooms, on-line games were all stopped and Internet companies were severely damaged.

The service will be fully restored on the 27th morning when the computer experts will be on duty.

This disaster started at 2:10 on the 25th when Domain Name System (DNS) servers on KT telephone Hyehwa office which connects domestic and abroad Internet received enormous amount of abnormal data.

When the DNS of Hyehwa office shut down due to overload, the KT made a detour net on the DNS servers on Guro office, but they also shut down due to overload so Internet connection was nearly stopped.

The Ministry of Information and Communication announced that this was caused by a new abroad worm virus which infects using a known flaw in popular database software from Microsoft Corp. called "SQL Server 2000."

The servers infected by the worm virus called “SQL overflow” send 376 Byte packets incessantly and made even the DNS servers down. Right after the attack, KT cut off the virus inflow path and restored its internal net at 3:44 p.m. Hanaro Telecom and Thrunet also restored their internal net and connection net with other companies at 7:00 p.m. and 6:30 p.m. respectively. However, Internet suspension was continued until 11:00 p.m. due to the slowdown.

On the 25th, Internet traffic was dramatically slowed down and overwhelmed the world`s digital pipelines.

CNN reported that about 22 thousand servers were infected internationally by the rapidly spread worm virus.

In Japan and Taiwan, the attack interfered with Web browsing and e-mail delivery. In the U.S. and Canada, many customers of bank could not withdraw money from its ATM machines because of technical problems caused by the attack.

An integrated security solutions developer AhnLab. Inc. explained, “Internet service will be restored on the 27th morning when computer experts on each company take proper measures such as installing security patch.”