January 26, 2003	Sunday	Ziqa’ad 22,1423

SEOUL/LONDON, Jan 25: A rapidly spreading computer worm on Saturday infested networks and bogged down Internet traffic across the globe, crippling online services in one of the world’s most wired countries, South Korea.

Called “Sapphire” or “SQL Slammer,” the worm carries a self-regenerating mechanism that enables it to multiply quickly across the Internet, said Mikko Hypponen, manager of anti-virus research at F-Secure, the Helsinki-based computer security firm.

“It is so good at replicating that it generates massive amounts of traffic that will slow down networks,” Hypponen said. “The end-user never sees it. They only experience the slowdown on the Net.”

Security experts blamed the worm for crashing almost all Internet services in South Korea.

It was the first time South Korea’s broadband and mobile Internet services have been shut down on such a scale, although hackers are fairly active in the country where 70 per cent of households have Internet access.

“It is highly likely hackers have launched an allout attack on the country’s Internet system,” Yonhap news agency quoted an official of the Ministry of Information and Communication as saying.

CODE RED SIMILARITIES: The problem was not limited to South Korea, with systems slowing from Japan to Europe to the United States, officials said.

The worm has been likened to the “Code Red” bug of July 2001, an infestation that slowed traffic dramatically on the Internet. The authors of that malicious code remain a mystery.

The worm infects computer servers that run on Microsoft Windows 2000 SQL software. Once it attaches to a server it transmits multiple data requests in a random manner to other IP addresses on the Internet looking for more vulnerable servers to infect.

The effect is a flood of traffic that bogs down ISP networks and can even knock Web sites off-line, Hypponen said. He added the worm was probably installed on a faulty server by a virus writer or hacker within the past few days.

Left unchecked, Hypponen warned that the worm could continue to create large network disruptions for ISP customers, plus knock out some Websites over the coming days.

Hypponen said it had disabled the email server of a corporate client in Slovenia.

Meanwhile, ISP customers in the United States and Britain lodged distress notes on Internet message boards on Saturday complaining about slowdowns in Internet traffic.

TARGET: The biggest impact appeared to be in South Korea, however, where police were called in to investigate the matter.

The infestation impacted the country’s largest ISP, KT Corp, bringing down its entire Internet service, said a company spokesman.

He said services were down for several hours in the afternoon but were now recovering. However, the networks of number two operator Hanaro Telecom Inc and number three Thrunet Co were still experiencing trouble.

The crash was triggered by a huge volume of transmissions flowing into KT’s Hyehwa service in Seoul, officials said. All of South Korea’s major high-speed Internet services use the KT server, so all suffered the same interruption of service.—Reuters