A worm that attacks computers running Microsoft's SQL Server software has co-opted more than 6,600 servers, but its insistent attempts to spread have made it easy to identify and exterminate, experts said Wednesday. Known as DoubleTap, SQLSnake and Spida.A.Worm, depending on the security organization one talks with, the infectious program is not expected to claim many more servers, said Johannes Ullrich, chief technology officer for the System Administration Networking and Security (SANS) Institute's Internet Storm Center. "The worm probably won't reach (the same number of infections) that it got up to yesterday," Ullrich said. "But you will see the probes for quite a while." Hampered by several drawbacks--only very insecure servers can be compromised, for example, and the worm's numerous scans are easy to detect--the SQL bug has not reached anywhere near the level of the Code Red worm, which claimed more than 364,000 servers last summer.
|