Internet attack strikes computers


by Ryan Olson - The Guardian (U. California-S.D.)

(U-WIRE) LA JOLLA, Calif. - Thousands of computers nationwide crashed after an Internet-based attack on Monday.

The attack affected computers running the Microsoft Windows 95 operating system and Windows NT - a popular operating system among larger computer networks.

Problems were reported at all University of California campuses and the Lawrence Livermore National Laboratory. Other affected sites included the Massachusetts Institute of Technology, Northwestern University and several federal government sites - including some unclassified Navy computers.

The San Diego Union-Tribune reported experts saying that only a deliberate act could have caused the far-flung glitches. It is not known whether the attack was intended to be a prank or a serious effort to compromise sensitive data.

The attack was considered harmless by experts because users affected could restart their computers without a loss of data.

James Madden, manager of Network Operations at UCSD's Academic Computing Services (ACS), said about 300 people on campus directly reported their computers crashing. Overall, Madden estimated that the attack struck about 1,000 computers on campus between 7 p.m. and 11 p.m. on Monday.

"The cause of the problem is a badly formatted piece of data, a TCP/IP packet, that is sent to the machine," Madden said. "Because it is misconstructed, the machine's operating system, Windows for example, goes into a loop. Finally, the machine runs out of memory and crashes with the so-called blue screen."

Madden added that UCSD's main computer servers that provide Internet and e-mail access were not affected, but computers in several ACS laboratories needed to be restarted.

Late Monday, ACS operators installed a filter that would detect and remove corrupted TCP/IP packets from incoming Internet data.

Microsoft released a patch in January that fixed the problem, but did not actively promote the installation of the upgrade until Monday's incident.

Madden said that since Monday, more than half the campus that would be susceptible to a similar attack had installed the upgrade.

Despite the best precautions, the chance still remains that another attack could happen.

"One of the challenges of trying to manage an academic network, like the one at UCSD, is that we want people to have access to stuff that they are interested in," Madden said. "But along with providing that access comes the possibility that someone will run across something that will break their machine."

Madden said that the best way that users can prevent falling victim to a similar incident in the future is to install the most current versions of software and to backup data.



| TOC |