sql slammer is a 2003 computer worm that caused a denial of service on some internet hosts and dramatically slowed down general internet traffic .

it spread rapidly , infecting most of its 75,000 victims within ten minutes .

the program exploited a buffer overflow bug in microsoft 's sql server and desktop engine database products .

although the ms02-039 patch had been released six months earlier , many organizations had not yet applied it .

sql slammer

the worm exploits known vulnerabilities in microsoft sql 2000 servers . sql slammer spreads by scanning the internet for vulnerable systems .
removal vendors mcafee , symantec , and trend micro have removal tools available for systems infected with sql slammer .
worm : w32 / slammer sparked off a major epidemic in january , 2003 . slammer exploited a buffer overflow vulnerability in microsoft sql server 2000 in order to propagate .
researchers spotted the infamous sql slammer worm used recently to attack servers that have not been patched for . . .
the day was the 25th of january , 2003 , and sql slammer had just been released . slammer was the fasted spreading internet worm ever and it took advantage of a buffer overflow vulnerability in microsoft sql server 2000 to replicate .
researchers from the check point threat intelligence team said they saw a spike in sql slammer worm activity late last year .
the virus thrived on sql servers but also worked on msde ( now sql express ) , microsoft’s sql desktop engine , that was part of many end - user products .
the slammer worm uses sql server resolution service buffer overflow flaw , discovered by ngssoftware , and patched by ms last july .
how it works sql slammer exploits the way in which ms sql servers process input on sql server resolution service port 1434 . a specially crafted packet of only 376 bytes sent over the internet can remotely compromise a vulnerable server . the sql worm itself is file - less and resides only in memory , much as code red . it does not create or delete files but actively scans for other vulnerable ms sql servers . the aggressive scanning done by sql slammer overloaded many networks on january 25 , 2003 , slowing internet traffic .
sql slammer spreads by scanning the internet for vulnerable systems , and it is this scanning activity that has degraded service across the entire internet .
slammer exploits a buffer overflow vulnerability in microsoft sql server 2000 ( ms02 - 039 ) . when the sql server receives the malicious request the overrun in the server ' s buffer allows the worm code to be executed .
while sql slammer was not the first worm to exist , and certainly not the last , its unique exploits have helped it achieve information security infamy .
slammer attack traffic came from ip addresses in china , vietnam , and mexico .
the sql slammer worm returned to take down systems that have been left unpatched for the past 14 years , but experts are unsure if the attacks will continue .
more than a decade later , slammer is hitting again ,
researchers say .
only machines running microsoft sql server 2000 are infected by this worm . however , the sql server is embedded inside msde 2000 - microsoft data engine 2000 .
also known as : sql slammer worm [ iss ] , ddos . sqlp1434 . a [ trend ] , w32 / sqlslammer [ mcafee ] , slammer [ f - secure ] , sapphire [ eeye ] , w32 / sqlslam - a [ sophos ]
sure , the internet was up and running , but the environment had changed ( for the better ) . sql slammer , while fairly easily to resolve , revealed gaps .
within a few hours of being released in the winter of 2003 , sql slammer had brought the internet to something of a standstill . we look back at this notable worm .
those viruses caused massive trouble for longer than slammer . but slammer , like roy batty in the film blade runner , was the light that burned twice as bright for half as long .
sends itself to the sql server resolution service , which listens on udp port 1434 .
ten years ago to the day , we published an faq about a computer worm called slammer .
on jan . 25 , 2003 , a new worm took the internet by storm , infecting thousands of servers running microsoft’s sql server software every minute . the worm , which became known as sql slammer , eventually became the fastest - spreading worm ever and helped change the way microsoft approached security and reshaped the way many researchers handled advisories and exploit code . this is the inside story of sql slammer , told by the researcher who found the bug and wrote the exploit code that was later taken by slammer’s authors and used as part of the worm .
this new batch of slammer - wielders must be optimists , given that the worm targeted a now - ancient sql server 2000 buffer overflow vulnerability that dbas have had 13 years to fix .
as was subsequently revealed , sql slammer , which was only 376 bytes worth of code ( akin to a short paragraph of text ) – would eventually spread courtesy of this buffer overflow .
as i write this in 2010 , slammer is still out there , nearly eight years after release , still doing the rounds , so to speak . this is at worst an annoyance as , fortunately , slammer had no destructive payload but it does suggest that there are still unpatched sql and msde installs out there . this is incredible to me but unpatched systems are definitely few and far between . one positive aspect of slammer was the effect it had on patching – prior to slammer i’d guesstimate , from the results of penetration tests and so on , that 9 out of 10 sql servers were unpatched . immediately after slammer this reversed leaving 1out of 10 unpatched . patching was 100 % effective in preventing reinfection and so , in its own ironic way , slammer helped make the internet that little bit more secure .
sql slammer targets systems running ms sql server 2000 and / or systems running microsoft desktop engine ( msde ) 2000 , which is included in visual studio . net , urltoken web matrix tool , office xp developer edition , msdn universal and enterprise , microsoft access , and microsoft application center 2000 .
the sql slammer worm , first seen in the wild in january 2003 , exploits a buffer - overflow vulnerability in microsoft sql server 2000 or msde 2000 . the worm infects the server via user datagram protocol port 1434 and carries out distributed denial - of - service attacks on target ip addresses .
one of the world ' s most famous net menaces , sql slammer , has resumed attacking servers some 13 years after it set records by infecting 75 , 000 servers in 10 minutes , researchers say .
the worm uses udp port 1434 to exploit a buffer overflow in ms sql server . close down this port on your firewall unless you really need to have your sql servers visible to the world .
fantastic story , very interesting reading . afaik , microsofts bounty for the coder of slammer still stands ? : )
now , more than a decade later , slammer is hitting again . during a routine analysis of global data collected by check point threatcloud , we detected a massive increase in the number of attack attempts between november 28 and december 4 , 2016 , making the sql slammer worm one of the top malware detected in this timeframe :
great read ! i ' ve been interested in sql slammer for years and have read 100s of articles on it ; but a first hand look at your methodology and experience with it was refreshing . thanks again .
the culprit was the sql slammer virus , also known as sapphire . by some estimates , the virus caused more than $ 1 billion in damages before patches and antivirus software caught up to the problem [ source : lemos ] . the progress of slammer ' s attack is well documented . only a few minutes after infecting its first internet server , the slammer virus was doubling its number of victims every few seconds . fifteen minutes after its first attack , the slammer virus infected nearly half of the servers that act as the pillars of the internet [ source : boutin ] .
prevention the worm can be removed by rebooting an infected system , however that solution does not guard against infection again at a later time . the underlying server resolution service buffer overrun flaw exploited by sql slammer was first reported in june 2002 and patched in ms02 - 039 . additional information is available in the sql elevation of privilege patch ms02 - 061 . systems already patched by installing sql 2000 service pack 3 are not affected . until a patch can be installed , system administrators may block the following sql server ports at their firewall / gateway :
re : ms sql worm is destroying internet block port 1434 ! dick st . peters ( jan 25 )
why could outsiders connect directly to my sql servers from outside ? ( ask yourself . why indeed ? )
as it happens , slammer came one year and 10 days after bill gate’s trustworthy computing memo so it would seem that microsoft were already on the right path and they’d have gotten to this state of affairs without the wee nudge from slammer .
lamar bailey , senior director of security research and development at tripwire inc . , based in portland , ore . , said there is no hope for unpatched systems to be patched , given that microsoft released a patch to protect against the sql slammer worm in july 2002 and microsoft sql server 2000 hit its end of life in 2013 .
the potential for what would become the sql slammer worm was originally discovered by the security expert david litchfield . in 2002 , the ‘”bug hunter” ethically developed two methods to bypass the prevention mechanisms built into a version of microsoft sql server . he uncovered a flaw and reported it to microsoft , whom he assisted with in finding a fix .
[ img _ assist | nid = 7144 | title = | desc = | link = none | align = left | width = 100 | height = 100 ] by david litchfieldon jan . 25 , 2003 , a new worm took the internet by storm , infecting thousands of servers running microsoft’s sql server software every minute . the worm , which became known as sql slammer , eventually became the fastest - spreading worm ever and helped change the way microsoft approached security and reshaped the way many researchers handled advisories and exploit code . this is the inside story of sql slammer , told by the researcher who found the bug and wrote the exploit code that was later taken by slammer’s authors and used as part of the worm .
the slammer virus hit south korea hard , cutting it off from the internet and leaving internet cafes like this one relatively empty .
the sql slammer worm ( w2 . sqlslammer . worm ) , also known as sapphire ( f - secure ) , w32 . sqlexp . worm ( symantec ) , and helkern ( kaspersky ) , exploits known vulnerabilities in microsoft sql 2000 servers . it has little impact on home or desktop pcs , and it does not infect linux , mac , or unix systems .
on saturday 25 th january 2003 , the internet was hit by a rapacious computer worm now known as sql slammer . spreading like wildfire over the internet via a bug in a version of microsoft sql , it is believed to have infected over 75 , 000 machines within a matter of minutes . globally , over 250 , 000 computers were thought to have been affected .
w32 . sqlexp . worm is a worm that targets the systems running microsoft sql server 2000 , as well as microsoft desktop engine ( msde ) 2000 . the worm sends 376 bytes to udp port 1434 , the sql server resolution service port .
the following month , ngssoftware published a white paper on auditing sql server which contained an explanation of its proof of concept code .
another positive effect slammer had was the sea change it helped cause at microsoft as far as security was concerned . as i hear it , all development of yukon ( sql server 2005 ) was put on hold and everyone on the sql team went back to sql server 2000 and pored through the code looking for flaws . and then they did the same for extant yukon code . doing this paid back massive dividends for microsoft . the first major flaw to be found in sql server 2005 came over 3 years after its release – a heap overflow found by brett moore , triggered by opening a corrupted backup file with the restore tsql command . so far sql server 2008 has had zero issues . not bad at all for a company long considered the whipping boy of the security world .
the worm ( also called slammer ) began to infect hosts slightly before 05 : 30 utc on saturday , january 25 . sapphire exploited a buffer overflow vulnerability in computers on the internet running microsoft ' s sql server or msde 2000 ( microsoft sql server desktop engine ) . this weakness in an underlying indexing service was discovered in july 2002 ; microsoft released a patch for the vulnerability before it was announced [
also , as lysa myers , a security researcher at eset , remembers , because sql slammer was file - less and existed only in memory – “a fairly novel technique at the time” – it did not write itself directly onto a disk . it could therefore be removed easily .
discovered : january 24 , 2003 updated : february 13 , 2007 11 : 42 : 35 am also known as : sql slammer worm [ iss ] , ddos . sqlp1434 . a [ trend ] , w32 / sqlslammer [ mcafee ] , slammer [ f - secure ] , sapphire [ eeye ] , w32 / sqlslam - a [ sophos ] type : worm systems affected : windows cve references : can - 2002 - 0649
the fix for slammer was relatively simple ; systems could be rebooted , and , if the patch had been installed , the problem was immediately fixed .
in addition , there are lot of other applications that might silently install microsoft sql server or msde 2000 . examples of such software are :
the uk security expert who discovered the flaw which was exploited by the slammer worm has concluded it does more good than harm to publish proof of concept code .
multiple buffer overflows in the resolution service for microsoft sql server 2000 and microsoft desktop engine 2000 ( msde ) allow remote attackers to cause a denial of service or execute arbitrary code via udp packets to port 1434 in which ( 1 ) a 0x04 byte that causes the sql monitor thread to generate a long registry key name , or ( 2 ) a 0x08 byte with a long string causes heap corruption , as exploited by the slammer / sapphire worm .
it appears that slammer didn ' t seem to call any attention to itself by showing you links in an e - mail , or requiring you to download an attachment . it just quietly sniffed out and exploited a vulnerability in your system . in that case , i believe we are still vulnerable to infections similar to slammer .
the worm exploits a buffer overflow vulnerability in microsoft sql server 2000 or msde 2000 by sending a formatted request to udp port 1434 . after the server is infected , it attempts to spread rapidly by sending the same payload to random ip addresses , causing a denial of service condition on its targets . this vulnerability was discovered by david litchfield several months before slammer first launched . accordingly , microsoft released a patch , but many installations had not been patched before slammer’s first appearance .
sql slammer is a computer worm that first appeared in the wild in january 2003 , and caused a denial of service condition on tens of thousands of servers around the world . it did so by overloading internet objects such as servers and routers with a massive number of network packets within 10 minutes of its first emergence .
in its first run in 2003 , the sql slammer worm was a major threat and set a record by infecting 10 , 000 servers and overloading 75 , 000 networks in just 10 minutes . so far , check point has only seen the one surge in usage , so the company cannot say whether the attacks will continue .
in a posting to bugtraq , david litchfield of ngssoftware expressed concerns that his proof of concept code was used as a template by unknown vandals in creating the destructive slammer worm .
the worm does not write itself to the disk . it exists only as network packets and in running processes on the infected computers . in this respect slammer is similar to codered .
back in 2003 , lots of users wouldn’t have patched their pcs against this sql vulnerability even if they’d seen the alert from microsoft . ms02 - 039 was headlined :
multiple buffer overflows in sql server 2000 resolution service allow remote attackers to cause a denial of service or execute arbitrary code via udp packets to port 1434 in which ( 1 ) a 0x04 byte causes the sql monitor thread to generate a long registry key name , or ( 2 ) a 0x08 byte with a long string causes heap corruption .
researcher michael bacarella first raised the alarm to slammer which was created on the back of public proof - of - concept exploit code published during black hat by now google security boffin david litchfield .
the in - memory worm exploits an ancient flaw in microsoft sql server and desktop engine triggering denial of service , and at the time of its emergence significantly choking internet traffic .
many victim computers were corporate sql servers , so the worm quickly acquired a lot of cpu power and network connectivity to help it acquire a lot more cpu and network energy .
the rapid spread produced so much network traffic , and bogged so many sql servers down , that it was self - limiting . badly - affected systems simply couldn’t be ignored .
there are still unpatched sql server systems in the wild . so , as long as they are running , there will be more targets for this worm . it can propagate and scan subnets quite fast , so it does not take long to [ infect ] new targets ,
bailey told searchsecurity .
these targets may not be traditional servers , either , because sql server is embedded in various other devices . when the worm first came out , we saw it launching from vending machines that had sql server embedded to track inventory .
if you don ' t trust the systray icon , an easy way to find out if you are running the sql server is to locally check if your udp port 1434 is open . to do this , click start / run and type
netstat - p udp - a 100
. then investigate if the output contains line like
udp yourcomputername : ms - sql - m
. if it does , you might be running ms sql 2000 and you should apply relevant patches . to exit this display , hit ctrl - c .
litchfield thinks the information only helped save time in writing the code . the virus authors were skilled and were quite capable of writing slammer even without ngssoftware ' s work to build on , he reckons .
the chaos which unfolded last weekend after the release of the slammer worm has re - ignited the debate on full disclosure of security vulnerabilities . it has also prompted litchfield into a bout of soul - searching .
using network monitor i captured the traffic and noticed that all it did was simply send a single byte packet with a value of 0x02 to udp port 1434 on the sql server . well , the obvious question was what happens if we send a single byte with a value of 0x01 – or 0x00 for that matter and all the other values up to 0xff ( 255 ) ? i quickly wrote a short c program to investigate this . once compiled , i fired it off against my sql server and by packet 0x08 the sql server had died . now that really grabbed my attention .
i ' m pretty sure you ' ll find that the amount of traffic generated by slammer from an infected server was orders of magnitude higher than the
chattiness
you claim for today ' s anti - virus .
at its height , sql slammer , which was the most widespread worm since 2001’s code red worm , doubled in size every 8 . 5 seconds . south korea , one of the most connected countries in the world at the time , had an outage of internet and cell phone coverage for 27 million people , while in the us , almost all of bank of america’s 13 , 000 atms were temporarily knocked offline .
takes advantage of a buffer overflow vulnerability that allows a portion of system memory to be overwritten . when the worm does this , it runs in the same security context as the sql server service .
but rather than simply stopping there and writing an exploit i went back and re - examined the code and found a number of other flaws . for example , if you send 0x0a as the first byte to a sql server’s udp port 1434 it’ll respond with 0x0a to your source port . thus , by spoofing the ip address of one sql server and setting the source port to 1434 and firing off an 0x0a to another sql server they’ll start hammering each other with 0x0as in a storm of “pings” . another bug , and this is the key one as far as slammer is concerned , happens when the first byte is 0x04 . anything after the 0x04 is sent to the sprintf ( ) function in the process of building a registry key to open . the sprintf ( ) function takes input and formats it as output into a destination buffer . in the case of sql server this is a fixed sized buffer on the stack and this lead to a classic stack based buffer overflow – one which was trivial to exploit .
as much as i hate these sorts of attacks , the shame here is really on any dba that still has a sql server 2000 running , much less didn ' t apply the patch at some point . when running end of life software you must make sure you are as update as possible when you role the dice . with sql server that means all sp ' s as well as hotfixes .
w32 / sqlslam - a is a network worm which spreads entirely in memory . the worm infects the process space of microsoft sql server 2000 by exploiting what is known as a buffer overflow . this allows w32 / sqlslam - a to begin running as part of your sql server . once running , the worm tries to send itself from your server to as many other internet sites as it can , until you stop it by shutting down your sql server process . ( the worm actually goes into what is known as an
infinite loop
, so it will never stop spreading of its own accord . )
quote :
the rapid spread produced so much network traffic , and bogged so many sql servers down , that it was self - limiting . badly - affected systems simply couldn ' t be ignored .
they never did catch the person who wrote slammer but i do have an interesting theory on this . a couple of years after slammer was released i was asked by microsoft whether , in my opinion , it had been written to be as small as possible and so i took a deeper look at the code . i concluded it had not . for example , part of the code set the ecx register to the value 0x9b040103 and it does so using the following instructions :
i & apos ; m getting massive packet loss to various points on the globe . i am seeing a lot of these in my tcpdump output on each host . 02 : 06 : 31 . 017088 150 . 140 . 142 . 17 . 3047 > 24 . 193 . 37 . 212 . ms - sql - m : udp 376 02 : 06 : 31 . 017244 24 . 193 . 37 . 212 > 150 . 140 . 142 . 17 : icmp : 24 . 193 . 37 . 212 udp port ms - sql - m unreachable [ tos 0xc0 it looks like there & apos ; s a worm affecting ms sql server which is pingflooding addresses at some random sequence . all admins with access to routers should block port 1434 ( ms - sql - m ) ! everyone running ms sql server shut it the hell down or make sure it can & apos ; t access the internet proper ! i make no guarantees that this information is correct , test it out for yourself ! - - michael bacarella 24 / 7 phone : 646 641 - 8662 netgraft corporation
we can see that the method that slammer uses is 3 bytes longer than it needs to be but that’s not what’s interesting . what is interesting is that half of the slammer code uses the xor method to set register values whereas the rest of the code uses the mov method . coders generally have styles they stick to and , in the same way that radio operators during the second world war could be recognized by their distinctive style , or fist , a coder could be recognized by their style and they would tend not to switch between using xor and mov ; and what’s interesting about slammer is that there are at least two styles at play here suggesting that there is more than one author . but that’s just a theory .
the worm uses a socket to send itself to to the vulnerable computers . the socket in connected to the udp port 1434 on the remote machine . if the computer has microsoft sql server 2000 it runs on that port .
today ' s antivirus software ( not just sophos ; i ' m most familiar with a competitor ) bogs a system down so much and is so chatty that users wouldn ' t be able to detect a rogue process like slammer was even running .
coding an exploit up i sent a copy of it to the microsoft security response center ( secure @ microsoft . com ) with a short write up of my findings then proceeded to own all of our client’s sql servers . job done .
as the worm does not infect any files , an infected machine can be cleaned by simply rebooting the machine . however , it will soon get reinfected if the machine is connected to the network without applying relevant patches for ms sql server .
worm : w32 / slammer was first detected on the internet on 25th of january 2003 at 05 : 30 gmt . after that it was detected in most countries around the world . however , there are unconfirmed reports of the worm traces being spotted already on january 20th .
are you unsure if your machine is running ms sql server 2000 or msde 2000 ? these programs install an icon to system tray . an icon which looks like a computer with a white circle and a green ' play ' button on it :
slammer uses gettickcount ( ) function from the win32 api to initialize it ' s random number generator . it uses the random numbers as ip addresses to search for vulnerable hosts . the worm does not try ip addresses sequentally - it gets a new random address for every infection attempt .
during a routine analysis of global data collected by check point threatcloud , we detected a massive increase in the number of attack attempts between nov . 28 , and dec . 4 , 2016 , making the sql slammer worm one of the top malware detected in this time frame ,
check point wrote in a blog post .
the attack attempts detected by check point were directed to a large variety of destination countries ( 172 countries in total ) , with 26 % of the attacks being toward networks in the united states .
caida ' s paper from the same period noted a similar result , measuring a outgoing rate of 26 , 000 connection attempts per second from a single infected server ( slammer ' s udp infection loop ) with 100mbit / sec . the limiting factor was the network , not the cpu :
this worm does not infect typical end user machines at all : it only infects computers running microsoft sql server 2000 or msde 2000 . end users might only notice this worm because of network slugginess . this worm is not a massmailer : it does not send any emails .
a patch issued by microsoft last summer removes the buffer overflow vulnerability in sql 2000 servers . the large number of unpatched systems , however , accounted for the worm ' s rapid spread across the internet beginning at 12 : 30 a . m . , january 25 , 2003 .
as business users resumed to work on monday morning , turning on computers with ms sql server 2000 and msde 2000 , we monitored a second major peak in network load especially on nameservers . this timed with the business starting hours in europe . a third , smaller peaks be seen later when business day started in usa .
there are still unpatched sql server systems in the wild . so , as long as they are running , there will be more targets for this worm . it can propagate and scan subnets quite fast , so it does not take long to [ infect ] new targets . lamar bailey enior director of security research and development at tripwire
i restarted the server and this time started debugging it . on byte 0x08 the sql server crashed again and i disassembled the code to work out what was going on . in this particular case a call to the strtok ( ) c function was made looking for a colon character in the user supplied data but , there being none , the function returned null . the fault in the code was not checking the return value of strtok ( ) which , all going well , returns a pointer to the “token” being searched for . the code in sql server assumed a valid pointer was returned and the next line of code attempted to use this null pointer which caused the crash .
of course , the story of slammer started much earlier than that . for me it began on the 22nd of may 2002 . myself , my brother mark and fellow co - founders of ngssoftware chris anley and sherief hammad were on an client engagement for a bank in frankfurt , germany . the guy who’d hired us , we’ll call him mr m . , wanted us to unleash bloody hell on his sql servers . they were locked down extremely capably and it would require something new to penetrate them so that was my task . having heard of a tool called sqlping , written by chip andrews , i wanted to know what it did so i downloaded it and fired it off against one of the targets in my mini - lab .
not long after , a patch was developed , meaning that when he later spoke at a black hat conference , he was not only able to warn people of the defect , but also highlight that a patch was now available . he said that those who did not fix the buffer overflow vulnerability – in microsoft’s sql server 2000 – would be at risk of being infected .
as part of the presentation i demoed my proof of concept code showing how easy it was to exploit the flaw . whoever wrote slammer used my code as a template and , at the time , this really gave me pause for concern . slammer took down parts of the internet because it spread so quickly , indirectly causing a denial of service attack and , in certain parts of the world , this wreaked havoc with essential services . for example , in washington state , the 911 emergency services system went down . whilst they reverted to good old paper and pen , this could’ve caused real problems for real people and it was a bit of a wake up call for me at the time . for me , what had been a fun , intellectual pursuit suddenly had real consequences and i had to carefully consider how i would go forward when publishing details of any more security flaws i found .
the slammer virus taught a valuable lesson : it ' s not enough to make sure you have the latest patches and antivirus software . hackers will always look for a way to exploit any weakness , particularly if the vulnerability isn ' t widely known . while it ' s still important to try and head off viruses before they hit you , it ' s also important to have a worst - case - scenario plan to fall back on should disaster strike .
sometimes the random generator returns numbers that are broadcast addresses ( eg . : x . y . z . 0 or x . y . z . 255 ) causing all the hosts on the particular network to receive the malicious packet . in many scenarios , this could infect several sql servers in the subnet at the same time . this makes the spreading routine even more aggressive . at the very least hitting broadcast addresses multiplies the network load generated by the worm .
] , sapphire represents the first such worm released into the wild . microsoft ' s sql server vulnerability was particularly well suited for constructing a fast worm ( since the exploit could be contained in a single udp packet ) . however , techniques exist such that any worm with a reasonably small payload can be crafted into a bandwidth - limited worm of a similar nature . thus , the extreme speed should not be viewed as an aberration due to the nature of the exploit or the particular protocol used ( udp vs tcp ) .
so , next i adjusted my little c program to send 0x083a – byte 0x08 followed by a colon . the server still crashed this time in the atoi ( ) function . atoi ( ) take a string number and converts into a proper number and by not providing one in my send string server crashed again . i was beginning to see what was going on here – sql server was looking for a hostname followed by a port number separated by a colon . so i gave it exactly that – but with an overly long host name and – bang – an exploitable heap overflow occurred .
in contrast , sapphire ' s scanner was limited by each compromised machine ' s bandwidth to the internet . since the sql server vulnerability was exploitable using a single packet to udp port 1434 , the worm was able to send these scans without requiring a response from the potential victim . the inner loop is very small , and since modern servers have sufficient network i / o capacity to transmit network data at 100mbps + , sapphire was frequently limited by the access bandwidth to the internet rather than its own ability to generate new copies of itself . in principle , an infected machine with a 100 mb / s connection to the internet could produce over 30 , 000 scans / second . in practice , due to bandwidth limitations and the per - packet overhead , the largest probe rate we directly observed was 26 , 000 scans / second , with an internet - wide average of approximately 4 , 000 scans / second per worm during the early phase of growth .
an $ 18m supercomputer to simulate brains of mice in the land of swiss cheese . how apt , hpe
hardware rumours , goat - spanking search engines and plenty of azure . it ' s last week in redmond
microsoft might not support windows xp any more , but gandcrab v4 . 1 ransomware does
cops suspect detroit fuel station was hacked before 10 drivers made off with 2 . 3k ' free ' litres
git365 . git for teams . quatermass and the git pit . github simply won ' t do now microsoft has it
imagine a patent on organizing computer files being used against online shopping sites . oh , it ' s still happening
ai bots suck at marking written essays , not too shabby at old atari games , and more . . .
in august last year , litchfield made a presentation on the issue at the black hat conference in las vegas that featured a demonstration of proof of concept code . at the time , litchfield warned of the ddos potential of the flaw and urged admins to patch their systems .
whoever authored the worm knew how to write buffer overflow exploits and would have been capable of doing this without using my shellcode as a template ,
litchfield writes .
having access to my code probably saved them around 20 or so minutes - but they still would have been able to do it without mine
.
but he still concludes that the publication of proof of concept code has a beneficial role to play in internet security .
so ngssoftware will continue to provide full disclosure on the security issues it unearths , he told us .
after careful consideration i ' ve decided that the publication of proof of concept code does have an important and beneficial role to play in internet security .
this decision was not made lightly and has been influenced by conversations with my colleagues at ngssoftware , friends and peers in the industry and the many mails i received in response to my original mail to the securityfocus bugtraq list .
as far as those responses go not a single one suggested that i , or ngssoftware , cease to provide proof of concept code for the vulnerabilities we find and most gave salient reasons as to why we should continue to do so .
this message is to explain why ngssoftware will continue with full disclosure of issues .
the threats and risks internet connected systems are exposed to are well known . connect an unpatched system to the internet and it will be compromised by a worm or hacker within minutes .
there are people out there with high levels of intelligence developing , sharing and actively using exploits against such systems . some do it for the fun of it , others as they see it as a challenge and still others who try to gain from it - whether financially or through peer recognition .
regardless of motive , there is much to be learnt from these people and their exploits . but if this was the only source of information for those working in the security industry then the
bad guys
would always be one step ahead of the
good guys
; and if they ' re one step ahead we lose and so do the organizations we ' re trying to protect .
it is imperative , therefore , that we derive and make available to everyone our own source of information . if we can find the bugs still waiting to be discovered before the
bad guys
we can then alert the vendor to the problem and get a fix out , hopefully giving people a chance to get there systems patched .
imagine ngssoftware discover a bug and choose not to alert the vendor but keep the bug secret .
who is to say whether those in the underground would ever find the bug ? the vulnerability could lie undetected for the whole shelf life of the vulnerable product .
no - one would know a thing save for ngssoftware . but then what happens if someone else did discover the problem and happily went around popping boxes on the internet , or worse , wrote and released damaging worm . in the absence of a patch there would be mayhem .
so as an industry we must err on the side of caution and alert the vendor and get them to produce a patch . but in doing this the world at large is alerted to a new bug in the product .
had ngssoftware kept the hole to itself though it could have been that noone would have ever known .
this has still not justified the publication of a full disclosure advisory , though , with in - depth details and a proper dissection of the vulnerability in question .
when a patch has been made available to the public someone who knows their way around computers will be able to compare the patched program and the vulnerable program and spot the differences within minutes - isolating the vulnerable bit of code . a couple of minutes later , and with the use of tools such as debuggers , they ' ll be able to work out exactly how the program is vulnerable and code up an exploit to take advantage of it . this can all be done without any information other than 1 ) there is a bug and 2 ) a copy of the new program and a copy of the old program .
such people , and there are thousands of them , do not need proof of concept code or advisories so even in their absence exploits , worms and virii will still be written and used .
so in the interests of
levelling the playing field
it is necessary to publish full details . with these details companies that produce intrusion detection / prevention devices can update their products more swiftly .
administrators can take steps to modify their firewalls ' rule bases to protect their network . developers of security assessment scanners can add new checks to their products so their users can scan their networks to see if they are vulnerable .
finally there is the educational value in publishing full details with proof of concept source code .
if i say to a software developer ,
don ' t code that way . it ' s dangerous .
they ' ll probably shrug it off . if i say to a developer ,
don ' t code that way . it ' s dangerous and here ' s why
and then proceed to demonstrate exactly why it ' s dangerous ( their eyes often widen ) and they take it on board . they immediately see the threat it poses . so through education developers can learn from others ' mistakes .
often cxos are blind to security issues and it is only when their network administrator proves to them the severity , with the use of proof of concept code , that they understand the impact a vulnerability can have to the business and organizations . [ 7 of the responses i received to my original posting stated that at some point in the past they ' ve use proof of concept code to get better budgets to enable them to do their job more effectively . ]
clients expect the very best from their security professionals - and to give their best security pros need to know the current state of security affairs . only through education and diligent learning can this be achieved . without the publication of proof of concept code and vulnerability details this educational gain would be lost - and this in the long run would have a negative impact upon the state of computer and internet security . ®
this paper explores plaster - the seven major ai challenges - in the context of nvidia’s dl solutions .
enterprises generally have a positive awareness and acceptance of sds : 61 % of enterprises that deployed sds realized tangible beneﬁts .
it teams have seen a clear need for a new type of all - flash storage solution , one that has been designed specifically for users requiring high levels of performance in file - and object - based environments .
the register - independent news and views for the tech community . part of situation publishing
the cloud is full of risk . your security posture shouldn ' t be .
the worm has the unintended payload of performing a denial of service attack due to the large number of packets it sends .
configure perimeter devices to block the ingress udp traffic to port 1434 from untrusted hosts .
symantec has provided a tool to remove the infections of w32 . sqlexp . worm . click
to obtain the tool . try this tool first , as it is the easiest way to remove this threat . because the worm resides in memory only and is not written to disk , the virus definitions do not detect this threat . symantec security response recommends that you follow the measures described in this document to deal with this threat .
click here for a more detailed description of rapid release and daily certified virus definitions .
calls the windows api function , gettickcount , and uses the result as a seed to randomly generate ip addresses .
opens a socket on the infected computer and attempts to repeatedly send itself to udp port 1434 on the ip addresses it has generated , by using an ephemeral source port . because the worm does not selectively attack the hosts in the local subnet , large amounts of traffic are the result .
symantec has released updates for symantec gateway security via liveupdate . additionally , you may click
to learn about limiting the ingress traffic for w32 . sqlexp . worm using symantec gateway security .
symantec has released an intruder alert 3 . 5 / 3 . 6 integration policy for netprowler 3 . 5x . click
symantec has released security update 22 for netprowler 3 . 5 . 1 , which includes a detection for w32 . sqlexp . worm . click
to learn about limiting the ingress traffic for w32 . sqlexp . worm using symantec ' s enterprise firewall , velociraptor , and raptor products .
symantec manhunt protocol anomaly detection technology detects the traffic generated by this threat as a udp flood . to specifically detect this threat as w32 . sqlexp . worm , symantec recommends that users of the symantec manhunt product activate the hybrid mode function and apply the following custom rule :
# variables need to be set dependent on the users network . below are examples on how to set
# variable . for more information see symantec manhunt administrative guide : appendix a .
alert udp $ external _ net any - > $ home _ net 1434 ( msg :
w32 . sqlexp . worm propagation
; content :
| 68 2e 64 6c 6c 68 65 6c 33 32 68 6b 65 72 6e |
; content :
| 04 |
; offset : 0 ; depth : 1 ; )
for more information on how to create custom signatures , refer to the
symantec manhunt administrative guide : appendix a custom signatures for hybrid mode .
use a firewall to block all incoming connections from the internet to services that should not be publicly available . by default , you should deny all incoming connections and only allow services you explicitly want to offer to the outside world .
enforce a password policy . complex passwords make it difficult to crack password files on compromised computers . this helps to prevent or limit damage when a computer is compromised .
ensure that programs and users of the computer use the lowest level of privileges necessary to complete a task . when prompted for a root or uac password , ensure that the program asking for administration - level access is a legitimate application .
disable autoplay to prevent the automatic launching of executable files on network and removable drives , and disconnect the drives when not required . if write access is not required , enable read - only mode if the option is available .
turn off file sharing if not needed . if file sharing is required , use acls and password protection to limit access . disable anonymous access to shared folders . grant access only to user accounts with strong passwords to folders that must be shared .
turn off and remove unnecessary services . by default , many operating systems install auxiliary services that are not critical . these services are avenues of attack . if they are removed , threats have less avenues of attack .
if a threat exploits one or more network services , disable , or block access to , those services until a patch is applied .
always keep your patch levels up - to - date , especially on computers that host public services and are accessible through the firewall , such as http , ftp , mail , and dns services .
configure your email server to block or remove email that contains file attachments that are commonly used to spread threats , such as . vbs , . bat , . exe , . pif and . scr files .
isolate compromised computers quickly to prevent threats from spreading further . perform a forensic analysis and restore the computers using trusted media .
train employees not to open attachments unless they are expecting them . also , do not execute software that is downloaded from the internet unless it has been scanned for viruses . simply visiting a compromised web site can cause infection if certain browser vulnerabilities are not patched .


only a single specimen is known , which was found near peñacerrada-urizaharra in the basque country .

microcostaphron

this is the place for microcostaphron definition . you find here microcostaphron meaning , synonyms of microcostaphron and images for microcostaphron copyright 2017 © urltoken
here you will find one or more explanations in english for the word microcostaphron . also in the bottom left of the page several parts of wikipedia pages related to the word microcostaphron and , of course , microcostaphron synonyms and on the right images related to the word microcostaphron .
how can i put and write and define microcostaphron in a sentence and how is the word microcostaphron used in a sentence and examples ? 用microcostaphron造句 , 用microcostaphron造句 , 用microcostaphron造句 , microcostaphron meaning , definition , pronunciation , synonyms and example sentences are provided by ichacha . net .
microcostaphron parvus is an extinct species of wasp which existed in spain during the early cretaceous period .
how can i put and write and define microcostaphron parvus in a sentence and how is the word microcostaphron parvus used in a sentence and examples ? 用microcostaphron parvus造句 , 用microcostaphron parvus造句 , 用microcostaphron parvus造句 , microcostaphron parvus meaning , definition , pronunciation , synonyms and example sentences are provided by ichacha . net .

' microcostaphron parvus
' is an extinct species of wasp which existed in spain during the early cretaceous period .
' microcostaphron parvus belongs to microcostaphron ' according to j . ortega - blanco et al . 2010 ' microcostaphron belongs to radiophronidae ' according to j . ortega - blanco et al . 2010 ' radiophron ibericus belongs to radiophron ' according to j . ortega - blanco et al . 2010 ' radiophron belongs to radiophronidae ' according to j . ortega - blanco et al . 2010 ' radiophronidae belongs to ceraphronoidea ' according to j . ortega - blanco et al . 2010
html public
- / / w3c / / dtd xhtml 1 . 0 strict / / en
urltoken
key words : hymenoptera , radiophronidae , ceraphronoidea , amber , albian , basque country , spain .
jaime ortega - blanco [ j . ortega . blanco @ urltoken ] and xavier delclòs [ xdelclos @ urltoken ] , dep . d’estratigrafia , paleontologia i geociències marines , facultat de geologia , universitat de barcelona , 08071 barcelona , spain ; alexander p . rasnitsyn [ rasna36 @ urltoken ] , paleontological institute , russian academy of sciences , profsoyuznaya str . 123 , 117997 , moscow , russia , and natural history museum , cromwell road sw7 5bd , london , england .
this is an open - access article distributed under the terms of the creative commons attribution license ( for details please see urltoken ) , which permits unrestricted use , distribution , and reproduction in any medium , provided the original author and source are credited .
html public
- / / w3c / / dtd html 4 . 0 transitional / / en
( a question mark next to a word above means that we couldn ' t find it , but clicking the word might provide spelling suggestions . )
not helpful ? you might try using the wildcards * and ? to find the word you ' re looking for . for example , use
encyclo . co . uk , online since 2007 , is a search engine for english meanings and definitions . the website aims to publish all wordlists , big and small , on the internet , making it much easier to find the word you need . follow us on facebook
html public
- / / w3c / / dtd xhtml 1 . 0 transitional / / en
urltoken
html public
- / / w3c / / dtd html 4 . 01 transitional / / en
urltoken
html public
- / / w3c / / dtd html 4 . 01 transitional / / en
javascript is required to use this web site . please turn it on before proceeding .
j . ortega - blanco , a . p . rasnitsyn , and x . delclos . 2010 . a new family of ceraphronoid wasps form early cretaceous álava amber .


haworth 's minor , celaena haworthii , is a moth of the noctuidae family .

it is found from the british isles and france through northern europe including scandinavia , east to the urals and across the palearctic to siberia and up to the pacific ocean .

celaena haworthii

kari pihlaviita added the finnish common name
mustaluhtayökkönen
to
celaena haworthii curtis 1829
.
haworth ' s minor ( celaena haworthii ) - norfolk moths - the macro and micro moths of norfolk .
download free celaena haworthii 9786137777107 pdf | download any of our ebooks including the world best known classics , and read with our fully featured ereader including dictionary .
html public
- / / w3c / / dtd html 4 . 01 transitional / / en
urltoken
gaden s . robinson , phillip r . ackery , ian j . kitching , george w . beccaloni and luis m . hernández
records of caterpillar hostplants are scattered through published and manuscript sources worldwide and are difficult to retrieve . many rearing records are never published and so are not accessible to other entomologists . but collected hostplant records form a valuable scientific resource that can be used eventually to answer broader biological questions about how lepidoptera and plants interact ( eg , letourneau , hagen & robinson , 2001 ) . it provides information of immediate relevance to agriculture , ecology , forestry , conservation and taxonomy .
hosts brings together an enormous body of information on what the world ' s butterfly and moth ( lepidoptera ) caterpillars eat . the web - based version presented here offers a synoptic data set drawn from about 180 , 000 records comprising taxonomically ' cleaned ' hostplant data for about 22 , 000 lepidoptera species drawn from about 1600 published and manuscript sources . it is not ( and cannot be ) exhaustive , but it is probably the best and most comprehensive compilation of hostplant data available .
we hope that it will be useful to a wide range of biologists and that it will act as a spur to further recording and analysis of caterpillar - plant interactions .
hosts can be searched in two ways , using text search and drill - down search modes .
in text search mode , use either lepidoptera or hostplant criteria or a combination of the two . hosts operates only using scientific names . it is not possible to search for the hostplants of the red admiral butterfly but a search for hostplants using its scientific name , vanessa atalanta , will be successful . enter the generic name ( vanessa ) in the - lepidoptera criteria - genus box ; enter atalanta in the species : box ; click search .
hint : leave the ' starts with ' command as the default and in the species entry box omit the last few letters of the species - name ( eg , atalant ) . this will get around the problem of variable gender - endings . hosts uses original orthography of species - group names as far as possible , but some checklists follow the convention of altering the species - group name to accord with the presumed gender of the generic name ( eg flava , flavus ) .
restrict or refine searches using additional criteria ; choosing ' usa ' from the drop - down location box and entering [ starts with ] ' urt ' in the hostplant family box will return hostplant records of vanessa atalanta from urticaceae in the usa .
hint : restricting location may deliver a very incomplete subset of records : in the previous example all records specified as from the nearctic region ( usa + canada ) would be missed .
drill - down search mode allows the user to home in from the starting - point of either the lepidoptera or the plant family . choose a family group from the drop - down box and allow time for all genera of that family in the database to load to the genus drop - down box ; choose a genus and wait for the species to load . the search button can be pressed at any time , but the record delivery limit may be exceeded at higher taxonomic levels . drill - down search allows the user to see by scrolling all the taxa that are represented in the database . following the previous example , choose nymphalidae , then choose vanessa from the genus drop - down box and then atalanta from the ten possible species of vanessa included in hosts .
the preliminary search results pages give family , genus and species of the caterpillar and its hostplant . note that many hostplants are recorded as a plant genus only . clicking the caterpillar name will give the full record . the full record listing gives , additionally , the author of the lepidoptera species , subspecific information on the insect and the plant , if available , together with details of larval damage . laboratory rearings where the food utilised may not be the natural hostplant are indicated . the status of the record ( whether considered true , erroneous or suspect ) is not currently implemented in this version of hosts .
leguminosae ( c ) - caesalpinioideae . leguminosae ( m ) - mimosoideae . leguminosae ( p ) - papilionoideae .
all lepidoptera groups are covered and subspecific taxa are differentiated . the original source of the record , original form of the names used ( prior to taxonomic ' cleaning ' and standardisation of nomenclature ) and validation and verification fields are not included . this information is , however , retained in the databases used to generate this site . while we have included species that do not feed on green plants , the known food substrates of these are not listed exhaustively . such species comprise detritophages and predators and include , for example , most tineidae and the stored - products pests . the published compilations from hosts ( see more detail - publications from hosts ) include record status and the sources of all records .
detailed published compilations from hosts are available in press . these books give greater detail than the website , together with comprehensive cross - indexes , record status and full bibliographies . they are indispensable tools for naturalists and professional entomologists .
robinson , g . s . , ackery , p . r . , kitching , i . j . , beccaloni , g . w . & hernández , l . m . 2001 . hostplants of the moth and butterfly caterpillars of the oriental region . 744 pp .
robinson , g . s . , ackery , p . r . , kitching , i . j . , beccaloni , g . w . & hernández , l . m . 2002 . hostplants of the moth and butterfly caterpillars of america north of mexico . 824 pp . [ memoirs of the american entomological institute , volume 69 . ]
beccaloni , g . w . , viloria , a . l . , hall , s . k . & robinson , g . s . 2008 . catalogue of the hostplants of the neotropical butterflies / catálogo de las plantas huésped de las mariposas neotropicales . m3m - monografías tercer milenio , volume 8 . zaragoza , spain : sociedad entomológica aragonesa ( sea ) / red iberoamericana de biogeografía y entomología sistemática ( ribes ) / ciencia y tecnología para el desarrollo ( cyted ) / natural history museum , london , u . k . ( nhm ) / instituto venezolano de investigaciones científicas , venezuela ( ivic ) . 1 - 536 pp . , 1 fig , 3 tabs .
gaden robinson was responsible for the overall project design and management of the hosts database , and for records of lepidoptera exclusive of butterflies and bombycoid moths . phillip ackery and george beccaloni were responsible for butterfly data , including data drawn from card catalogues developed by ackery , whilst ian kitching was responsible for hostplant data of bombycoid moths . luis m . hernández was responsible for abstracting in the latter two years of the project and for development of the bibliography for the hardcopy versions of the data .
we are extremely grateful to the many people who contributed their own rearing records of lepidoptera or personal accumulations of data for inclusion in the hosts database , particularly mike bigger ( uk ) , john w . brown ( usa ) , chris conlan ( usa ) , rob ferber ( usa ) , konrad fiedler ( germany ) , jeremy holloway ( uk ) , frank hsu ( usa ) , jurie intachat ( malaysia ) , alec mcclay ( canada ) , bill palmer ( australia ) , pierre plauzoles ( usa ) and the generous individuals who contributed rearing records through the worldwideweb and who are known to us only as an email address .
we are particularly grateful to julian donahue and the los angeles county museum of natural history for allowing us to include data on microlepidoptera from the card catalogue prepared by the late j . a . comstock and c . henne , and for access to manuscript records by noel mcfarland .
marian fricano ( santa clara university ) and aileen giovanello ( clark university , international internship 1996 ) made substantial contributions of abstracted data ; fran love ( north carolina ) painstakingly checked scanned texts and reformatted them for import to paradox .
we are indebted to all our helpers for their diligence , accuracy and patience , and for their unswerving faith that this daunting project would reach a conclusion .
we thank the trustees of the loke wan tho memorial foundation for their generous support for this project .
robinson , g . s . , p . r . ackery , i . j . kitching , g . w . beccaloni & l . m . hernández , 2010 . hosts - a database of the world ' s lepidopteran hostplants . natural history museum , london . urltoken . ( accessed : 18 aug . 2010 ) .
brummitt , r . k . 1992 . vascular plant families and genera . [ vi ] + 804 pp . , royal botanic gardens , kew .
kartesz , j . t . 1994 . a synonymized checklist of the vascular flora of the unites states , canada and greenland . timber press , portland . 1 , checklist , lxi + 622 pp ; 2 , thesaurus , vii + 816 pp .
kitching , i . j . & cadiou , j . - m . 2000 . hawkmoths of the world : an annotated and illustrated revsionary checklist . xx + 500 pp . , cornell university press , ithaca .
kitching , i . j . & rawlins , j . e . 1999 . the noctuoidea . pp . 355 - 401 . in : kristensen , n . p . ( ed . ) lepidoptera , moths and butterflies . 1 . evolution , systematics and biogeography . handbook of zoology , 4 ( 35 ) . lepidoptera . x + 491 pp . de gruyter , berlin .
letourneau , d . k . , hagen , j . a . & robinson , g . s . 2001 . bt crops : evaluating benefits under cultivation and risks from escaped transgenes in the wild . pp . 33 - 98 . in : letourneau , d . k . & burrows , b . e . ( eds ) , genetically engineered organisms : assessing environmental and human health effects . [ viii ] + 438 pp . , crc press , boca raton .
mabberley , d . j . 1987 . the plant book . a portable dictionary of the higher plants . xii + 707 pp . , cambridge university press . [ the 1993 reprint edition is currently used in editing . ]
nielsen , e . s . , edwards , e . d . & rangsi , t . v . ( eds ) 1996 . checklist of the lepidoptera of australia . monographs on australian lepidoptera . 4 . xiv + 529 pp . , csiro , melbourne .
nye , i . w . b . ( ed . ) 1975 - 91 . the generic names of moths of the world . 1 : 568 pp . ( noctuoidea ( part ) - nye , i . w . b . , 1975 ) ; 2 : xiv + 228 pp . ( noctuoidea ( part ) - watson , a . , fletcher , d . s . & nye , i . w . b . , 1980 ) ; 3 : xx + 243 pp . ( geometroidea - fletcher , d . s . , 1979 ) ; 4 : xiv + 192 pp . ( bombycoidea to zygaenoidea - fletcher , d . s . & nye , i . w . b . , 1982 ) ; 5 : xv + 185 pp . ( pyraloidea - fletcher , d . s . & nye , 1984 ) ; 6 : xxix + 368 pp . ( microlepidoptera - nye , i . w . b . & fletcher , d . s . , 1991 ) . british museum ( natural history ) / the natural history museum , london .
rawlins , j . e . 1984 . mycophagy in lepidoptera . pp . 382 - 483 . in : wheeler , q . & blackwell , m . ( eds ) fungus - insect relationships . perspectives in ecology and evolution . 514 pp . , columbia university press .
robinson , g . s . 1999 . hosts - a database of the hostplants of the world ' s lepidoptera . nota lepidopterologica , 22 : 35 - 47 .
robinson , g . s . , ackery , p . r . , kitching , i . j . , beccaloni , g . w . & hernández , l . m . 2001 . hostplants of the moth and butterfly caterpillars of the oriental region . 744 pp . southdene sdn bhd , kuala lumpur .
robinson , g . s . , ackery , p . r . , kitching , i . j . , beccaloni , g . w . & hernández , l . m . 2002 . hostplants of the moth and butterfly caterpillars of america north of mexico . memoirs of the american entomological institute , 69 : 1 - 824 .
scoble , m . j . ( ed . ) 1999 . a taxonomic catalogue to the geometridae of the world ( insecta : lepidoptera ) . 2 vols . csiro publications , melbourne .
royal botanic garden edinburgh dipterocarpaceae database : http : / / 193 . 62 . 154 . 38 / diptero /
we use cookies to optimise your experience when using this site . view our cookie policy and our new privacy notice .
if you have images for this taxon that you would like to share with nbn atlas , please upload using the upload tools .
html public
- / / w3c / / dtd xhtml 1 . 0 transitional / / en
urltoken
click here to view an interactive map of the northern ireland dataset as currently collated by cedar . the map is generated through the nbn gateway using their interactive mapping tool .
this is a small , relatively common , well - marked , attractive moth of bogs and heaths . it freely comes to light but can be active on warm sunny days when it can be caught whilst nectaring on flowers . it flies in august and september . caterpillars feed on cotton - grasses and various species of rush . it has declined in the uk by 80 % over a 25 year period . in northern ireland there is no evidence of such a decline .
species description this diminutive moth is extremely well patterned with an obvious white kidney shaped mark which has two white veins ( appearing as streaks ) extending from it to the outer edge of the wing . the background colour of the forewing is usually a dark purplish brown .
life cycle the adult flies in august and september when eggs are laid on the chosen food - plant . it overwinters as an egg . the caterpillar burrows into the stem of cotton - grass or various rushes , changing stems when it out - grows them . pupation takes place in a cocoon close to the ground .
how to see this species this species is attracted to light and can be taken relatively easily on bogs and heaths . walking these habitats on warm sunny days checking flowers for nectaring moths can also be productive if you are quick with a net !
current status it is widespread and fairly common in suitable habitat throughout northern ireland .
threats / causes of decline it is thought to be declining in the uk as a result of many factors , including habitat change , pollution and the use of pesticides .
conservation of this species current action in northern ireland there are no specific actions proposed for this species .
report all moth sightings to the moth recorder for northern ireland , andrew crory , andrew . crory @ urltoken or use the butterfly conservation northern ireland ( bcni ) sightings web page at urltoken . the bcni database is managed by cedar and these records will then be used to update the butterflies and moths of northern ireland website .
join butterfly conservation . butterflies and moths are in serious decline — with your support butterfly conservation can take action to reverse this .
literature skinner , b . ( 2009 ) . 3rd revised and updated edition . the colour identification guide to the moths of the british isles . apollo books . thompson , r . & nelson , b . ( 2006 ) . the butterflies and moths of northern ireland . nmni , belfast . waring , p . & townsend , m . ( 2009 ) . 2nd edition . field guide to the moths of great britain and ireland . british wildlife .
very locally recorded at certain norfolk fens and marshes including several sites in the broads .
comes to light at night , males can be seen flying by day on sunny afternoons .
recorded in 15 ( 22 % ) of 69 10k squares . first recorded in 1873 . last recorded in 2018 .
underlying maps using digital map data © norfolk online lepidoptera archive - nola™ 2018 . © james wheeler - n o r f o l k m o t h s 2007 - 2018 . data © nola™ 2018
species “of principal importance for the purpose of conserving biodiversity” covered under section 41 ( england ) of the nerc act ( 2006 ) and therefore need to be taken into consideration by a public body when performing any of its functions with a view to conserving biodiversity .
species “of principal importance for the purpose of conserving biodiversity” covered under section 42 ( wales ) of the nerc act ( 2006 ) and therefore need to be taken into consideration by a public body when performing any of its functions with a view to conserving biodiversity .
the northern ireland priority list of threatened species requiring conservation action in northern ireland . criteria have been developed to ensure that priority species have been chosen using a scientific basis ( see http - / / www . habitas . org . uk / priority / criteria . html ) . the list is designed to assist those involved in the conservation of biodiversity by guiding decisions on where to target action and invest resources .
the uk list of priority species and habitats contains 1150 species and 65 habitats that have been listed as priorities for conservation action under the uk biodiversity action plan ( uk bap ) .
receive our free weekly newsletter which includes our popular photo of the week and review of the week features , plus competitions , special offers and much more . hide message .
view thousands of photos and video of butterflies and moths from around the world , or upload your own . to search by species , use the species guide ( change
ioc
to
butterflies & moths
before searching by taxon ) .
© 2018 birdguides , warners group publications plc . all rights reserved . company registered in england no . 2572212 | vat registration no . gb 638 3492 15
html public
- / / w3c / / dtd html 3 . 2 / / en
a very rare and local species in belgium , restricted to wet biotopes and occuring in two disjunct areas ; in flanders and in the south of the country .
the adults fly from late june till mid october in one generation . they come to light and sugar .
belgium , antwerpen , viersel , 12 july 2005 . ( photo © maarten jacobs )
ws : 25 - 30mm ( mbgbi10 ) , fw : 10 - 14mm ( waring & townsend ) ; aug - sep ; common cottongrass ( eriophorum angustifolium ) ; locally common in boggy moorland in scotland , n . england and n . wales ; more local in s . england in exmoor , dartmoor , the test and itchin valleys and norfolk broads .
forewing ranges from grey - brown to red - brown ( fenland specimens tending to be paler and brighter ) , with a darker broad median fascia usually discernible ; usually a prominent small whitish oval ; prominent larger whitish kidney with two white streaks extending distally from its dorsal end towards a pale subterminal fascia of variable prominence ; usually a narrow pale dorsal streak . male antenna fasciculate - ciliate , female shortly ciliate . helotropha leucostigma ( crescent ) has a similar general pattern including the bold white kidney mark with 2 white streaks extending from it towards the termen a variable pale subterminal fascia and a variable pale dorsal streak . h . leucostigma is larger ( ws : 35 - 41 , fw : 14 - 17mm ) and has a more pointed forewing apex ; its oval mark is nearly as large as the kidney mark and is either indistinct or pale outlined .
§1 aberfoyle , perthsire ; 20 / 08 / 2008 ; male ; fw 11 . 7mm §2 arrochar , dunbartonshire ; 05 / 09 / 2014 ; male ; fw 10 . 7mm §3 cheviot hills , northumberland ; 17 / 09 / 2014 ; male ; fw 10 . 7mm ; potted by day §4 dalmunzie ( glenshee ) , perthshire ; 30 / 08 / 2016 ; male ; fw 12 . 7mm all images © chris lewis
eol content is automatically assembled from many different content providers . as a result , from time to time you may find pages on eol that are confusing .
to request an improvement , please leave a comment on the page . thank you !
description : wingspan 25 - 32 mm . forewings reddish brown with a series of small black marks along the costa . stigmata ochreous white and clearly defined the orbicular being quite small . antemedian and post median lines indistinct . there is a whitish suffusion at the terminal area of the forewing . there is also a series of small black dashes along the outer margin of the wing . hindwings pale fuscous becoming lighter towards the basal area .
status : widely distributed across southern counties especially around the bogs and fens of north armagh . in fermanagh it is found in several widely scattered sites while north of lough neagh it has only been reported from coastal localities including rathlin island , antrim . it may possibility be under recorded in some other areas since there is no shortage of suitable habitat .
ecology : a small species found mainly on bogs , fens and moorland . adult males will often fly in late afternoon sunshine but the majority are seen at light . some may be found at rest on the stems of heather . they are also attracted to the flowers of heather calluna vulgaris , common ragwort senecio jacobaea and wood - rush luzula spp . the larvae feed during the warmer days in spring through until july on cottongrass eriophrum spp . and rush juncus spp . it overwinters as an egg .
world distribution : eurasiatic : common across most of western europe from portugal north to denmark and central fennoscandia .
download online ma biographie . . . : avec un appendice . . . pdf
by downloading this content you are agreeing to use it in accordance with the terms of use and any data provider terms associated with the data download . please provide the following details before downloading ( * required ) :
× list name biodiversity lists - england - nerc s . 41 owner r . stroud @ urltoken list type conservation list description source : natural environment and rural communities act 2006 - secies of principal importance in england ( section 41 ) and wales ( section 42 ) source description : sections 41 ( england ) and sections 42 ( wales ) of the natural environment and rural communities act 2006 require the listing of species “of principal importance for the purpose of conserving biodiversity” and therefore need to be taken into consideration by a public body when performing any of its functions with a view to conserving biodiversity . designation description : species “of principal importance for the purpose of conserving biodiversity” covered under section 41 ( england ) of the nerc act ( 2006 ) and therefore need to be taken into consideration by a public body when performing any of its functions with a view to conserving biodiversity . date submitted 2017 - 01 - 26 is private no included in species pages yes authoritative yes invasive no threatened no part of the sensitive data service no region not provided metadata link urltoken
download free gas dynamics 9780471878995 pdf by m . r . a . shaalan , a . nasser
read online of the specimens of birds , vol . 2 : in the collection of the british museum classic reprint by unknown author rtf
e - books box : contributions to the natural history of the united states of america , volume 4 . . . by louis agassiz pdf
epub free download trematodes : their life cycles , biology and evolution epub by t . a . ginetsinskaya