printer friendly version

Lessons from Code Red

Recently, the Code Red worm was unleashed and quickly spread to some 350 000 host machines around the world. Whilst Code Red is not of immediate interest to businesses in the conventional security sector, the saga of Code Red highlights issues that we would all be well advised to take note of.

How was Code Red able to spread and what lessons can we learn from its destruction?

On 19 June 2001, the Computer Emergency Response Team Coordination Centre issued Advisory CA-2001-13 www.cert.org/advisories/CA-2001-13.html warning of a buffer overflow in the Microsoft Internet Information Server software Versions 4.0 or 5.0 running under Windows 2000 and beta-test versions of Windows XP. This vulnerability allows execution of arbitrary code on a susceptible machine; ie anyone can execute any instructions they like on an unpatched system.

The Advisory urged, "Since specific technical details on how to create an exploit are publicly available for this vulnerability, system administrators should apply fixes or workarounds on affected systems as soon as possible."

One month later, on 19 July, Advisory CA-2001-19 www.cert.org/advisories/CA-2001-19.html was issued announcing that the Code Red worm (a free-standing, self-propagating program that spreads through network connections) was exploiting the vulnerability announced in CA-2001-13. A good description of the worm's internals can be found at xforce.iss.net/alerts/advise89.php

Without regurgitating all of the hype surrounding Code Red, there are some obvious lessons to be learnt from this outbreak:

* It took only a month from public discovery and patch of a vulnerability to an outbreak of an exploit.

* It took more than a month for many administrators of vulnerable systems to apply the patch.

* Variants of the worm appeared almost immediately, and they were worse than the first ones.

* The number of unpatched systems is so high that even a simple attack can measurably affect Internet traffic and increase response time for web connections.

* All unpatched systems will continue to be vulnerable to this type of exploit.

* The fundamental flaw that allowed for this attack is poor programming: buffer overflows imply that input strings are not being checked for length or otherwise edited, allowing strings to be interpreted as instructions. Manufacturers need to improve their quality assurance.

* The originator of the attack may never be known.

* The criminal hacker subculture has bred a group of people whose enjoyment of harm approaches the level of clinical sociopathy.

* The long-standing warnings from Donn Parker and others about automation of computer crime are coming true (see Parker's 1998 book, 'Fighting computer crime: A new framework for protecting information').

According to M.E. Kabay, Associate Professor of Computer Information Systems at Norwich University, "We are very close to major damage to the information infrastructure through self-propagating code that exploits the inability and unwillingness of management to support network administrators in keeping their system patches up-to-date."

Reinforcing this message was an excellent analysis of the implications of the Code Red family of worms by Elinor Mills Abreu, who interviewed several security experts for an article headlined 'Code Red foreshadows evolution of cyber threats' ( news.excite.com/printstory/news/r/010803/22/net-techcodered-dc). She points out that Code Red shows that infectious code can rapidly increase the damage caused by its payload.

An issue not being talked about is that of the collateral damage of Code Red. For example, Cisco has admitted that DSL routers with older firmware were susceptible to a denial-of-service attack when attacked by Code Red. Such devices were not specifically targeted by Code Red. Instead, their web interface could not handle the Code Red attack. There has been an enormous proliferation of random devices with a web interface: listening on Port 80, including security hardware from CCTV to access control. Says Counterpane Internet Security's Bruce Schneier, "This is a large single-point-of-failure that Code Red has illustrated, and no one seems to be talking about."

Ouch.

Lessons from Code Red indeed.

Till next month.

Darren Smith

Share this article:

Further reading: