Lessons from Code Red

October 2001 News & Events

Recently, the Code Red worm was unleashed and quickly spread to some 350 000 host machines around the world. Whilst Code Red is not of immediate interest to businesses in the conventional security sector, the saga of Code Red highlights issues that we would all be well advised to take note of.

How was Code Red able to spread and what lessons can we learn from its destruction?

On 19 June 2001, the Computer Emergency Response Team Coordination Centre issued Advisory CA-2001-13 www.cert.org/advisories/CA-2001-13.html warning of a buffer overflow in the Microsoft Internet Information Server software Versions 4.0 or 5.0 running under Windows 2000 and beta-test versions of Windows XP. This vulnerability allows execution of arbitrary code on a susceptible machine; ie anyone can execute any instructions they like on an unpatched system.

The Advisory urged, "Since specific technical details on how to create an exploit are publicly available for this vulnerability, system administrators should apply fixes or workarounds on affected systems as soon as possible."

One month later, on 19 July, Advisory CA-2001-19 www.cert.org/advisories/CA-2001-19.html was issued announcing that the Code Red worm (a free-standing, self-propagating program that spreads through network connections) was exploiting the vulnerability announced in CA-2001-13. A good description of the worm's internals can be found at xforce.iss.net/alerts/advise89.php

Without regurgitating all of the hype surrounding Code Red, there are some obvious lessons to be learnt from this outbreak:

* It took only a month from public discovery and patch of a vulnerability to an outbreak of an exploit.

* It took more than a month for many administrators of vulnerable systems to apply the patch.

* Variants of the worm appeared almost immediately, and they were worse than the first ones.

* The number of unpatched systems is so high that even a simple attack can measurably affect Internet traffic and increase response time for web connections.

* All unpatched systems will continue to be vulnerable to this type of exploit.

* The fundamental flaw that allowed for this attack is poor programming: buffer overflows imply that input strings are not being checked for length or otherwise edited, allowing strings to be interpreted as instructions. Manufacturers need to improve their quality assurance.

* The originator of the attack may never be known.

* The criminal hacker subculture has bred a group of people whose enjoyment of harm approaches the level of clinical sociopathy.

* The long-standing warnings from Donn Parker and others about automation of computer crime are coming true (see Parker's 1998 book, 'Fighting computer crime: A new framework for protecting information').

According to M.E. Kabay, Associate Professor of Computer Information Systems at Norwich University, "We are very close to major damage to the information infrastructure through self-propagating code that exploits the inability and unwillingness of management to support network administrators in keeping their system patches up-to-date."

Reinforcing this message was an excellent analysis of the implications of the Code Red family of worms by Elinor Mills Abreu, who interviewed several security experts for an article headlined 'Code Red foreshadows evolution of cyber threats' ( news.excite.com/printstory/news/r/010803/22/net-techcodered-dc). She points out that Code Red shows that infectious code can rapidly increase the damage caused by its payload.

An issue not being talked about is that of the collateral damage of Code Red. For example, Cisco has admitted that DSL routers with older firmware were susceptible to a denial-of-service attack when attacked by Code Red. Such devices were not specifically targeted by Code Red. Instead, their web interface could not handle the Code Red attack. There has been an enormous proliferation of random devices with a web interface: listening on Port 80, including security hardware from CCTV to access control. Says Counterpane Internet Security's Bruce Schneier, "This is a large single-point-of-failure that Code Red has illustrated, and no one seems to be talking about."

Ouch.

Lessons from Code Red indeed.

Till next month.

Darren Smith





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
From QR code to compromise
Information Security News & Events
A new attack vector involves threat actors using fraudulent QR codes emailed in PDF attachments to bypass companies' phishing security measures by requiring users to scan the code with their mobile phones.

Read more...
Boost revenue streams for MNOS
News & Events Security Services & Risk Management Financial (Industry)
ReveNet has introduced its new solution, designed to safeguard and potentially boost revenue streams in an increasingly challenging landscape for MNOS. The new platform combines advanced analytics and is built on trust, transparency, and sustainability principles.

Read more...
Here’s to a SMART 2025
SMART Security Solutions Editor's Choice News & Events
This is the final news brief from SMART Security Solutions for 2024, and the teams would like to take this opportunity to thank our readers, advertisers and partners and wish everyone a safe and secure festive season.

Read more...
Organisations fear AI-driven cyberattacks, but lack key defences
Kaspersky Information Security News & Events Training & Education
A recent Kaspersky study reveals that businesses are increasingly worried about the growing use of artificial intelligence in cyberattacks, with 56% of surveyed companies in South Africa reporting a rise in cyber incidents over the past year.

Read more...
South African SMBs chart growth amid economic uncertainties
News & Events
Survey shows that business confidence among South African SMBs remains strong at 78%, but opportunities abound to boost productivity and accelerate digital transformation. Additionally, AI adoption has gained traction, with two-thirds of South African SMBs investing in AI over the past year.

Read more...
ONVIF launches new online learning initiative
Training & Education Surveillance News & Events
ONVIF has released the first course in a new online learning initiative designed to promote greater knowledge and understanding of ONVIF's workings. The first “Introduction to ONVIF” course is now available.

Read more...
Gallagher Security opens Cape Town office
Gallagher News & Events Access Control & Identity Management
Acknowledging a significant period of growth for the company in South Africa, opening a second office will enable Gallagher to increase its presence across the region with staff based in Johannesburg and Cape Town.

Read more...
Physical security technology trends to watch in 2025
Technews Publishing News & Events
There are some exciting developments and significant changes, some technical and some operational, taking place in the market that security professionals should be aware of as they plan for the year ahead.

Read more...
Axis announces ARTPEC-9 SoC
Axis Communications SA Surveillance News & Events
Axis Communications has announced the 9th generation of its system-on-chip (SoC). ARTPEC-9 builds on and refines the capabilities and features of previous generations of the company’s in-house designed SoC, including exceptionally low bitrate, AI-powered analytics, quality imaging, and enhanced cybersecurity.

Read more...