Lessons from Code Red

October 2001 News

Recently, the Code Red worm was unleashed and quickly spread to some 350 000 host machines around the world. Whilst Code Red is not of immediate interest to businesses in the conventional security sector, the saga of Code Red highlights issues that we would all be well advised to take note of.

How was Code Red able to spread and what lessons can we learn from its destruction?

On 19 June 2001, the Computer Emergency Response Team Coordination Centre issued Advisory CA-2001-13 www.cert.org/advisories/CA-2001-13.html warning of a buffer overflow in the Microsoft Internet Information Server software Versions 4.0 or 5.0 running under Windows 2000 and beta-test versions of Windows XP. This vulnerability allows execution of arbitrary code on a susceptible machine; ie anyone can execute any instructions they like on an unpatched system.

The Advisory urged, "Since specific technical details on how to create an exploit are publicly available for this vulnerability, system administrators should apply fixes or workarounds on affected systems as soon as possible."

One month later, on 19 July, Advisory CA-2001-19 www.cert.org/advisories/CA-2001-19.html was issued announcing that the Code Red worm (a free-standing, self-propagating program that spreads through network connections) was exploiting the vulnerability announced in CA-2001-13. A good description of the worm's internals can be found at xforce.iss.net/alerts/advise89.php

Without regurgitating all of the hype surrounding Code Red, there are some obvious lessons to be learnt from this outbreak:

* It took only a month from public discovery and patch of a vulnerability to an outbreak of an exploit.

* It took more than a month for many administrators of vulnerable systems to apply the patch.

* Variants of the worm appeared almost immediately, and they were worse than the first ones.

* The number of unpatched systems is so high that even a simple attack can measurably affect Internet traffic and increase response time for web connections.

* All unpatched systems will continue to be vulnerable to this type of exploit.

* The fundamental flaw that allowed for this attack is poor programming: buffer overflows imply that input strings are not being checked for length or otherwise edited, allowing strings to be interpreted as instructions. Manufacturers need to improve their quality assurance.

* The originator of the attack may never be known.

* The criminal hacker subculture has bred a group of people whose enjoyment of harm approaches the level of clinical sociopathy.

* The long-standing warnings from Donn Parker and others about automation of computer crime are coming true (see Parker's 1998 book, 'Fighting computer crime: A new framework for protecting information').

According to M.E. Kabay, Associate Professor of Computer Information Systems at Norwich University, "We are very close to major damage to the information infrastructure through self-propagating code that exploits the inability and unwillingness of management to support network administrators in keeping their system patches up-to-date."

Reinforcing this message was an excellent analysis of the implications of the Code Red family of worms by Elinor Mills Abreu, who interviewed several security experts for an article headlined 'Code Red foreshadows evolution of cyber threats' ( news.excite.com/printstory/news/r/010803/22/net-techcodered-dc). She points out that Code Red shows that infectious code can rapidly increase the damage caused by its payload.

An issue not being talked about is that of the collateral damage of Code Red. For example, Cisco has admitted that DSL routers with older firmware were susceptible to a denial-of-service attack when attacked by Code Red. Such devices were not specifically targeted by Code Red. Instead, their web interface could not handle the Code Red attack. There has been an enormous proliferation of random devices with a web interface: listening on Port 80, including security hardware from CCTV to access control. Says Counterpane Internet Security's Bruce Schneier, "This is a large single-point-of-failure that Code Red has illustrated, and no one seems to be talking about."


Lessons from Code Red indeed.

Till next month.

Darren Smith

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Crossing the chasm
Editor's Choice News Security Services & Risk Management Training & Education
Industry reports suggest that in the next ten years, millions of jobs could go unfilled because there simply are not enough people to fill them.

The greatest asset for driving transformation
Dell Technologies’ research from 40+ countries details how, after two years of accelerated digital transformation, business leaders are more aware than ever of the role employees play in driving successful change

Top six priorities for business security this festive season
At this time of year it is not uncommon to see criminals enter a business posing as a customer or a delivery supplier, and then proceed to hold staff at gunpoint.

DeltaTrak and Ericsson IoT offer real-time cold chain traceability
News Products Logistics (Industry)
Ericsson’s Internet of Things (IoT) business and DeltaTrak announced a collaboration through Deutsche Telekom that will drive cold chain traceability enhancements powered by the Ericsson IoT Accelerator platform.

No supply chain delays from Germany
Dallmeier Electronic Southern Africa News CCTV, Surveillance & Remote Monitoring Products
Dallmeier announces that its complete Domera single-sensor camera family is available without delivery problems for installers and channel partners.

Lukas van Emmenis joins Olarm in Gauteng
Olarm News
Lukas van Emmenis has joined Olarm as its regional manager based in Gauteng, where he will make full use of his experience in the electronic security, security distribution and discreet manufacturing fields.

From the editor's desk: Social beings
Technews Publishing News
      Welcome to Hi-Tech Security Solutions Issue 7. We have slightly fewer topics in focus in this issue because the bulk of the editorial covers one topic, the Residential Estate Security Conference 2022. ...

SALTO launches integrated Technology Partner Programme
Salto Systems Africa News Access Control & Identity Management Commercial (Industry)
SALTO Systems has announced it is offering other technology leaders the opportunity to partner with it for an integrated and improved customer offering.

Suprema launches BioStation 3
Suprema neaMetrics Editor's Choice Access Control & Identity Management News Products
Suprema has launched BioStation 3, a contactless access control terminal specialised for facial recognition in the post-Covid era.

ESDA golf day a success
ESDA(Electronic Security Distributors Association) News
The ESDA Annual Charity Fundraiser, part of the Electronic Security Distributors Association’s Golf Day, was held at the Benoni Lake Golf Course on 21 September 2022.