Lessons from Code Red

October 2001 News & Events

Recently, the Code Red worm was unleashed and quickly spread to some 350 000 host machines around the world. Whilst Code Red is not of immediate interest to businesses in the conventional security sector, the saga of Code Red highlights issues that we would all be well advised to take note of.

How was Code Red able to spread and what lessons can we learn from its destruction?

On 19 June 2001, the Computer Emergency Response Team Coordination Centre issued Advisory CA-2001-13 www.cert.org/advisories/CA-2001-13.html warning of a buffer overflow in the Microsoft Internet Information Server software Versions 4.0 or 5.0 running under Windows 2000 and beta-test versions of Windows XP. This vulnerability allows execution of arbitrary code on a susceptible machine; ie anyone can execute any instructions they like on an unpatched system.

The Advisory urged, "Since specific technical details on how to create an exploit are publicly available for this vulnerability, system administrators should apply fixes or workarounds on affected systems as soon as possible."

One month later, on 19 July, Advisory CA-2001-19 www.cert.org/advisories/CA-2001-19.html was issued announcing that the Code Red worm (a free-standing, self-propagating program that spreads through network connections) was exploiting the vulnerability announced in CA-2001-13. A good description of the worm's internals can be found at xforce.iss.net/alerts/advise89.php

Without regurgitating all of the hype surrounding Code Red, there are some obvious lessons to be learnt from this outbreak:

* It took only a month from public discovery and patch of a vulnerability to an outbreak of an exploit.

* It took more than a month for many administrators of vulnerable systems to apply the patch.

* Variants of the worm appeared almost immediately, and they were worse than the first ones.

* The number of unpatched systems is so high that even a simple attack can measurably affect Internet traffic and increase response time for web connections.

* All unpatched systems will continue to be vulnerable to this type of exploit.

* The fundamental flaw that allowed for this attack is poor programming: buffer overflows imply that input strings are not being checked for length or otherwise edited, allowing strings to be interpreted as instructions. Manufacturers need to improve their quality assurance.

* The originator of the attack may never be known.

* The criminal hacker subculture has bred a group of people whose enjoyment of harm approaches the level of clinical sociopathy.

* The long-standing warnings from Donn Parker and others about automation of computer crime are coming true (see Parker's 1998 book, 'Fighting computer crime: A new framework for protecting information').

According to M.E. Kabay, Associate Professor of Computer Information Systems at Norwich University, "We are very close to major damage to the information infrastructure through self-propagating code that exploits the inability and unwillingness of management to support network administrators in keeping their system patches up-to-date."

Reinforcing this message was an excellent analysis of the implications of the Code Red family of worms by Elinor Mills Abreu, who interviewed several security experts for an article headlined 'Code Red foreshadows evolution of cyber threats' ( news.excite.com/printstory/news/r/010803/22/net-techcodered-dc). She points out that Code Red shows that infectious code can rapidly increase the damage caused by its payload.

An issue not being talked about is that of the collateral damage of Code Red. For example, Cisco has admitted that DSL routers with older firmware were susceptible to a denial-of-service attack when attacked by Code Red. Such devices were not specifically targeted by Code Red. Instead, their web interface could not handle the Code Red attack. There has been an enormous proliferation of random devices with a web interface: listening on Port 80, including security hardware from CCTV to access control. Says Counterpane Internet Security's Bruce Schneier, "This is a large single-point-of-failure that Code Red has illustrated, and no one seems to be talking about."

Ouch.

Lessons from Code Red indeed.

Till next month.

Darren Smith





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
From the editor's desk: Showtime for Securex
Technews Publishing News & Events
We have once again reached the time of year when the security industry focuses on Securex. This issue includes a short preview, with more coming online and via our special Securex Preview news briefs. ...

Read more...
Chubbsafes celebrates 190 years
Gunnebo Safe Storage Africa News & Events Security Services & Risk Management
Chubbsafes marks its 190th anniversary in 2025 and as a highlight of the anniversary celebrations it is launching the Chubbsafes 1835, a limited edition 190th-anniversary collector’s safe.

Read more...
Suprema unveils BioStar Air
Suprema neaMetrics News & Events Access Control & Identity Management Infrastructure
Suprema launches BioStar Air, the first cloud-based access control platform designed to natively support biometric authentication and feature true zero-on-premise architecture. BioStar Air simplifies deployment and scales effortlessly to secure SMBs, multi-branch companies, and mixed-use buildings.

Read more...
New law enforcement request portal
News & Events Security Services & Risk Management
inDrive launches law enforcement request portal in South Africa to support safety investigations. New portal allows authorised South African law enforcement officials to securely request user data related to safety incidents.

Read more...
Igniting standards, powering protection
Securex South Africa News & Events Fire & Safety
Fire safety is more than compliance, it is a critical commitment to protecting lives, assets, and infrastructure. At Firexpo 2025, taking place from 3 to 5 June at Gallagher Convention Centre, that commitment takes centre stage.

Read more...
The rise of AI-powered cybercrime and defence
Information Security News & Events AI & Data Analytics
Check Point Software Technologies launched its inaugural AI Security Report, offering an in-depth exploration of how cybercriminals are weaponising artificial intelligence (AI), alongside strategic insights defenders need to stay ahead.

Read more...
From the editor's desk: We’ve only just begun
Technews Publishing News & Events
The surveillance market has expanded far beyond the analogue days of just recording and/or monitoring screens. The capabilities of surveillance technology today extend to black screen monitoring with ...

Read more...
SAFPS issues SAPS impersonation scam warning
News & Events Security Services & Risk Management
The Southern African Fraud Prevention Service (SAFPS) is warning the public against a scam in which scammers pose as members of the South African Police Service (SAPS) and trick and intimidate individuals into handing over personal and financial information.

Read more...
Strong industry ties set Securex South Africa apart
News & Events Training & Education
Securex South Africa, co-located with A-OSH EXPO, Facilities Management Expo, and Firexpo, is a meeting place of minds, where leading security, safety, fire, and facilities professionals come together, backed by strong ties with the industry’s most influential bodies.

Read more...