Feeds

Code Red bug hits Microsoft security update site

Duh!

  • alert
  • submit to reddit

5 things you didn’t know about cloud backup

Microsoft's own Windows Update site has fallen victim to the Code Red worm.

As previously reported, the Code Red worm attacks what's now called the .ida vulnerability, an unchecked buffer in the IIS Indexing Service ISAPI filter, which, if exploited, can yield system-level access to an intruder.

The fact that the Windows Update site, which provides a portal to product updates and security patches along with advice on critical updates, wasn't itself up to date with the latest security patches is richly ironic.

Security experts at MIS Corporate Defence warned that because the bug allows system level access, the possibility that links on the site had been changed to point to maliciously crafted updates (possibly containing Trojans) needed to be ruled out. Whether Microsoft carried out such an audit before putting the site live again remains unclear.

A patch to guard against the .ida vulnerability has been available for over a month but the spread of the worm indicates sys admins have not woken up to the problem, even after the release of an attack script was released on 21 June by Japanese hacker HighSpeed Junkie.

The Code Red worm, which first appeared on 13 July, defaces Web sites with the message: "Welcome to http://www.worm.com! Hacked by Chinese!" and will periodically send 100KB of junk data to Whitehouse.gov as part of an apparent denial of service attack. The worm sets itself up on the infected system and creates 99 other 'threads' which provide a means for it to spread itself to other Web servers.

A flood of the White House Web site was due to begin last night but the site's admins have switched the numerical address of the site and seem to be on top of the problem. Unfortunately the same can not be said of other members of the Internet community and a large number of infections have been reported worldwide.

Some estimates suggest 225,000 machines have been infected, which is way over the top, but there's no doubt that infection is widespread

The FBI's National Infrastructure Protection Centre has issued an alert on the virus which describes it as a significant threat that could "degrade services running on the Internet".

Code Red is not saved as a file, but injected and executed directly from memory. Patching the security hole in the system and rebooting will remove the worm and prevent further infection. ®

External Links

CERT advisory with links to Microsoft's patches
FBI warning
Stats on the spread of the worm
Discussion on the hacking of Microsoft by staff at Attrition

Related Stories:
IIS worm made to packet Whitehouse.gov
IIS buffer-overrun attack has been scripted
MS hacked once, twice, three, FOUR times
MS confronts another IIS system-level hole
Yet another IIS exploit reported
Microsoft IIS hole gives System-level access

Secure remote control for conventional and virtual desktops

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NZ Justice Minister scalped as hacker leaks emails
Grab your popcorn: Subterfuge and slur disrupts election run up
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.