Feeds

Code Red bug hits Microsoft security update site

Duh!

  • alert
  • submit to reddit

Providing a secure and efficient Helpdesk

Microsoft's own Windows Update site has fallen victim to the Code Red worm.

As previously reported, the Code Red worm attacks what's now called the .ida vulnerability, an unchecked buffer in the IIS Indexing Service ISAPI filter, which, if exploited, can yield system-level access to an intruder.

The fact that the Windows Update site, which provides a portal to product updates and security patches along with advice on critical updates, wasn't itself up to date with the latest security patches is richly ironic.

Security experts at MIS Corporate Defence warned that because the bug allows system level access, the possibility that links on the site had been changed to point to maliciously crafted updates (possibly containing Trojans) needed to be ruled out. Whether Microsoft carried out such an audit before putting the site live again remains unclear.

A patch to guard against the .ida vulnerability has been available for over a month but the spread of the worm indicates sys admins have not woken up to the problem, even after the release of an attack script was released on 21 June by Japanese hacker HighSpeed Junkie.

The Code Red worm, which first appeared on 13 July, defaces Web sites with the message: "Welcome to http://www.worm.com! Hacked by Chinese!" and will periodically send 100KB of junk data to Whitehouse.gov as part of an apparent denial of service attack. The worm sets itself up on the infected system and creates 99 other 'threads' which provide a means for it to spread itself to other Web servers.

A flood of the White House Web site was due to begin last night but the site's admins have switched the numerical address of the site and seem to be on top of the problem. Unfortunately the same can not be said of other members of the Internet community and a large number of infections have been reported worldwide.

Some estimates suggest 225,000 machines have been infected, which is way over the top, but there's no doubt that infection is widespread

The FBI's National Infrastructure Protection Centre has issued an alert on the virus which describes it as a significant threat that could "degrade services running on the Internet".

Code Red is not saved as a file, but injected and executed directly from memory. Patching the security hole in the system and rebooting will remove the worm and prevent further infection. ®

External Links

CERT advisory with links to Microsoft's patches
FBI warning
Stats on the spread of the worm
Discussion on the hacking of Microsoft by staff at Attrition

Related Stories:
IIS worm made to packet Whitehouse.gov
IIS buffer-overrun attack has been scripted
MS hacked once, twice, three, FOUR times
MS confronts another IIS system-level hole
Yet another IIS exploit reported
Microsoft IIS hole gives System-level access

Choosing a cloud hosting partner with confidence

More from The Register

next story
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.