Feeds

Code Red bug hits Microsoft security update site

Duh!

  • alert
  • submit to reddit

New hybrid storage solutions

Microsoft's own Windows Update site has fallen victim to the Code Red worm.

As previously reported, the Code Red worm attacks what's now called the .ida vulnerability, an unchecked buffer in the IIS Indexing Service ISAPI filter, which, if exploited, can yield system-level access to an intruder.

The fact that the Windows Update site, which provides a portal to product updates and security patches along with advice on critical updates, wasn't itself up to date with the latest security patches is richly ironic.

Security experts at MIS Corporate Defence warned that because the bug allows system level access, the possibility that links on the site had been changed to point to maliciously crafted updates (possibly containing Trojans) needed to be ruled out. Whether Microsoft carried out such an audit before putting the site live again remains unclear.

A patch to guard against the .ida vulnerability has been available for over a month but the spread of the worm indicates sys admins have not woken up to the problem, even after the release of an attack script was released on 21 June by Japanese hacker HighSpeed Junkie.

The Code Red worm, which first appeared on 13 July, defaces Web sites with the message: "Welcome to http://www.worm.com! Hacked by Chinese!" and will periodically send 100KB of junk data to Whitehouse.gov as part of an apparent denial of service attack. The worm sets itself up on the infected system and creates 99 other 'threads' which provide a means for it to spread itself to other Web servers.

A flood of the White House Web site was due to begin last night but the site's admins have switched the numerical address of the site and seem to be on top of the problem. Unfortunately the same can not be said of other members of the Internet community and a large number of infections have been reported worldwide.

Some estimates suggest 225,000 machines have been infected, which is way over the top, but there's no doubt that infection is widespread

The FBI's National Infrastructure Protection Centre has issued an alert on the virus which describes it as a significant threat that could "degrade services running on the Internet".

Code Red is not saved as a file, but injected and executed directly from memory. Patching the security hole in the system and rebooting will remove the worm and prevent further infection. ®

External Links

CERT advisory with links to Microsoft's patches
FBI warning
Stats on the spread of the worm
Discussion on the hacking of Microsoft by staff at Attrition

Related Stories:
IIS worm made to packet Whitehouse.gov
IIS buffer-overrun attack has been scripted
MS hacked once, twice, three, FOUR times
MS confronts another IIS system-level hole
Yet another IIS exploit reported
Microsoft IIS hole gives System-level access

Secure remote control for conventional and virtual desktops

More from The Register

next story
Leak of '5 MEELLLION Gmail passwords' creates security flap
You should be OK if you're not using ANCIENT password
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Enigmail PGP plugin forgets to encrypt mail sent as blind copies
User now 'waiting for the bad guys come and get me with their water-boards'
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.