Feeds

Code Red bug hits Microsoft security update site

Duh!

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

Microsoft's own Windows Update site has fallen victim to the Code Red worm.

As previously reported, the Code Red worm attacks what's now called the .ida vulnerability, an unchecked buffer in the IIS Indexing Service ISAPI filter, which, if exploited, can yield system-level access to an intruder.

The fact that the Windows Update site, which provides a portal to product updates and security patches along with advice on critical updates, wasn't itself up to date with the latest security patches is richly ironic.

Security experts at MIS Corporate Defence warned that because the bug allows system level access, the possibility that links on the site had been changed to point to maliciously crafted updates (possibly containing Trojans) needed to be ruled out. Whether Microsoft carried out such an audit before putting the site live again remains unclear.

A patch to guard against the .ida vulnerability has been available for over a month but the spread of the worm indicates sys admins have not woken up to the problem, even after the release of an attack script was released on 21 June by Japanese hacker HighSpeed Junkie.

The Code Red worm, which first appeared on 13 July, defaces Web sites with the message: "Welcome to http://www.worm.com! Hacked by Chinese!" and will periodically send 100KB of junk data to Whitehouse.gov as part of an apparent denial of service attack. The worm sets itself up on the infected system and creates 99 other 'threads' which provide a means for it to spread itself to other Web servers.

A flood of the White House Web site was due to begin last night but the site's admins have switched the numerical address of the site and seem to be on top of the problem. Unfortunately the same can not be said of other members of the Internet community and a large number of infections have been reported worldwide.

Some estimates suggest 225,000 machines have been infected, which is way over the top, but there's no doubt that infection is widespread

The FBI's National Infrastructure Protection Centre has issued an alert on the virus which describes it as a significant threat that could "degrade services running on the Internet".

Code Red is not saved as a file, but injected and executed directly from memory. Patching the security hole in the system and rebooting will remove the worm and prevent further infection. ®

External Links

CERT advisory with links to Microsoft's patches
FBI warning
Stats on the spread of the worm
Discussion on the hacking of Microsoft by staff at Attrition

Related Stories:
IIS worm made to packet Whitehouse.gov
IIS buffer-overrun attack has been scripted
MS hacked once, twice, three, FOUR times
MS confronts another IIS system-level hole
Yet another IIS exploit reported
Microsoft IIS hole gives System-level access

Intelligent flash storage arrays

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
The total economic impact of Druva inSync
Examining the ROI enterprises may realize by implementing inSync, as they look to improve backup and recovery of endpoint data in a cost-effective manner.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.