Nimda worm runs riot on IT sites

Microsoft, Dell, NTL and INS caught with pants down

By John Leyden, 20th September 2001

Customer Success Testimonial: Recovery is Everything

The IT industry has done a poor job in protecting its Web servers from the effects of the Nimda worm.

That's the conclusion we draw from evidence that Web sites belonging to Dell, Microsoft, NTL and corporate ISP C&W INS all show tell-tale traces of Nimda infection.

As previously reported, Nimda (which affects both Windows PCs and servers running IIS) spreads via an email attachment or a web defacement download.

The worm takes advantage of well-known Microsoft IIS vulnerabilities to stick copies of itself on servers before attempting to propagate via the Web.

For the record: www.microsoft.com/frontpage (possibly), Microsft's Japanese Web server (definetly), ftp://ftp1.dell.com/bios/, mms3-win.server.ntl.com, mms4-win.server.ntl.com and THE_WEB01 server of C&W INS have all been infected by the virus.

We hope the firms involved are in the process of updating their Web servers to guard against the worm, as explained by an advisory issued by C&W INS on what it is doing.

With the numerous security flaps about IIS that have surfaced of late you'd have expected these firms to have patched up their servers ages ago - at least if they had any proper security policy in place.

Is it too much to expect the industry to practice what it preaches? If financial institutions advised IT firms about Internet security (instead of the other way around) we'd probably all be a lot better off... ®