Virulent worm calls into doubt our ability to protect the Net

By Rob Lemos
Special to CNET News.com
July 27, 2001, 4:00 a.m. PT

For one moment last week, the Internet stood still.

At midnight Thursday, July 19 GMT, more than 350,000 servers infected with the so-called Code Red worm stopped hammering the Internet with scans searching for vulnerable computers. Instead, the servers targeted an Internet address used as the hub for the White House's public Web site with a denial-of-service attack of such proportions that some feared parts of the Internet would shut down, unable to cope with the unprecedented flood of data.

"If this goes along what it's looking like, parts of the Net will go down," predicted Marc Maiffret, chief hacking officer at network-protection company eEye Digital Security. A month earlier, the Aliso Viejo, Calif., company discovered the flaw exploited by the worm in Microsoft's Web servers and was the first to decode the malicious program.

In the end, a design flaw in the worm's programming stymied the attack, but the potential threat of hundreds of thousands of servers flooding the wires with garbage data has resurrected concerns about security among those who consider themselves the guardians of the Internet.

The Internet was lucky this time, as this particular Code Red program squandered its advantage and left itself vulnerable to security measures. That will not always be the case, said Vern Paxson, staff computer scientist at the Lawrence Berkeley National Laboratory, who analyzed Code Red's quick spread.

"This could have been so much worse," he said.

Worms have become the tool of choice among malicious vandals on the Internet, but the Code Red strain has proven particularly fast and effective in commandeering a significant portion of the Internet. Unlike other worms that hide in e-mail attachments, such as LoveLetter and SirCam, Code Red does not require fooling an unwitting recipient into opening a document.

Paxson said a better author could have clogged the entire Net with garbage data or hit critical parts of the global network with a more effective denial-of-service attack--things that the inevitable variants of this version could still do.

"We are in for bumpy times," he said. "I don't see any way out of that."

Like many new worms, Code Red took full advantage of its element of surprise.

On Thursday, July 12, things were going smoothly at the Black Hat Security Briefings in Las Vegas, where several hundred consultants in the computer-security industry hobnobbed with one another. The day before, one researcher had predicted that worms would continue to threaten the Internet. Most considered it an obvious conclusion.

Unknown to the attendees, however, that day a program had started infecting computers running Microsoft's Internet Information Server. The servers had a security hole that had been discovered the month before, leaving them open to attack if not repaired with Microsoft's specific software patch.

The security hole, known officially as the Index Server ISAPI vulnerability, allowed

DOJ cracks down on cybercrime John Ashcroft, U.S. attorney general

Each hole in the vast number of vulnerable IIS servers on the Web represented a chink in the armor of the Internet that allowed the worm to spread.

That Thursday, the intrusion-detection system at publishing company Chemical Abstract Services recorded three illegal Web access attempts from a single Internet address. The original attacker's address apparently belongs to a server at the University of Foshan in China, though Ken Eichman, senior security engineer for CAS, stressed that an online vandal could have infected the server from practically anywhere.

Eichman didn't notice the scans until the next day, July 13, when 611 attacks from 27 sources appeared in the company's logs. "It wasn't really intense, and it really didn't bother me," he said.

By the end of the day, however, the scans started getting worse. At one point, Eichman thought that hostile hackers were targeting his company's network. On Saturday, when the number of servers attacking his system jumped from 27 the day before to more than 1,000, he knew it was no minor mischief.

"By Saturday night, it was getting more intense," Eichman said. "By Sunday morning, I got up and hoped it would be gone, but it wasn't."

That Sunday, Eichman sent his findings to a security mailing list hosted by intrusion-detection project DShield.org. He described the attacks affecting servers that used the most common service on the Internet: the Web. He expected help; what he got in return was derision and sarcasm.

"You never heard about Web browsers?" wrote one person on the list. "Please get real. (That's) a Web browser, not an attack," another offered.

But Eichman was a frequent contributor to DShield, which used his logs to correlate disparate incidents on the Net in an effort to identify some sort of patterns. Because he seemed knowledgeable, he was taken seriously by Johannes Ullrich, editor of DShield and the chief technology officer of the Internet Storm Center for the System Administration Networking and Security Institute (SANS).

"The first suspicion was that there was something wrong with his firewall," Ullrich said. "But he was a longtime submitter, so we kept notifying the people" who were attacking CAS' network, he added.

On Monday, July 16, researchers got the first confirmation that Eichman was right. The immediate conclusion: It was a worm.

A worm is a program, most often malicious, that can spread from computer to computer without needing to infect files first.

One of the most infamous examples caused a password-collection program to become the Cornell Internet Worm, which spread to between 3,000 and 4,000 servers, or about 5 percent of the Internet, in November 1988. Created by then-graduate student Robert T. Morris, the worm exploited flaws in two well-known Internet services and attempted to masquerade as a legitimate user by trying passwords stolen from other systems.

Lured by the efficiency of self-propagating worms' ability to spread code widely, online vandals have begun using such worms to deface and hack servers. Starting with the Linux Ramen worm in January, a steady stream of such programs has leveraged widespread flaws in computer systems to spread across the Internet.

When Microsoft announced June 18 that a flaw had been found in the company's IIS Web server software--the software basis of nearly 6 million Web sites--it seemed only a matter of time before virus writers and vandals created a worm to attack it.

So for eEye's Maiffret, it came as no surprise when Internet hosting service Left Coast Systems reported the discovery of just such a worm a month later.

The British Columbia-based company discovered that one of its servers had been infected Friday, July 13, by a new worm exploiting the vulnerability. The company decided to directly contact eEye, the company that had found the flaw.

Maiffret immediately asked for a copy of the program to analyze, but his investigation was delayed by the weekend. The worm kept working overtime, though, infecting almost 3,600 hosts by Sunday night.

On Monday, several programmers at eEye began analyzing the code, working through the night on adrenalin fed by large amounts of "Code Red"-branded Mountain Dew, a highly caffeinated soft drink that has become a staple among the code warriors of Silicon Valley. The group dubbed the worm Code Red in honor of the drink and in wry political reference to the worm's habit of defacing Web sites with pages that read "Hacked by Chinese!"

By Tuesday morning, the bleary eEye crew had discovered how the worm worked.

A worm that already had infected a server would scan the Internet using 100 "threads," or sub-programs. When one of the threads located a vulnerable computer, the worm would infect it and begin the process all over again.

The company also discovered two important properties of the worm: Code Red defaces Web pages, and the part of the program used to generate a list of random addresses to attack had an error. Each instance of the worm, once it had infected a server, would not randomly attack the Internet but instead follow the same path as all its brethren.

Any computer attacked by the first Code Red worm would, in the end, be attacked by each of its offspring.

The error had an interesting side effect. The owner of any computer attacked by the worm could make a definitive list of compromised machines, because every infected server would eventually attack the computer. This allowed eEye and others to track the growth of the worm, though it could also allow a person with malicious intent to build a list of known vulnerable systems.

Throughout the day, eEye continued to decode the worm. By Tuesday evening, worm infections had topped 10,000.

Year of the Worm

Microsoft reveals Web server hole

"Code Red" worm claims 12,000 servers

Code Red worm set to flood Internet

Web worm targets White House

Code Red stopped--for now

Microsoft career site hacked
ZDNet

Code Red worm set to return
The Industry Standard

Vigilantes strike back at worm
Newsbytes

Hackers try to shut down White House Web site
Los Angeles Times