1.0 Description

1.1 Overview

Further to the previous attack of the self-propagating malicious code, "Code Red", a few security organizations analysis of this code has concluded the behaviour of the infected machines when their system clocks roll over to the next month.

There is evidence by CERT/CC that tens of thousands of systems are already infected or vulnerable to re-infection at that time. Because the worm propagates very quickly, it is likely that nearly all vulnerable systems will be compromised by August 2, 2001.

Thus we would advice and urge all respective parties to take security measures to ensure all your systems are patched and secured.

1.2 Systems Affected

1. Microsoft Windows NT 4.0 with IIS 4.0 or IIS 5.0 enabled and Index Server 2.0 installed
2. Windows 2000 with IIS 4.0 or IIS 5.0 enabled and Indexing services installed
3. Cisco CallManager, Unity Server, uOne, ICS7750, Building Broadband Service Manager (these systems run IIS)
4. Unpatched Cisco 600 series DSL routers

2.0 Technical Matters

According to CERT/CC, at least two major variants of the worm, each of which exhibits the following pattern of behaviour:

1. Propagation mode (from the 1st - 19th of the month): The infected host will attempt to connect to TCP port 80 of randomly chosen IP addresses in order to further propagate the worm. Depending on the configuration of the host that receives this request, there are varied consequences.

   How it infects:
   Unpatched IIS 4.0 and 5.0 servers with Indexing service installed will almost certainly be compromised by the "Code Red" worm.

   Unpatched Cisco 600-series DSL routers will process the HTTP request and trigger an unrelated vulnerability that causes the router to stop forwarding packets.

   Systems not running IIS, but with an HTTP server listening on TCP port 80 will probably accept the HTTP request, return with an "HTTP 400 Bad Request" message, and potentially log this request in an access log.

2. Flood mode (from the 20th - 27th of the month): A packet-flooding denial-of-service attack will be launched against a specific IP address embedded in the code.

3. Termination (after the 27th day): The worm remains in memory but is otherwise inactive.

3.0 Possible Steps

3.1 Applying the latest patches

Step by Step patch installation and recovery is made available at http://www.digitalisland.net/codered/ provided by SANS via Digital Island which includes:

1. Identifying if your host is vulnerable.

2. Download the patch from Microsoft.

   Windows NT version 4.0:
   http://www.microsoft.com/Downloads/Release.asp?ReleaseID=30833

   Windows 2000 Professional, Server and Advanced Server:
   http://www.microsoft.com/Downloads/Release.asp?ReleaseID=30800

3. Install the patch.

4. Rebooting the system to clear the worm from RAM.

   MyCERT strongly recommends the removal of the ida and idq files for systems which does not require such services.

   Cisco patches available at:
   http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.shtml

3.2 Ingress filtering

Ingress filtering manages the flow of traffic as it enters a network under your administrative control. With "Code Red," ingress filtering will prevent instances of the worm outside of your network from infecting machines in the local network that are not explicitly authorized to provide public web services.

3.3 Egress filtering

Egress filtering manages the flow of traffic as it leaves a network under your administrative control. In the case of "Code Red," employing egress filtering will prevent compromised IIS servers on your network from further propagating the worm.

3.4 Updating IDS Signatures

Those using IDS and Firewalls are advised to update your signature files and firewall rules to ensure that your system will detect and block such traffic.

In order to properly secure your web server, MyCERT recommends you the following sites:

For Windows NT 4.0, IIS 4.0:
http://www.microsoft.com/technet/itsolutions/security/tools/iischk.asp

For Windows 2000, IIS 5.0:
http://www.microsoft.com/technet/itsolutions/security/tools/iis5chk.asp

4.0 More Information

To obtain more information on this rootkit, please refer to the following site:

4.1 CERT Advisory
http://www.cert.org/advisories/CA-2001-23.html

4.2 Detailed technical analysis of the "Code Red" worm can be found at:
http://www.cert.org/advisories/CA-2001-19.html

4.3 Cisco advisory
http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.shtml

4.4 Microsoft Corporation
http://www.microsoft.com/technet/security/bulletin/MS01-033.asp