Microsoft's own Windows Update site has fallen victim to the Code Red worm.
As previously reported, the Code Red worm attacks what's now called the .ida vulnerability, an unchecked buffer in the IIS Indexing Service ISAPI filter, which, if exploited, can yield system-level access to an intruder.
The fact that the Windows Update site, which provides a portal to product updates and security patches along with advice on critical updates, wasn't itself up to date with the latest security patches is richly ironic.
Security experts at MIS Corporate Defence warned that because the bug allows system level access, the possibility that links on the site had been changed to point to maliciously crafted updates (possibly containing Trojans) needed to be ruled out. Whether Microsoft carried out such an audit before putting the site live again remains unclear.
A patch to guard against the .ida vulnerability has been available for over a month but the spread of the worm indicates sys admins have not woken up to the problem, even after the release of an attack script was released on 21 June by Japanese hacker HighSpeed Junkie.
The Code Red worm, which first appeared on 13 July, defaces Web sites with the message: "Welcome to http://www.worm.com! Hacked by Chinese!" and will periodically send 100KB of junk data to Whitehouse.gov as part of an apparent denial of service attack. The worm sets itself up on the infected system and creates 99 other 'threads' which provide a means for it to spread itself to other Web servers.
A flood of the White House Web site was due to begin last night but the site's admins have switched the numerical address of the site and seem to be on top of the problem. Unfortunately the same can not be said of other members of the Internet community and a large number of infections have been reported worldwide.
Some estimates suggest 225,000 machines have been infected, which is way over the top, but there's no doubt that infection is widespread
The FBI's National Infrastructure Protection Centre has issued an alert on the virus which describes it as a significant threat that could "degrade services running on the Internet".
Code Red is not saved as a file, but injected and executed directly from memory. Patching the security hole in the system and rebooting will remove the worm and prevent further infection. ®
IIS worm made to packet Whitehouse.gov
IIS buffer-overrun attack has been scripted
MS hacked once, twice, three, FOUR times
MS confronts another IIS system-level hole
Yet another IIS exploit reported
Microsoft IIS hole gives System-level access