This weekend I have been in dialog with eEye's Marc Maiffret, lawĮnforcement agencies of the U.S. I then initiated a dialog with a number of agencies of the US government and private industry to share, confirm, and discuss my findings.įinally, coming to the conclusion that we have not seen the last of the Code Red Internet worm (by a long shot), and feeling that the reasons for this have not been adequately reported by the computer press, I wrote and forwarded the following advisory to a number of my friends in the press with whom I have corresponded in the past: On Sunday, July 29th, 2001, with August 1st looming, I set aside some time to examine the programming code of the Code Red Internet worm. NOTE The following page documents my prediction of the return of the FIRST worm, which did, as we now know, come true in spades: And since any 'infection probe' captured by a personal firewall originates from an open infected server, these 'backdoor Trojanned' systems actively advertise the availability of their backdoor across the Internet.Ĭlick here for a complete technical analysis of CodeRedIIįor further information, please see these excellent sites: This subsequently grants anyone remote access to the server's resources.

This tends to cause it to waste less time probing large dead areas of the Internet.Īnd this worm is more nasty than the first: This worm plants a 'Trojan-style Backdoor' on every infected server. The worm tends to search mostly within its own 'IP neighborhood', only occasionally sending probes out to other networks. Reports from many users indicate MUCH higher scanning rates (personal firewall logs going crazy and filling up) due to a much more clever (much less random) and aggressive second-generation IIS-searching system. Saturday, August 4th, 2001 There's a New Worm in Town:Ī new worm appeared on the Internet and began propagating using Microsoft's increasingly infamous 'Can O'Worms' IIS web servers.Ĭalling itself CodeRedII, this is a completely new worm, written from scratch and with a very different agenda and replication technology. By Steve Gibson, Gibson Research Corporation - 0

Download red worms