The summer of 2001 essentially saw a
new era in internet security with three major
worm outbreaks. These three major worms were
Code Red One, version two, Code Red Two,
and Nimda. Let's take a quick look at each of these worms. Code Red 1
was released on July 13th, 2001, and was
the first modern worm. It exploited a buffer
overflow in Microsoft's IIS server. From the
1st through the 20th of each month, it
would spread By finding new targets using a random scan of IP address space, it
would spawn 99 new threads, which generated
IP addresses at random and then looked for
vulnerable instances of IIS. Now version 2
Of code red one, was actually released six
days later and fixed that random scanning bug.
So that each instance of the worm scanned
a different part of IP address space. After
the scanning bug was fixed, the worm was able
to compromise 350000 vulnerable hosts in a matter of only
14 hours. By most estimates, that was the complete set of hosts
running the vulnerable version of IAS. On the entire internet. The payload
of this worm was to mount a denial of
service attack on whitehouse.gov. But a bug in the
coding, caused the worm to die, on the 20th
of each month. If the victims clock was wrong however,
the worm would actually resurrect itself. On the 1st.
Fortunately in this case, the payload which launched the
denial of service attack on whitehouse.gov actually was launched
at a particular IP address, not at the domain name.
So the operators of the website needed only
to move the web server to another IP address
to defend against the denial of service attack.
A better worm design would have been much more
catastrophic. Code Red 2 exploited the same vulnerability
but had a completely different payload, it was released
on August 4th, 2001, and was called Code
Red2 mainly because of a comment in the code.
The worm actually only spread on Windows
2000, it actually crashed on Windows NT.
The scan actually preferred nearby addresses It
would choose addresses from the same /8
with probability one half from the same
/16 with probability three eighths, and randomly
from the entire internet with the remaining
one eighth probability. The reason for preferring nearby
IP addresses is that if there was one vulnerable host on the network. There was
likely to be more, because the same
administrator that failed to patch the compromised machine
might have other machines on the same
network that were also vulnerable. This notion of
preferential scanning can speed up infections in some
cases by increasing the probability that scanning will
find another vulnerable host. The payload of this worm was an IIS
backdoor, and the worm was completely dead, by design, by October 1,
2001. Nimda released on September 18, 2001
and was interesting mostly because it spread using
multiple propagation vectors. It was effectively multi-model. So in addition
to using the same IIS vulnerability as Code Red 1 and Code Red 2, there were
some additional vectors that it used. It could
spread by bulk email as an attachment. It copied
itself across open network shares. It installed an
exploit code on webpages on the corresponding web
server running on the machine, so that any
browser that visited the webpage for that server would
become infected itself and it would scan for the Code Red 2 backdoors that
that worm had installed. The interesting thing
about the multi-modal nature of the Nimda worm
is that signature based defences don't necessarily
help, because of the many ways that it
could spread, for example, by email or
via a website exploit, Nimda actually needs firewalls.
Most of the firewalls pass the email carrying
Nimda completely untouched, using brand new infection with
an unknown signature, and those scanners couldn't detect
it. This was the first instance of a worm
that exploited what we would call a zero
day attack which is when a worm first appears
in the wild. And the signature of the
worm is not extracted until minutes, or hours later.
Zero day attacks are particularly viralent because the
worm can spread extremely quickly, before any type
of signature-based antivirus has a chance to catch
up and prevent the infections in the first place.