2 cissp ® Official Study Guide Eighth Edition

926
Chapter 21 
■
Malicious Code and Application Attacks
Code Red Worm
The Code Red worm received a good deal of media attention in the summer of 2001 when 
it rapidly spread among web servers running unpatched versions of Microsoft’s Internet 
Information Server (IIS). Code Red performed three malicious actions on the systems it 
penetrated:
■
It randomly selected hundreds of Internet Protocol (IP) addresses and then probed 
those addresses to see whether they were used by hosts running a vulnerable version 
of IIS. Any systems it found were quickly compromised. This greatly magnified Code 
Red’s reach because each host it infected sought many new targets.
■
It defaced HTML pages on the local web server, replacing normal content with the fol-
lowing text:
Welcome to 
http://www.worm.com!
Hacked By Chinese!
■
It planted a logic bomb that would initiate a denial-of-service attack against the IP 
address 198.137.240.91, which at that time belonged to the web server hosting the 
White House’s home page. Quick-thinking government web administrators changed 
the White House’s IP address before the attack actually began.
The destructive power of worms poses an extreme risk to the modern internet. System 
administrators simply must ensure that they apply appropriate security patches to their 
internet-connected systems as software vendors release them. As a case in point, a security 
fix for an IIS vulnerability exploited by Code Red was available from Microsoft for more 
than a month before the worm attacked the internet. Had security administrators applied it 
promptly, Code Red would have been a miserable failure.
rTM and the Internet Worm
In November 1988, a young computer science student named Robert Tappan Morris 
brought the fledgling internet to its knees with a few lines of computer code. He released 
a malicious worm he claimed to have created as an experiment onto the internet. It 
spread quickly and crashed a large number of systems.
This worm spread by exploiting four specific security holes in the Unix operating system.