South African Internet service provider Internet Solutions (IS) was attacked by the CodeRed worm on Thursday night, resulting in several hours of network problems for the company.
According to a statement from Derek Wilcocks, joint-MD of IS, the worm caused a distributed denial of service attack that extended across the globe.
"IS picked up the attack early on Thursday evening and immediately started discussions with its upstream bandwidth providers to put in place mechanisms to stop the worm from replicating itself and to block the denial of service traffic itself," says Wilcocks in a press statement released late Friday.
"This prompt action minimised the impact of the attack as much as possible although unusually high loads and subsequent congestion was experienced on the IS network for several hours on Thursday evening."
The CodeRed worm targets systems running unpatched Microsoft Index Server and MS IIS Web server on Windows NT 4.0 or Windows 2000. The worm causes a buffer overflow in the IDQ.dll file through a HTTP request.
The worm does not write itself to disk, but rather injects itself directly into memory. It attempts to replicate itself to other vulnerable servers, and on certain dates runs a denial of service attack on www.whitehouse.gov`s IP address, which has been changed.
After two hours it returns its own HTML to Web requests, containing the text: "Welcome to http:// www.worm.com ! Hacked By Chinese!". After 10 hours this hook is removed.
Information regarding the patch necessary to stop the CodeRed worm is available from Microsoft at http://www.microsoft.com/technet/security/bulletin/MS01-033.asp.
Related stories:
Code Red Worm can be killed by reboot
Share
