The Tech Industry Rescue Squad

Thursday, 17 October 2002, 1:25 PM EST

When officials at Carnegie Mellon University's CERT Coordination Center (CERT/CC) noticed unusual scanning activity on the Internet's port 80 - the conduit for Web traffic - in July 2001, they knew something was wrong.

They were right. A vulnerability announced a month earlier by CERT/CC and Microsoft, warning network administrators that the Indexing Service of Microsoft's IIS Web server software was susceptible to buffer overflow attacks, was being exploited by what became known as the Code Red worm.

According to CERT/CC team leader of incident handling Marty Lindner, another firm, eEye Digital Security, descrambled the malicious code to match it with the vulnerability.

Once the worm was pinpointed, CERT's incident handling team began working to release an advisory on how to defend against what would become one of the most costly viruses that year. A patch already was available but had not been installed widely enough to prevent the spread of the worm.

After that, the center's artifact analysis team studied Code Red, enabling them to recognize it again when it showed up a month later as Code Red 2, and in September as the Nimda worm.

"We cover the whole gamut," Lindner told NewsFactor.

[ Read more ]




Spotlight

Windows 0-day exploited in ongoing attacks, temporary workarounds offered

Posted on 22 October 2014.  |  A new Windows zero-day vulnerability is being actively exploited in the wild and is primarily a risk to users on servers and workstations that open documents with embedded OLE objects.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Thu, Oct 23rd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //