The Tech Industry Rescue Squad

Thursday, 17 October 2002, 1:25 PM EST

When officials at Carnegie Mellon University's CERT Coordination Center (CERT/CC) noticed unusual scanning activity on the Internet's port 80 - the conduit for Web traffic - in July 2001, they knew something was wrong.

They were right. A vulnerability announced a month earlier by CERT/CC and Microsoft, warning network administrators that the Indexing Service of Microsoft's IIS Web server software was susceptible to buffer overflow attacks, was being exploited by what became known as the Code Red worm.

According to CERT/CC team leader of incident handling Marty Lindner, another firm, eEye Digital Security, descrambled the malicious code to match it with the vulnerability.

Once the worm was pinpointed, CERT's incident handling team began working to release an advisory on how to defend against what would become one of the most costly viruses that year. A patch already was available but had not been installed widely enough to prevent the spread of the worm.

After that, the center's artifact analysis team studied Code Red, enabling them to recognize it again when it showed up a month later as Code Red 2, and in September as the Nimda worm.

"We cover the whole gamut," Lindner told NewsFactor.

[ Read more ]


Pen-testing drone searches for unsecured devices

You're sitting in an office, and you send a print job to the main office printer. You see or hear a drone flying outside your window. Next thing you know, the printer buzzes to life and, after spitting out your print job, it continues to work and presents you with more filled pages than you expected.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Oct 9th