The Tech Industry Rescue Squad

Thursday, 17 October 2002, 1:25 PM EST

When officials at Carnegie Mellon University's CERT Coordination Center (CERT/CC) noticed unusual scanning activity on the Internet's port 80 - the conduit for Web traffic - in July 2001, they knew something was wrong.

They were right. A vulnerability announced a month earlier by CERT/CC and Microsoft, warning network administrators that the Indexing Service of Microsoft's IIS Web server software was susceptible to buffer overflow attacks, was being exploited by what became known as the Code Red worm.

According to CERT/CC team leader of incident handling Marty Lindner, another firm, eEye Digital Security, descrambled the malicious code to match it with the vulnerability.

Once the worm was pinpointed, CERT's incident handling team began working to release an advisory on how to defend against what would become one of the most costly viruses that year. A patch already was available but had not been installed widely enough to prevent the spread of the worm.

After that, the center's artifact analysis team studied Code Red, enabling them to recognize it again when it showed up a month later as Code Red 2, and in September as the Nimda worm.

"We cover the whole gamut," Lindner told NewsFactor.

[ Read more ]


101,000 US taxpayers affected by automated attack on IRS app

The IRS has revealed more details about an attack it suffered last month, mounted by unknown individuals with the aim to file fraudulent tax returns and funnel the returned money to their own bank accounts.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Wed, Feb 10th