When officials at Carnegie Mellon University's CERT Coordination Center (CERT/CC) noticed unusual scanning activity on the Internet's port 80 - the conduit for Web traffic - in July 2001, they knew something was wrong.

They were right. A vulnerability announced a month earlier by CERT/CC and Microsoft, warning network administrators that the Indexing Service of Microsoft's IIS Web server software was susceptible to buffer overflow attacks, was being exploited by what became known as the Code Red worm.

According to CERT/CC team leader of incident handling Marty Lindner, another firm, eEye Digital Security, descrambled the malicious code to match it with the vulnerability.

Once the worm was pinpointed, CERT's incident handling team began working to release an advisory on how to defend against what would become one of the most costly viruses that year. A patch already was available but had not been installed widely enough to prevent the spread of the worm.

After that, the center's artifact analysis team studied Code Red, enabling them to recognize it again when it showed up a month later as Code Red 2, and in September as the Nimda worm.

"We cover the whole gamut," Lindner told NewsFactor.

[ Read more ]