Code Red Is In The HouseCode Red Is In The House

While many companies have successfully guarded their front-line Web servers, the Code Red worm has managed a rear-guard attack. Security firm TruSecure Corp. says there are reports that large companies are suffering severe internal network outages.

"The majority of internal infections are not coming in through the Internet," says Russ Cooper, editor of TruSecure's security mailing list, NTBugTraq. "They are coming in through employees connecting through notebooks or connecting via virtual private networks and infecting internally." Chances are a lot of users are running Windows 2000 Professional, he says. "It's not the place people are looking for infections."

Once Code Red gets into an internal network, it will infect systems running Internet Information Services that have not been patched. The worm's relentless scanning degrades network performance, experts say. Says Cooper, "Based on the size and number of companies reporting this, I can comfortably estimate that we are talking about 500,000 compromised internal servers."