It's Back: Code Red II StrikesIt's Back: Code Red II Strikes

Businesses that neglected to patch security holes in their Microsoft 2000 and NT servers last week are feeling the effects of the most aggressive version of the Code Red worm to date, which struck this weekend. SecurityFocus' Attack Registry & Intelligence Service (ARIS) discovered rapid infections beginning late Saturday evening.

An analysis conducted by eEye Digital Security showed that while the worm uses the same method to infect servers running Microsoft's Internet Information Services software, this version packs a potentially more powerful wallop. Code Red II drops a Trojan program, which creates a "back door," or a way for the attacker to gain access to the infected server at a later date. According to Elias Levy, chief technology officer of SecurityFocus, Code Red II has a much higher attack rate. While the original Code Red worm spawned 100 scanning threads, this version spawns 300 or 600 threads, letting it locate potential servers to infect much more quickly.

Experts say the companies that have patched their Microsoft 2000 and NT servers are safe from the worm, which infected more than 135,000 systems over the weekend, but even more should be done. "Patches are effective in terms of preventing infection, but system administrators still need to remove the file or back door by using antivirus software," says Stephen Trilling, director of research at the Symantec AntiVirus Research Center (SARC).

"The most common security break-ins are through known security holes," Trilling adds. When software manufacturers develop a patch for vulnerability in their software, "they announce it to their customers as well as to all the malicious people who want to take advantage of it," Trilling says.

Gartner research director John Pescatore says he's advising his clients to put intrusion prevention software on their IIS Web servers, which he considers to be "horrible from a security perspective." Pescatore also advises his clients to address security issues regularly instead of waiting for an attack to throw them into action. "Don't rely on 'we'll do better next time'," he says. "Leave your snow tires on the Web servers all year round, because hackers don't go by seasons."