Code Red OP-ED

Code Red -- My two cents

By: madirish

Well, now that Code Red has broken the mainstream media, and all of a sudden all my friends suddenly understand all my
frustration at work ("Hey Madirish, weren't you bitching about Code Red like three weeks ago when nobody knew what it
was?"), I think its time to add my two cents to the media storm surrounding the worm. First of all let me say that I am sickened
by the media reporting on the worm (a.k.a. Virus). You'd think reporters would take the time to check their facts, and given the
volume of analysis online this shouldn't have been much of a problem. But I'm sure reporters bitch about tech geeks in much the
same fashion, so I'll leave off for now.

The most interesting aspect of Code Red is that it can't be blamed on (l)users. You'll notice a particular absence of sysadmin complaints about user incompetence and how user ignorance is always the cause of the spread of these types of malicious programs. This time its the admins who are at fault. Nobody seems to be making much of this in the reporting the worm is receiving. Since Code Red only attacks servers, only admins can be responsible for stopping the attacks. That said, I must issue a hearty "What the hell are you admins doing with your days, browsing porn and downloading MP3's?!? Come on!!!". You may notice some anger there, well that?s because due to other sysadmin's incompetence, responsible sysadmins are being flooded by HTTP attacks throughout the day (the latest figure I heard was 3 Code Red probes an hour is the average for most systems). And for crying out loud, its not like this exploit came out of the blue, there's been a patch since JUNE!!! That?s JUNE, almost 3 months ago!

The only reason I can think that this situation exists is because either: there are sysadmins out there who don't subscribe to BugTraq, don't get Microsoft Security Updates, and/or don't patch their system regularly (no excuse since Microsoft has a handy website for this purpose (http://update.microsoft.com), -or- there are systems out there that simply don't have administrators. I'd guess the guilty parties are split between the two groups.

To take issue with the first group (lazy/incompetent sysadmins) I'd like to say, if you thought you were too busy to patch your system BEFORE you got infected, bet you've got more free time now that you have to pull your server offline, eliminate the virus, install the patch, and reboot and reconnect. Although I'll bet a lot of sysadmins aren't even doing this since they don't feel Code Red causes their systems any damage. First of all that?s sort of like allowing termites that only eat up your neighbors house to live under yours, you make a nuisance of yourself in the neighborhood. Second of all, I think these folks thoroughly deserve whatever nastiness creeps down the pipe in the form of Code Red variants to chew up their systems. I'm sure there are also sysadmins out there that are so ignorant of their systems as to not even realize they are infected. If so, they shouldn't be administering a network or system. Network administration is a tough job, and a lot of responsibility, if you can't do the job correctly, you shouldn't have it. Given today?s job market, I'm sure these folks won't last long anyways.

The second group isn't surprising either. Microsoft has made a tough gamble by making their software so easy to use. Because MS is so point and click user friendly any moron can set up a Microsoft NT/2000 server, and many do. Most of these folks plug servers into their network and leave them alone, never bothering to learn how they work, or how to protect them. Its a sad state of affairs, but I know it exists. These are most likely the smaller companies that can't afford a full time sysadmin and had the secretary's brother set up the server, or maybe someone in the company did it. Well, its time for a hard lesson in security. Security is a tough field to justify because if a security administrator does their job, nothing will happen. Its hard to justify a salary for someone who makes nothing happen. But to do without could be disastrous. Even if you can't afford to have a full time sysadmin, at least shell out the money to have a qualified professional set up your server, or even pay for consultants to come in and do a security audit. This usually shouldn't be too expensive, and its a wise investment.

Now, if you eliminate companies without sysadmins, and companies or organizations with lazy or incompetent sysadmins, you should be left with the a group consisting of companies with strong sysadmins, and the big guys, who should have enough money and sense to be on top of things. But wait? Didn't the US Military pull almost all of its servers offline during the initial round of infection? I'll leave you with that, and remember if you're a US citizen this should make for some sleepless nights...

1.) Code Red
OP-ED - madirish
2.)
An Introduction to the SirCam Virus - Manic Velocity
3.) Hardening
your Windows 2000 Server - madirish
4.) End of the
gravy train - Dinesh Nair
5.) Intro to
hacking routers and other nifty bits - octet
6.) Broadband
in Malaysia: A hard look at your options - L33tdawg