'Code Red' worm attack blunted as users take action
The Code Red worm continued its attack on the Internet on Thursday, infecting about 5,000 new computers an hour, but its assault was blunted by people applying protective patches to their vulnerable computers, experts said.
"It's continuing to infect systems at a steady rate, about 5,000 per hour," said Alan Paller of the System Administration, Networking and Security (SANS) Institute. "But something is causing the number of scans to go down." Internet Security Systems reported on Thursday that people had downloaded more than 2 million copies of the patch.
After spreading quickly on Wednesday morning, the worm seemed to level off a bit in the afternoon, Paller noted. "The worm ran out of food because enough (computers) had been patched."......
By Elinor Mills Abreu and Deborah Zabarenko, Reuters
There were an estimated 267,600 infected computers by late afternoon Thursday, compared to more than 280,000 when the worm spread in mid-July, according to SANS.
But only 100,000 to 170,000 of those were believed to be still scanning and looking for other victims because they've been patched, Paller said. Rebooting the computer kills the worm on infected computers and applying a free software patch prevents future infection.
SANS was sending the numeric Internet addresses of the computers that are continuing to attack to the Internet service providers that serve them, Paller said.
"We're asking them to please get in touch with them and ask them to patch them or cut them off," he said.
After spreading quickly on Wednesday morning, the worm seemed to level off a bit in the afternoon, Paller noted. "The worm ran out of food because enough (computers) had been patched."
TWO MILLION PATCHES DOWNLOADED
The patch for computers running Microsoft Corp.'s Windows NT and 2000 operating systems as well as its IIS software can be downloaded from various sites, with instructions at (http://www.digitalisland.net/codered). Computers running Windows 95, 98 and ME are not vulnerable.
Internet Security Systems reported on Thursday that people had downloaded more than 2 million copies of the patch.
But Paller warned against complacency.
"If we stop, the worm wins," Paller said in a telephone interview from Bethesda, Maryland. "Right now, we've got even with it and we've got to get the rest of the machines patched."
Meanwhile, the worm was not causing any measurable impact on Web performance, said Bill Jones, a spokesman for Keynote Systems, which monitors web performance for popular sites. However, Jones said the firm is worried that users of dial-up or digital subscriber lines could see some slowdown on Monday.
"We're closely monitoring broadband and dial-up because the Mom and Pop type operations have few resources to put on patches," he said. "Thus infected machines on the back streets of the Internet, the smaller segments, could see some degradation."
Paller warned of a side effect of the worm. Some undisclosed Web sites had to be taken offline because of routers and systems that were halted or overloaded by the worm, he said.
Jeff Reed of the Pittsburgh-based U.S. Computer Emergency Response Team (CERT), said in an e-mail at 9:30 a.m. EDT (1330 EDT) his team was "cautiously optimistic that the impact of the infection stage of this particular variant of the Code Red worm, which we will call Version 2, has been minimized."
Click here to continue reading this article at Total Telecom
