Microsoft Releases Code Red Cleanup
To undo the effects of an Internet worm that may have burrowed into hundreds of thousands of computers, Microsoft has released a new tool, Code Red Cleanup. Available from the Microsoft Web site, the small utility is designed to "eliminate the obvious effects of the Code Red II worm" from infected Web servers, according to the company.
First identified over the weekend, Code Red II exploits a recently identified weakness in Microsoft's Internet Information Server (IIS) software on Windows 2000 and Windows NT4 systems. The worm installs a "back door" on infected machines that allows attackers to remotely control them. The worm attempts to spread by scanning the Internet address space for other vulnerable servers.
In addition to eradicating malicious files installed by the worm, Code Red Cleanup reboots the system to eliminate memory-resident code. The tool also removes special settings known as "mappings" installed by the worm. Finally, the utility provides an option to permanently disable IIS on the server.
The cleanup tool does not install the patch released by Microsoft in June to correct the buffer-overflow bug in its Web server software.
While it can eliminate all traces of the Code Red II worm from an infected system, security experts and Microsoft warn that Code Red Cleanup may lull administrators into a false sense of security.
According to Simple Nomad, a security expert with Bindview Corporation's RAZOR team, the Microsoft utility does not eliminate the other malicious programs that might have been loaded on an infected system using the back door created by Code Red II.
"People right this second are manually scanning for these openings and uploading even more malicious code. I am surprised secondary worms to take advantage of these wide-open machines are not already running," said Simple Nomad.
According to the Computer Emergency Response Team (CERT) at Carnegie Mellon University, the best way to recover from system-level compromises such as a Code Red II infection is to reformat the drive, re-install software and apply appropriate security patches.
In its description of Code Red Cleanup, Microsoft acknowledges that the tool "does not eliminate any additional damage that other attacks may have caused while your server was infected." The company advises operators of Internet-connected servers to rebuild the infected systems from scratch, as well as any other servers at risk because of their proximity to the infected machines.
The release of Code Red Cleanup by Microsoft late Tuesday follows a public request from security experts for a way to swiftly protect infected systems and block the further spread of Code Red II.
On Sunday, Elias Levy, chief technology officer for SecurityFocus.com, posted a blueprint for such a tool on a security mailing list. Although not a perfect solution, such a tool was required, according to Levy, because many system administrators are unlikely to rebuild their systems and apply the patch.
"It's good to give them an easy option that at the very least closes the hole and hope that the machine had not yet been found by an attacker and modified further," wrote Levy, whose blueprint for the tool included installing the June Microsoft patch.
Despite Microsoft's quick response in releasing the tool, security experts remain concerned that many operators still may not even get around to cleaning up and patching their infected systems, much less taking them down and rebuilding them.
"I fear that most of the systems that are still unpatched may not get patched until the next service pack or even OS upgrade. If, after all this, people are still unaware of what's happening, then they simply are not paying attention or don't care," said Christopher Paul, a security consultant at Dedicated Technologies, an information technology consulting firm, who has been analyzing Code Red and its successors.
Microsoft's description of Code Red Cleanup is at http://www.microsoft.com/technet/itsolutions/security/tools/redfix.asp .
CERT's advisory on Code Red II is at http://www.cert.org/incident_notes/IN-2001-09.html .
