New variant of Code Red worm found - Code Red II - the sequel
eEye who discovered the original Code Red worm which has been wreaking havoc worldwide this week said late Friday that it has identified a variant of the worm which is harder to track.
The variant of the Code Red worm has been modified in subtle but important ways that make it harder to identify and track, said eEye Digital Security Inc. chief hacking officer Marc Maiffret in a message to the Bugtraq security e-mail list. The variant worm no longer contacts hosts early in the sequence of IP (Internet Protocol) addresses that the original worm scanned, which will make the worm harder to track, Maiffret said. Also, the variant does not deface the pages of infected host systems the way the original worm did, making it more difficult to know if a system is compromised, he said. The worm does still send attack traffic to the White House Web site....
New variant of Code Red worm found
Sam Costello, IDG News ServiceBoston Bureau
The new worm has only had about 13 bytes of code changed from the original, and is employing capabilities that were always in the original worm, Maiffret said. Though the code that enables the new functions of the worm has always been there, Maiffret believes that the new worm is a rerelease of the original, rather than part of a natural progression.
The original Code Red is a worm that attacks Microsoft Corp. Internet Information Server (IIS) systems vulnerable to a certain type of buffer overflow attack discovered in mid-June [See "'Code Red' worm exploits Windows NT flaw," July 20]. The worm spreads itself by infecting a system and then running through 100 nearly random IP addresses looking for other vulnerable machines. When it finds them, it infects them and repeats the process. The worm also makes infected systems send 100k-bytes of traffic to the Whitehouse.gov Web site from July 20 to July 27.
EEye Digital Security, in Aliso Viejo, California, can be reached at
Microsoft, based in Redmond, Washington, can be reached via the Internet at
More information on the IIS Indexing Service DLL and patches that close the vulnerability are available on Microsoft's Web site at
