Whale Communications Stops Latest Code Red Worm In Its Tracks

Whale Communications® today announced that its e-Gap System prevents, out of the box, the latest and more malicious variant of the Code Red worm which leaves organizations servers wide-open to hackers.

The e-Gap System filters out improper and unexpected URLs, allowing only valid and expected requests to reach the web server, thereby blocking by default both the original Code Red worm and the latest variant (both utilize invalid URLs). In addition, the rules stating which requests are allowed to reach the server are based on the positive logic of an application rather than on simply trying to disallow all illegal transactions. Therefore, if someone were to send an illegitimate request to the web server (e.g., by typing an illegal URL), the e-Gap System would simply discard it, before the request could reach the real web server.

“By not letting through requests that do not conform to the RFC standards for URLs, the e-Gap System ensures that Code Red II Worm has no chance of slithering through,” said Joseph Steinberg, Whale’s director of technical services. “Since the original Code Red worm was released, our customers have shown us logs showing numerous attempts by Code Red to penetrate their systems, and of course, the e-Gap blocked the attacks every time.”

To see a failed attack in action, check Whale’s 90-second self-running viewlet at the following link: http://www.whalecommunications.com/coderedworm.html?p=pr1

Like the original Code Red worm, the latest variant uses the same buffer-overflow vulnerability in un-patched Microsoft IIS web servers to squirm its way in. It exploits an idq.dll (Internet Data Queries file) that IIS installs by default to give extended functionality. The idq.dll file contains an unchecked buffer in a section of code that handles input URLs. Unlike the original worm, Code Red II creates a trojan copy of explorer.exe and allows hackers to gain total remote control of infected web servers. Also, after the worm has infected a server merely patching and rebooting will not clean the system as it did with the original Code Red worm. Windows 2000 systems running un-patched IIS web servers are reportedly vulnerable to the worm.

Utilizing Air Gap technology, the e-Gap System’s application-level inspection is handled in a secure zone, physically disconnected from the outside world. The e-Gap System acts as the gatekeeper to this secure zone, shuttling transactions between the outside world and the web server in real time, while maintaining an air gap between them. Because the HTTP filtering takes place in the secure zone, even sophisticated hackers cannot bypass or disable the inspection mechanisms that keep the web servers safe. There is no network path from the Internet to the machines enforcing the security policies.