Computer worm's second strike could slow internet

30 July 2001

The computer worm called Code Red, which infected roughly 350,000 servers on 19 July, is programmed to start spreading itself again Tuesday 31 July.

The threat posed is sufficiently high for the US government to have joined the computer industry and experts to issue an unprecedented warning.

“Code Red is likely to start spreading again on 31 July, 2001 at 2000 EDT and has mutated so that it may be even more dangerous,” reads a joint statement. “This spread has the potential to disrupt business and personal use of the internet for applications such as electronic commerce, email and entertainment.

Government organisations backing the call to arms include the Federal Computer Incidence Response Centre, the CERT Co-ordination Centre and the National Infrastructure Protection Centre. Microsoft and Internet Security Systems have also endorsed the warning. The group are stressing that vulnerable computers must be protected with the available software patch.


Taking the blame

Microsoft released the tools to repair the problem on 18 June and some industry experts say that anyone infected by the worm must take part of the blame for its spread.

“You should protect not just yourself but other people because you are part of the internet community,” Graham Cluley, of UK computer security firm Sophos told New Scientist.

The worm exploits a bug in Microsoft’s popular Internet Information Server software. It wriggles into systems without being detected because it does not remove any files. Then it overwrites any web pages held on the infected server and uses the machine to attempt to crash the White House’s web site, by sending a flood of data.

The volume of data traffic increases exponentially as the worm spreads, leading to the fears that the whole net could be slowed by a major outbreak.