Emergency talks as Code Red rears its head

The US Government and security groups held an emergency conference yesterday at the International Trade Centre to address the threat posed by the Code Red worm. The worm is poised to remerge from its dormant state to infect more machines in the UK at 2am Wednesday morning.

A number of respected industry organisations, including Cert, the Sans Institute and the National infrastructure Protection Centre, met yesterday to advise organisations to take immediate action to respond to the threat.

Those present at the security conference warned that "it is very likely that the resulting distributed denial of service could impact businesses and home users as the internet slows down dramatically".

Security firm ISS, which was also present at the conference, said that "most system administrators and users will not even know they have been compromised".

According to ISS, the Code Red worm infected more than 250,000 systems in just nine hours on 19 July. It infects systems by exploiting a buffer overflow in Windows NT 4 and 2000 servers, before using these machines as a launch pad to attack more servers.

"This uncontrolled growth in scanning directly decreases the speed of the internet and can cause sporadic but widespread outages among all types of systems," said ISS.

It is also believed that the worm has mutated "so that it may be even more dangerous".

To harden vulnerable servers against this attack Microsoft has released patches which are available here for Windows NT and here for 2000.

An advisory on the flaw is also available from Microsoft, here.