01 August 2001

Internet Security Agency Warns of "Code Red" Worm

The National Infrastructure Protection Center (NIPC) reported August 1 that the potentially damaging Code Red Internet worm began infiltrating the world's electronics communications system at 0001 GMT August 1.

The NIPC reports that the situation is still very fluid, and recommends that users of vulnerable Microsoft programs and servers still act to download protective software.

The NIPC was one member of a broad coalition of government and private communications organizations that warned the public several days before the anticipated outbreak to be on alert and act to stop Code Red. The rogue program of unknown origin attacks Microsoft IIS Web servers lacking the protective software "patch," propagates itself, searches addresses for other vulnerable equipment and infects new systems.

This continuous cycle of propagation and infection can cause widespread Internet slowdowns for all users.

The "Code Red" Worm was first detected in July when an estimated 275,000 systems were affected. Security experts anticipated that the damage could be greater in this outbreak.

The patch for the Windows NT version 4.0 can be downloaded at: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=30833

In order to protect the Windows 2000 Professional, Server and Advanced Server, users should download the patch at: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=30800

Further information about Internet security is available at http://www.nipc.gov and at http://www.cert.org/

A detailed description of how the Code Red Worm works is available at http://xforce.iss.net/alerts/advise89.php

Following is the text of the NIPC advisory.

National Infrastructure Protection Center

www.nipc.gov

For Immediate Release August 1, 2001

Code Red Update -- The Worm Has Gone Active

Washington, DC -- Government and industry officials continue to monitor activity of the Code Red Worm estimated to have started its journey through the Internet last night at 8pm EDT. Those who have not installed the free Microsoft patches to their systems are still urged to do so quickly. Applying the patch will still protect users from infection.

Data analysis this morning confirms that previous predictions were correct that the Code Red Worm has in fact gone active. Early reports of activity spanning the entire globe, including the United States, indicate that the worm has gone active and is presently spreading throughout the Internet. As it was the case in July with its early progression, the worm's potential is still unknown at this time. Further updates will be given throughout the day. We are hopeful that the many precautions taken by the public, the government and private industry will have some effect on its ability to propagate.

We appreciate the participation of all who have cooperated so far to address this significant threat to the Internet. We especially want to thank the media for their quick response and vigilant coverage. Microsoft, thus far, reports that over a million people have avoided the Code Red Worm by downloading and applying the free patch available from Microsoft's website. In the meantime, both government and industry Watch Centers are on full alert to follow progress of the worm throughout the day, and we will report any significant developments.

end text