F-Secure warns: Code Red is not dead
Helsinki-Finland, August 1, 2001 – F-Secure Corporation (HEX: FSC) is alerting computer users worldwide that the Code Red worm is starting up again. As has been widely reported in the media, the Code Red web worm started spreading again at 00:01 on the 1st of August. Immediately after midnight, roughly 150 infected web servers were identified.
By 12:00 GMT, 12 hours after the new propagation cycle started, no visible effects of the worm could be seen. The number of infected machines was about 4000 web servers and the rate of new infections remained low. By this time the whole Code Red alert by FBI and other US government organizations was largely dismissed as a false alarm.
However, by 15:00 GMT, 15 hours after the infections restarted, the situation was getting rapidly worse. The worm had gone worldwide again, infecting vulnerable web sites at an increasing rate. The number of infected servers almost doubled every hour, and has passed 20,000 infected machines. This trend will probably continue.
The worm has been programmed to spread only during the first 20 days of every month. As the widespread July infections started on the 19th of the month, the worm stopped spreading by itself almost as soon as it had become widespread. This time it won’t. It will continue to spread for almost three weeks and might spread much more widely than in July, when it infected around 300,000 servers.
“Whether Code Red will continue to spread at these rates is difficult to tell. It’s also very difficult to estimate if the worm will cause real slowdowns for Internet users,” comments Mikko Hypponen, Manager of Anti-Virus Research at F-Secure. “In any case, Code Red is not dead.”
Code Red continues to target WWW servers running an unsecure version of the IIS web server software. A patch to fix this problem is available from Microsoft.
More information on the Code Red worm is available at http://www.f-secure.com/v-descs/bady.shtml —
About F-Secure Corporation
F-Secure Corporation is a leading provider of centrally managed security for today’s mobile, wireless enterprise. The company offers a full range of award-winning, integrated anti-virus, file encryption, distributed firewall and VPN solutions for workstations, servers, gateways and mobile devices. F-Secure products are uniquely suited for delivery of Security as a ServiceTM which provides invisible, reliable, always-on, and up-to-date security for the most widely distributed user base. Whether provided by corporate IT or delivered by service providers, F-Secure solutions extend policy-based security and instant alerts to all devices where information is created, stored or accessed. Founded in 1988, F-Secure Corporation is listed on the Helsinki Stock Exchange [HEX: FSC]. The company is headquartered in Helsinki, Finland with North American headquarters in San Jose, California, as well as offices worldwide.