White House escapes 'Code Red' attack

July 23, 2001

Admins of the White House Web site escaped an Internet worm's denial-of-service (DoS) attack by switching the numerical address of the site to an alternate Internet address.

So-called Code Red worm is a new worm that is spreading quickly over the Net. As previously reported, the worm is designed specifically to compromise computers running Microsoft's Web server software. Each server infected by the Code Red worm was scheduled to send 100KB of junk data to Whitehouse.gov as part of an apparent DoS attack. Now there are at least 225,000 computers infected by the worm.

Even Microsoft, which recently issued a patch to prevent the Code Red from infecting computers using its Web server software, failed to protect all of its servers. So Microsoft's own Windows Update site has fallen victim to the the worm.

Until July 20, the Code Red is programmed to spread to new servers, according to security experts analysis. From July 20 to July 28, the worm will attack the now-outdated address for the White House Web site.

It is strongly recommended that you update your system immediately with the Microsoft patch:
http://www.microsoft.com/technet/security/bulletin/MS01-033.asp

After downloading the appropriate patch for your system take the system offline, reboot it and apply the patch.

If you do not patch your systems till Aug. 1, your server could be reinfected with the worm, starting the whole process over again.