Code-Red: a case study on the spread and victims of an internet worm

ABSTRACT

On July 19, 2001, more than 359,000 computers connected to the Internet were infected with the Code-Red (CRv2) worm in less than 14 hours. The cost of this epidemic, including subsequent strains of Code-Red, is estimated to be in excess of $2.6 billion. Despite the global damage caused by this attack, there have been few serious attempts to characterize the spread of the worm, partly due to the challenge of collecting global information about worms. Using a technique that enables global detection of worm spread, we collected and analyzed data over a period of 45 days beginning July 2nd, 2001 to determine the characteristics of the spread of Code-Red throughout the Internet.In this paper, we describe the methodology we use to trace the spread of Code-Red, and then describe the results of our trace analyses. We first detail the spread of the Code-Red and CodeRedII worms in terms of infection and deactivation rates. Even without being optimized for spread of infection, Code-Red infection rates peaked at over 2,000 hosts per minute. We then examine the properties of the infected host population, including geographic location, weekly and diurnal time effects, top-level domains, and ISPs. We demonstrate that the worm was an international event, infection activity exhibited time-of-day effects, and found that, although most attention focused on large corporations, the Code-Red worm primarily preyed upon home and small business users. We also qualified the effects of DHCP on measurements of infected hosts and determined that IP addresses are not an accurate measure of the spread of a worm on timescales longer than 24 hours. Finally, the experience of the Code-Red worm demonstrates that wide-spread vulnerabilities in Internet hosts can be exploited quickly and dramatically, and that techniques other than host patching are required to mitigate Internet worms.

REFERENCES

• 1: E. Spafford, "The internet worm: Crisis and aftermath," 1989.
• 2: Charles Schmidt and Tom Darby, "The Morris Internet Worm," Tech. Rep., http://www.software.com.pl/newarchive/misc/Worm/darbyt/pages/history.html.
• 3: John F. Shoch , Jon A. Hupp, The “worm” programs—early experience with a distributed computation, Communications of the ACM, v.25 n.3, p.172-180, March 1982 [doi>10.1145/358453.358455]
• 4: CERT Coordination Center, "CERT Advisory CA-1989-04 WANK Worm On SPAN Network," http://www.cert.org/advisories/CA-1989-04.html.
• 5: Max Vision, "Ramen Internet Worm Analysis," http://www.whitehats.com/library/worms/ramen/.
• 6: SANS Global Incident Analysis Center, "Lion Worm," http://www.sans.org/y2k/lion.htm.
• 7: Computer Economics, "2001 economic impact of malicious code attacks," http://www.computereconomics.com/cei/press/pr92101.html.
• 8: eEye Digital Security, "Advisories and Alerts: AD20010618," http://www.eeye.com/html/Research/Advisories/AD20010618.html.
• 9: Microsoft, "A Very Real and Present Threat to the Internet," http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/topics/codealrt.asp.
• 10: eEye Digital Security, "Advisories and Alerts: .ida "Code Red" Worm," July 2001, http://www.eeye.com/html/Research/Advisories/AL20010717.html.
• 11: Silicon Defense, "Code Red Analysis page," http://www.silicondefense.com/cr/.
• 12: Cisco Systems, Inc, "Cisco Security Advisory: "Code Red" Worm - Customer Impact," http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.shtml.
• 13: eEye Digital Security, "CodeRedlI Worm Analysis," August 2001, http://www.eeye.com/html/Research/Advisories/AL20010804.html.
• 14: SecurityFocus, "SecurityFocus Code Red II Information Headquarters," http://aris.securityfocus.com/alerts/codered2/.
• 15: "Cisco NetFlow," http://www.cisco.com/warp/public/732/netflow/.
• 16: Vern Paxson, Bro: a system for detecting network intruders in real-time, Computer Networks: The International Journal of Computer and Telecommunications Networking, v.31 n.23-24, p.2435-2463, Dec. 1999 [doi>10.1016/S1389-1286(99)00112-7]
• 17: eEye Digital Security, "eEye Code Red analysis, commented disassembly, full IDA database, and binary of the worm;" http://www.eeye.com/html/advisories/codered.zip.
• 18: Ixiacom IxMapping, "Ixmapping," http://www.ipmapper.com.
• 19: David Moore, Geoffrey M. Voelker, and Stefan Savage, "Inferring Internet Denial-of-Service Activity," Usenix Security Symposium, 2001.
• 20: Dug Song and Rob Malan and Robert Stone, "A Snapshot of Global Internet Worm Activity," http://research.arbor.net/up_media/up_files/snapshot_worm_activity_f.ps.
• 21: Netsizer, "Evaluating the size of the internet," http://www.netsizer.com.

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Invasive software (e.g., viruses, worms, Trojan horses)

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.3 Network Operations
          Subjects: Network management
      C.2.5 Local and Wide-Area Networks
          Subjects: Internet (e.g., TCP/IP)

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Invasive software (e.g., viruses, worms, Trojan horses)

General Terms:
Management, Measurement, Performance

Keywords:
Code-Red, Code-RedI, CodeRedI, CodeRedII, backscatter, epidemiology, security, virus, worm