CISSP Training Guide

Case Study: CodeRed

SCENARIO

ESSENCE OF THE CASE The following points are the essence of the case: Microsoft has a vulnerability in its Web server software. Three worms were written that exploited this vulnerability. The worms spread by using commonly permitted traffic types, SMTP, HTTP, and TFTP to locate and infect other systems. The worms would deface legitimate Web sites. The worms would launch a DoS attack against a certain IP address. The worms would further expose systems by opening administrative access on the systems using the guest account. Due to the nature of the replication pattern, the worms could act as a DoS against network infrastructure equipment, particularly routers.

In the late summer and early fall of 2001 there was a series ...