Network Security Principles and Practices

Case Study: The Code Red Worm and NBAR

Code Red is a worm that spreads by attacking Microsoft IIS WWW servers and installing a Trojan in the compromised systems. After a system has become infected, it tries to infect other systems by trying to install Trojans on those systems as well. Although an attacker can use the back door to get access to a compromised system, the compromised systems themselves carry a program that stages attacks on certain web sites (such as whitehouse.org) by all infected hosts at the same time. The details of the attacks can vary from version to version of the virus.

The URL www.caida.org/analysis/security/code-red/ has a detailed analysis of the Code Red worm and its functionality.

The Code Red worm is spread and exploited ...