« The Worm that won't die | Main | Htaccess Tutorial Part 3 released »

Code Red Part 3: Backdooring your IIS machine

Yet another variant of Code Red worm has come
out that not only exploits you but backdoors
your webserver. It creates a file called root.exe
which is really a copy of your cmd.exe file. This
will allow a attacker to execute commands on your
machine with complete control. This can also allow
people to commit large scale ddos attacks with ease.

It is VERY IMPORTANT to patch if you haven't already.
Please visit the links below for some further information.

theregister.co.uk
Incidents.org
Code Red Request log examples(Look at attack signatures)

Comments

Feed You can follow this conversation by subscribing to the comment feed for this post.


All Comments are Moderated and will be delayed!


Post a comment

Verify your Comment

Previewing your Comment

This is only a preview. Your comment has not yet been posted.

Working...
Your comment could not be posted. Error type:
Your comment has been saved. Comments are moderated and will not appear until approved by the author. Post another comment

The letters and numbers you entered did not match the image. Please try again.

As a final step before posting your comment, enter the letters and numbers you see in the image below. This prevents automated programs from posting comments.

Having trouble reading this image? View an alternate.

Working...







Remember personal info?