Worm:W32/CodeRed.II

CodeRed II is a rewritten version of the original Code Red worm. It uses the same IIS hole to gain access on the web server and then continues to find new vulnerable systems.

Interestingly, Code Red II has been programmed to spread more aggressively in China than anywhere else. This might be in relation to the Chinese references in the original worm.

Backdoor

The most important feature of Code Red II is that it installs a backdoor into systems it infects. This is accomplished by copying the standard Windows NT/2000 command interpreter "cmd.exe" into web server's "scripts" directory. As a result, any web surfer can now execute commands on any infected www site just by typing suitable URLs to the web location. Below, a 'DIR' directory listing command has been executed.

Propagation

When a host gets infected it starts to scan for other hosts to infect. It probes random IP addresses but the code is designed so that probing of neighbour hosts is more probable.

If the infected system has the language set to Chinese the worm starts more aggressive scanning (600 threads instead of 300). The scanning runs for 24 hours after the infection (48 for Chinese machines) and then the system is rebooted.

There is a time limit in the code that will stop the worm on the 1st of October. At that time it will reboot the machine and stop spreading. The installed trojan still remains in the system! The worm drops a trojan program to '\explorer.exe' that modifies different some IIS settings to allow a remote attack of the infected host. The standard command interpreter 'cmd.exe' is copied to '\inetpub\scripts\root.exe' and to '\progra~1\common~1\system\MSADC\root.exe'. The worm creates these files to both 'C:' and 'D:' drives if they exist. These copies of the 'cmd.exe' will allow any attacker to execute commands on the remote system really easily.

Installation

First of all it disables the System File Checker (SFC) functionality in Windows. SFC is responsible for checking the integrity of system files.

Two new root directories are added to the IIS configuration: '/c' that points to 'c:\' and '/d' that points to 'd:\'.

This makes sure that even if the copies of 'cmd.exe' the worm made are removed the system can still be compromised.

Registry Changes

The following changes are made:

• 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable'

is set to 0xffffff9d that disables the System File Checker. ',217' is appended to these keys:

• 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\Scripts'
• 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\MSADC'

These keys make 'C:' and 'D:' accessible trough the webserver:

• 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\C'
• 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\C'

Note

The backdoor components that the worm drops into infected system are detected by F-Secure Anti-Virus with updates released at August 5th, 2001.