'Code Red' Worm Sparks Concern in Government, Business

The government is warning America about the worldwide Red Threat — not the specter of communism, but the "Code Red" computer worm, which could slow down or cause outages on the Internet.

"The Internet has become indispensable to our national security and economic well-being," Ron Dick, head of the National Infrastructure Protection Center, an arm of the FBI, said Sunday. "Worms like Code Red pose a distinct threat to the Internet."

The worm defaces Web sites with the words "Hacked by Chinese." While it doesn't destroy data, it could be modified to do so. At least two mutations have already been found.

"Code Red" was considered serious enough to warrant unprecedented government publicity, including its own federal news conference Monday with Microsoft Corp. officials. There are also various warnings on government Web sites.

While the actual infection rate is unknown, it is believed to be in the hundreds of thousands of Internet-connected computers. In just the first nine hours of its July 19 outbreak, it infected more than 250,000 systems.

The government-funded Computer Emergency Response Team said the worm is predicted to start spreading again Tuesday at 8 p.m. EDT.

"This spread has the potential to disrupt business and personal use of the Internet for applications such as electronic commerce, e-mail and entertainment," a CERT advisory warns.

Officials are frustrated that even though a software inoculation was made available over a month before the worm's first attack, many computers are still defenseless. The patch, which will protect computers, can be found on Microsoft's Web site.

Click here to download the patch.

Code Red exploits a flaw discovered in June in Microsoft's Internet Information Services software used on Internet servers. It is found in Windows NT and Windows 2000 operating systems.

Only computers set to use the English language will have their Web pages defaced, while users of Windows 95, Windows 98 or Windows Me are not affected. For the first 20 days of every month, the worm spreads. From the 20th on, it attacks the White House Web site, trying to knock it offline.

The White House took precautions against it, changing its numerical Internet address to dodge the attack.

Even though the target has moved, the infected computers will still launch their attack. This, officials said, could slow down the Internet and cause sporadic but widespread outages.

Last week, the Pentagon was forced to shut down public access to all of its Web sites temporarily to purge and protect them from the Code Red worm.

Because Code Red spread so quickly, security companies have not been able to figure out who wrote and released it.

Code Red also can damage smaller networks by affecting a certain type of Internet routers, made by Cisco Systems, used for data traffic control.

The Associated Press contributed to this report