Computer Weekly "CW 360º", © 2001 ComputerWeekly.com Ltd
Code Red: Time for defensive
By Cliff Saran
Code Red may have been a comparative non-event, but the publicity surrounding
the worm that threatened to bring down the Net should act as a call for action
within the software developer community.
Wednesday, August 01 2001 - Estimates from the US
research group Computer Economics suggest the bill for using contracted IT staff
to patch the Microsoft server at risk, IIS, currently stands at $1.2bn (£0.84bn).
Some might wonder whether it is fair to expect users to foot the bill for
a flaw in Microsoft's software. Among the experts who spoke to CW360, the answer
was that Microsoft was not culpable; yet it continues to sell flawed software
Simon Moores, the chairman of the Microsoft Forums, told CW360 that the Internet
relies too heavily on Microsoft software. "Problems
[such as Code Red] will continue to reveal flaws in Microsoft software," he
Most commercial software is flawed, however, and Tony Lock, a senior analyst
at Bloor Research, said he could not envisage a time when software would be
DK Matai, the managing director of the security firm mi2g software,
said, "The Code Red worm vulnerability amplifies
the argument in favour of open software within large businesses." Under
such a scenario, Matai argues that users would be able to run teams of software
engineers to develop patches in real time as more and more vulnerabilities came
But it is not just commercial software products that are being targeted. Kenneth
De Speigeleire, the manager of security assessment services at the security
firm ISS, warned that hackers were moving higher up the food chain. Hackers
initially targeted operating systems, but security holes in operating systems
are well publicised and patches are readily available, forcing serious hackers
to look eslsewhere when mounting an attack.
The most serious threat envisaged by De Speigeleire is one of hackers targeting
bespoke e-commerce applications such as online banking.
Worryingly, the same type of flaw, buffer overflows that were exploited by
the Code Red worm, will occur in any type of software, according to De Speigeleire.
"If you look hard enough you will find a buffer overflow error in every application,"
In De Speigeleire's experience, a skilled hacker would be able to write a
buffer overflow hack for a bespoke e-commerce application in less than three
days. The only indication that someone was trying to hack the software would
be intrusion detection systems catching a hacker continually accessing the application.
The only way to avoid Code Red-type scares is to produce flawless software
- a feat the industry believes is impossible. However, software vendors could
write applications more defensively, assuming someone will always try to break
in, and put in place measures to prevent damage or exploitation.
Modern computer systems have enough spare processing capacity to handle this
type of software development without too much of a performance hit. But the
sheer pace of software development will lead many businesses to cut corners
and continue to deploy applications with hidden buffer overflow time bombs.
And when the software fails, everyone will have to pay the price.