Home User Threat

It has been more than a year since the Code Red and Nimda worms rocketed around the globe infecting millions of servers running Microsoft's Internet Information Server (IIS).

By Paul Roberts

November 08, 2002 — CSO — It has been more than a year since the Code Red and Nimda worms rocketed around the globe infecting millions of servers running Microsoft's Internet Information Server (IIS). But while Microsoft quickly issued a patch to close the security hole that Code Red exploited, hundreds of unpatched and infected hosts can still be found on the public Internet. It's a problem that raises a vexing question: what to do when those responsible for maintaining Internet hardware shirk their responsibility?

"There are a significant number of servers worldwide that have no security at all," says Mikko Hyppönen, manager of antivirus research at Helsinki, Finland-based F-Secure.

The most chronically infected culprits, according to Hyppönen, are servers belonging to home users. Many of these individuals have no knowledge of how to manage a public Web server and may not even know they are hosting a Web server on their desktop or laptop.

For Web server administrators with secure systems, those infected machines may come to feel like old friendsdistant IP addresses that show up in server access logs every few weeks in their never-ending quest around the globe for new Internet hosts to infect.

But, Hyppönen points out, those infected machines also pose a significant risk to the entire public Internet. Infected machines, by definition, contain open doors that malicious hackers can use to distribute their own viruses, or to launch denial-of-service attacks on targeted websites.

One solution, suggests Hyppönen, may be for outsiders to fix the holes themselvesusing the same security hole exploited by the worm or virus.

Simple enough. The catch? Cleaning up a virus on an infected machine that doesn't belong to you still qualifies as an unauthorized electronic intrusion onto somebody else's property. It's a violation of both U.S. and international law that can carry stiff monetary penalties and even jail time.

To tackle this problem, Hyppönen advocates the creation of an international body with the authority to intervene and fix infected machines. "It would be like an Internet policeyou'd need a warrant," he says.

Read more about data protection in CSOonline's Data Protection section.

Other stories by Paul Roberts

• Print