Nimda: the worm that infected 160,000 computers in 7 hours

On September 18, 2001, shortly before 12:00 UTC, a worm called Nimda began to spread around the world. Seven hours later, 160,000 computers were infected, according to the internet research center CAIDA. A worm is a program that copies itself from one computer to the next on its own. Nimda used five routes at once: e-mail, infected websites, shared network folders, two flaws in IIS, Microsoft’s web server software, and backdoors left by CodeRedII. That worm had used the same flaw as Code Red. Microsoft had fixed every flaw Nimda used months before.

How it worked

The CERT Coordination Center (CERT/CC), a US center for security incidents, described the worm on the day of the outbreak. Nimda arrived by e-mail as an attachment called readme.exe, labeled as a sound file. Mail programs such as Outlook Express use Internet Explorer to display e-mails written in HTML, the language of web pages. In Internet Explorer 5.01 and 5.5, a flaw made the browser run such a mislabeled attachment on its own. Just seeing the message in the preview pane was enough. Microsoft had fixed this flaw on March 29, 2001.

Once running, Nimda mailed itself to the addresses it found on the computer, and again every 10 days. Every infected computer, including ordinary desktop PCs, also searched the internet for IIS servers. Half of the addresses it tried shared the first two of the four numbers of its own address. So the worm favored its own neighborhood. Once one e-mail had passed a company’s firewall, the machines behind it were likely targets.

On each server, Nimda first looked for the backdoors of CodeRedII and of an older worm called sadmind/IIS. Then it tried two directory traversal flaws. A web server should only hand out files from its web folder. It should block requests that contain “..”, which means “one folder up”. IIS could be fooled by writing these characters in an unusual form. In the older flaw, they were written with special Unicode characters. In the newer one, they were encoded twice, because IIS decoded the request a second time after its security check. This let the worm run commands on the server and make it download a copy of the worm.

On a server it had taken over, Nimda added a short JavaScript program to every web page. Visitors with an unpatched Internet Explorer could then be infected just by viewing the page. It also copied itself into every folder it could write to, including shared network folders. It shared the C: drive and created a Guest account with administrator rights.

Reach and damage

Nimda had a large target: in the survey of the firm Netcraft for September 2001, Microsoft’s web server software ran 27.46 % of all websites, 8,895,343 sites. Only Apache ran more.

CAIDA, at the University of California San Diego, counted the computers it saw spreading Nimda in steps of 15 minutes. The infection peaked around 19:00 UTC with 160,000 infected computers. By midnight UTC, CAIDA had seen 450,000 different internet addresses trying to spread the worm. An address is not always one computer, so this is not an exact count of machines.

Researchers at the Lawrence Berkeley National Laboratory, a US research lab, measured the probes for IIS servers. Within half an hour, they rose from almost none to nearly 100 per second.

The worm’s traffic did harm of its own. CERT/CC received reports of denial of service caused by the scanning and the e-mails. According to CAIDA, some networks were so flooded by their own infected machines that their links to the internet were saturated. The firm Computer Economics estimated the worldwide economic impact of Nimda at USD 635 million, less than a quarter of its estimate for Code Red. This is an estimate, not a measurement. The sources document no outage of critical services such as hospitals or power supplies.

The fix and the response

When Nimda appeared, all its flaws were known. Microsoft warned of the older IIS flaw on October 17, 2000, and a patch from August 2000 already fixed it. The fix for Internet Explorer followed on March 29, 2001. The fix for the newer IIS flaw came on May 14, 2001, 127 days before the outbreak. On August 15, 2001, Microsoft released MS01-044, a cumulative patch that contained all these IIS fixes. Servers infected by CodeRedII in August kept its backdoor unless they had been cleaned up.

For infected servers, CERT/CC gave blunt advice: “The only safe way to recover from the system compromise is to format the system drive(s) and reinstall the system software from trusted media.” Nimda had changed web pages and programs and created a new account, so removing the worm was not enough.

Infected machines also fell silent faster than after Code Red. Less than 24 hours after Nimda began to infect large numbers of computers, half of the infected machines no longer spread it. After Code Red and CodeRedII, this had taken 11 days. According to CAIDA, part of the reason was that machines were cut off rather than cleaned. Organizations disconnected themselves, and internet providers cut off infected customers or blocked web traffic.

Nimda did not disappear. In the months after the outbreak, the Berkeley lab confirmed attacks from 63,000 different Nimda hosts. Its researchers note that this may be an undercount, because they only counted the attacks on web servers.

Two weeks after the outbreak, Microsoft announced an “unprecedented mobilization” of its staff, with free virus-related support and a tool to lock down IIS. The announcement does not name Nimda. Microsoft later wrote that Code Red and Nimda led some customers to rethink their use of IIS.

Which flaw counts as the main one

Nimda used three flaws with a CVE number: two in IIS, one in Internet Explorer. Here, the newer IIS flaw, CVE-2001-0333, counts as the main one. Through it, every infected computer attacked web servers without help from anyone. It also worked on more servers than the older one. Microsoft’s fix for it contained the older fix, but Windows 2000 Service Pack 2 contained only the older one. No measurement shows how many computers each route infected. The National Vulnerability Database rates all three flaws 7.5 out of 10 on CVSS 2.0, so the choice does not change the score.