Code Red Worm: Mountain Dew, 359,000 Servers and a White House Siege

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

The Code Red worm was released on July 13, 2001, and by July 19 it had hijacked about 359,000 computers running Microsoft's Internet Information Services, with heavy damage across North America, Europe, China and India. Researchers Marc Maiffret and Ryan Permeh at eEye Digital Security dissected it, building on Riley Hassell's discovery of the underlying flaw, and named it after the Mountain Dew Code Red they were drinking. The worm exploited a buffer overflow documented in Microsoft Security Bulletin MS01-033, sending a long string of the letter N to overwrite memory and run its own command. A patch had been available for a full month before the outbreak.

Infected sites showed the message "hacked by Chinese," but the defacement hid a calendar-driven payload. From day 1 to 19 of each month the worm spread, from day 20 to 27 every infected machine launched a denial-of-service attack on the IP address of the White House web server, and from day 28 to month's end it slept. Kenneth D. Eichman found a way to block its spread and was invited to the White House. On August 4, 2001, Code Red II appeared, using the same IIS hole with a string of X characters and favoring targets on its own subnet, so it spread inside corporate networks behind firewalls.

• Apache servers logged floods of N requests but could not be infected because they lacked the IIS memory flaw.
• Code Red became the first large-scale mixed threat attack to hit enterprise networks, combining self-propagation with a denial-of-service payload.
• The eEye researchers believed Code Red II originated in Makati in the Philippines, the same origin as the ILOVEYOU worm.
• IT departments of the era delayed patches for weeks because updates often broke custom enterprise software.
• The episode credits Code Red with forcing the industry to treat patching as mandatory rather than optional.