⬇ Download holy card: ·
The Demon Code Red, Defacer of IIS
Legend
In July 2001 a memory-resident worm found a buffer overflow in the IIS Indexing Service extension, idq.dll, and in under fourteen hours infected more than 350,000 servers. It defaced web pages with a boastful message and, on fixed dates, aimed all its zombies at the White House website, which escaped by changing its address. Its younger sibling, Code Red II, also left a backdoor behind.
Exorcism
Cast it out by patching internet-facing web servers at once, like MS01-033, which was already available. Remove ISAPI extensions and handlers nobody uses, and watch outbound traffic: a server suddenly knocking on half the world's doors is not doing its job.