Scourge · July 19 2001

The Red Scourge of Code Red

Chronicle

Code Red exploited a buffer overflow in Microsoft IIS's indexing service and defaced pages with 'Hacked By Chinese!'. The first version appeared on 12 July 2001, but it was the CRv2 variant, with a random generator that finally worked, that exploded on 19 July: more than 359,000 hosts infected in under 14 hours, at peaks of over 2,000 new victims a minute. It was also programmed to flood whitehouse.gov.

Lesson learned

It was one of the first worm outbreaks measured almost live by CAIDA researchers, and showed that a published patch is useless until somebody installs it.

Prayer of reparation

O Code Red, named after the soda your analysts were drinking, keep your heirs away from our web servers and remind us to patch before someone turns the patch into a worm. Amen.

How it is remembered

Remembered by disabling the IIS extensions nobody needs and updating exposed servers within days, not months.