Code Red worm - Definition and Overview

The Code Red worm was a computer worm released via the Internet on July 13, 2001 affecting computers running Microsoft's Internet Information Server (IIS) web server. The programmers at eEye Digital Security who reported it named it after both the Mountain Dew soft drink and the phrase "Hacked By Chinese!" (see Red Scare) that it propagated. The worm exploited a vulnerability in the indexing software distributed with IIS and did several things:

• It defaced the affected web site to display:

  "HELLO! Welcome to http://www.worm.com! Hacked By Chinese!" (The last phrase became a stock phrase)

• It tried to spread itself by looking for more IIS servers on the Internet.
• It waited 20-27 days after it was installed to launch denial of service attacks on several fixed IP addresses. The IP address of the White House web server was among those.
• It used the pattern NNNNNNNN...

On August 4, 2001, a variant of the Code Red worm, named Code Red II, appeared. It pseudo-randomly chose targets on the same or different subnets as the infected machines according to a fixed probability distribution, favoring targets on its own subnet more often than not, and it used the pattern XXXXXXXX... instead of NNNNNNNN...

See also

• eEye Code Red advisory (http://www.eeye.com/html/Research/Advisories/AL20010717.html)
• Code Red II analysis (http://www.unixwiz.net/techtips/CodeRedII.html)
• Notable computer viruses and worms