On July 13, 2001, a worm began propagating across the internet by exploiting a buffer overflow in Microsoft's Internet Information Services (IIS) web server. Within 19 hours of initial activation on July 19, Code Red had infected approximately 359,000 machines. The worm defaced websites with the message "HACKED BY CHINESE!" and, in some variants, launched a distributed denial-of-service attack against the White House's IP address. It caused an estimated $2 billion in damage.

Code Red was not the first internet worm - the Morris Worm predated it by thirteen years - but it demonstrated something the security community had been warning about: that a single critical vulnerability in widely-deployed server software could produce an internet-scale incident within hours, and that the speed of worm propagation would outpace any human response capability. The window between Code Red's vulnerability disclosure and the worm's deployment was 27 days. Most of those 359,000 servers had been given 27 days to patch and had not.

The Vulnerability: IIS Buffer Overflow

The Code Red worm exploited CVE-2001-0500, a stack buffer overflow in the Index Server component of IIS 4.0 and 5.0. The vulnerable component was the .ida (Internet Data Administration) ISAPI extension - a component that handled searches against IIS-hosted content. Microsoft had released a patch for this vulnerability on June 18, 2001, exactly 27 days before Code Red began its rapid spread phase on July 19.

The overflow was triggered by sending an HTTP GET request with an excessively long .ida query string. IIS copied this string into a fixed-size stack buffer without bounds checking, overwriting the return address with attacker-controlled data. The worm's shellcode then executed at IIS process privilege - typically running as LocalSystem on Windows 2000, which meant full administrative access to the machine.

[TECHNICAL NOTE]
Code Red's buffer overflow exploitation was notable for its reliability. The worm exploited a simple stack buffer overflow with no heap grooming, no information leak for ASLR bypass, and no complex gadget chain - because Windows 2000 in 2001 had none of those mitigations. There was no Data Execution Prevention (DEP/NX), no Address Space Layout Randomization (ASLR), no stack canaries. The attacker controlled the stack return address directly and the shellcode executed from the stack. This was the default Windows condition in 2001: raw memory corruption was directly exploitable. The Code Red incident was one of the arguments cited in the eventual deployment of DEP (Windows XP SP2, 2004) and the gradual development of ASLR (Vista, 2007) - security features that didn't arrive until three to six years after Code Red demonstrated what their absence enabled. The exploit required no credentials, no prior access, and no user interaction - just an HTTP request to port 80. Any internet-accessible IIS server was vulnerable from the moment the worm began scanning.

Propagation: 359,000 Machines in 19 Hours

Code Red's spread was driven by its scanning methodology. Each infected host generated 99 threads: 99 simultaneous scanning threads probing random IP addresses for vulnerable IIS servers on port 80. This produced a roughly exponential growth curve - early phase limited by the number of infected hosts, later phase limited by the total population of vulnerable servers. The worm's scanning rate was aggressive enough that network operators noticed anomalous ICMP and TCP traffic patterns in transit networks before many administrators had detected infections.

The worm's behavior was time-triggered. Between the 1st and 19th of each month, Code Red scanned and propagated. Between the 20th and 27th, it launched DDoS attacks against fixed target IP addresses including the White House website at 198.137.240.91. The White House changed its IP address in response to the threatened attack. After the 27th of the month, it entered a dormant phase. This monthly cycle meant Code Red effectively reactivated itself each month as long as infected machines remained unpatched.

[WARNING]
The Code Red attack on the White House website was the first time a worm had been designed to use its infected fleet as a DDoS weapon against a specific government target, and it created significant public attention around the intersection of cybersecurity and national security. The White House pre-emptively changed its IP address before the DDoS phase activated - a defensive measure that worked for that specific worm but illustrated how perimeter defenses were limited against a threat that operated from within the internet itself. The incident accelerated the creation of CERT/CC's reporting infrastructure and prompted the first White House-level engagement with internet security as a national security issue. The FBI and NIPC (National Infrastructure Protection Center) opened an investigation. No individual was ever charged with releasing Code Red; its origin remains officially unknown though some analysis suggested East Asian origination based on code characteristics. The geopolitical framing of the website defacement message ("HACKED BY CHINESE!") was never resolved as to whether it reflected the author's actual identity or was a deliberate misdirection.

Code Red II and the Backdoor Variant

Approximately two weeks after the original Code Red, a second variant appeared that shared the same IIS vulnerability but had significantly different behavior. Code Red II dropped a backdoor (a root.exe shell) on infected systems, creating persistent unauthorized access. Where the original Code Red used infected machines primarily for scanning and DDoS, Code Red II created a persistent foothold on hundreds of thousands of IIS servers that remained exploitable for follow-on attacks.

Code Red II was written separately from the original worm - it was not an evolution by the original author but an independent author exploiting the same vulnerability with different objectives. The existence of two separate worms exploiting the same vulnerability within weeks of each other demonstrated that once a reliable exploit existed for a widely-deployed service, multiple threat actors would use it near-simultaneously. This "vulnerability pile-on" dynamic had been theorized but Code Red was among the first clear demonstrations of it at scale.

The Patching Gap

The 27-day interval between Microsoft's patch release and Code Red's major outbreak encapsulated what would become one of the persistent structural problems of internet security: the gap between vulnerability disclosure and enterprise patching. In 2001, many organizations had no formal patch management process. IIS servers were often deployed, connected to the internet, and then largely left unmanaged. The absence of automatic updates for server software (Windows Update in 2001 was focused on desktop Windows) meant administrator action was required for every security patch.

Code Red and its contemporaries (Nimda followed six weeks later, also targeting IIS) were significant factors in Microsoft's internal security reckoning that produced the Trustworthy Computing initiative in 2002 - Bill Gates's memo that initiated the security review of all Windows products and eventually produced Windows XP SP2's security improvements, automatic updates, the Windows Security Center, and the beginning of Microsoft's shift from treating security as a feature to treating it as a foundational requirement.

[IOC]
Code Red worm technical summary: first detection July 13, 2001; major spread phase July 19, 2001 (199 million bytes of network traffic per hour at peak). Vulnerability: CVE-2001-0500, buffer overflow in IIS Index Server ISAPI extension (.ida files), IIS 4.0 and 5.0. Affected OS: Windows NT 4.0, Windows 2000 with IIS enabled. Patch release: Microsoft MS01-033, June 18, 2001 (27 days before peak spread). Propagation: 99 scanning threads per infected host, random IP address probing on TCP port 80. Infection count: approximately 359,000 unique IP addresses in 19 hours (eEye Digital Security measurement). Website defacement: "Welcome to http://www.worm.com! Hacked By Chinese!" on infected hosts' default web pages, limited to first 100 infected connections. DDoS target: White House website at 198.137.240.91 (changed proactively by White House). Damage estimate: $2 billion in cleanup and lost productivity. Code Red II: second variant, different author, same vulnerability, dropped root.exe backdoor shell instead of DDoS payload; more persistent damage footprint. Legacy: contributed to Microsoft Trustworthy Computing initiative (January 2002), eventual deployment of DEP in XP SP2 (2004), and the development of automated patch management tooling. No criminal charges filed. Origin officially undetermined.