Code Red: the worm that infected 359,000 servers within 14 hours

On July 19, 2001, a worm called Code Red infected 359,104 computers in less than 14 hours. A worm is a program that copies itself from one computer to the next on its own, without anyone clicking on anything. Code Red used a flaw in IIS, Microsoft’s web server software, a month after Microsoft had published a fix for it.

How it worked

IIS came with an add-on for Microsoft’s indexing service, which makes files searchable. This add-on copied part of the requested web address into a memory area of fixed size, called a buffer, without checking the length. A request with a very long address overflowed the buffer, and the extra data could contain program code. The server ran that code before any login check. Because the add-on ran with the highest rights in Windows, the attacker’s code took full control of the server.

Windows 2000 Server installed IIS by default, and the faulty add-on could be reached whenever IIS was running, even if nobody used the indexing service.

Code Red carried its whole program, about 4 KB, inside a single request. Each infected server sent this request to random internet addresses on port 80, the standard network port for websites, at about 11 attempts per second. The first version, active from July 12, 2001, spread slowly, because every copy tried the same addresses in the same order. The second version, from July 19, picked different addresses on every server and spread far faster. It changed web pages on infected servers to show the words “Hacked by Chinese”. At midnight UTC, it was programmed to stop spreading and to start an attack: from the 20th of each month, it flooded a White House website with traffic.

Reach and damage

The spread was measured by CAIDA, an internet research center at the University of California San Diego. CAIDA records the traffic that arrives at large blocks of internet addresses, which infected servers hit by chance while they searched for new victims. By the end of July 19 (UTC), it had counted 359,104 infected computers by their internet addresses, and it treats this number as a lower bound. At the peak, more than 2,000 computers were infected every minute. A later study that compared Code Red with SQL Slammer gives its doubling time as about 37 minutes: the time in which the number of infected computers doubled.

Not only large companies were hit. From the network names of the infected computers, CAIDA estimated that 21 % were home and small-business machines. The worm also reached 136 computers with .mil addresses and 213 with .gov addresses, which belong to the US military and to US government agencies.

The cost is harder to pin down. The firm Computer Economics estimated that the epidemic, including later versions of Code Red, cost more than USD 2.6 billion. CAIDA’s study quotes this figure; it is an estimate, not a measurement.

The fix and the response

The security firm eEye Digital Security had reported the flaw to Microsoft. On June 18, 2001, eEye published its findings, and Microsoft released a fix in its security bulletin MS01-033. When the worm appeared, eEye analyzed it on July 13 and gave it its name. A month after the fix, Code Red still found hundreds of thousands of servers without it.

Patching remained slow after the outbreak. CAIDA checked a daily sample of 10,000 of the computers infected on July 19. Between July 24 and July 31, the share of patched machines grew by an average of only 1.5 percentage points a day.

On August 1, Code Red began to spread again. By midnight, about 275,000 internet addresses were spreading the worm, and 29,710 computers were newly infected in the hour after 14:00 UTC alone. Only then did the share of patched machines in CAIDA’s sample rise markedly, from 32 % to 64 %.

On August 4, a different worm, CodeRedII, began to use the same flaw. It was not a new version of Code Red: it installed a backdoor, a hidden way back into the server, and preferred to attack addresses close to its own.

By August 14, the share of patched computers differed by type of network: