Code Red Worm

Code Red (CodeRed) is a computer worm that affected MS ISS web servers back in the early 2000s. At the peak of its popularity, it affected nearly half a million host systems.

Code Red uses a simple but effective vulnerability of older ISS web servers. the worm causes a buffer overflow by using a particularly long string of symbols, the netter N in this case, to overflow the software buffer. This, in turn, allows the malware to execute the arbitrary code it needs and spread further, while defacing the host in the process.

Servers who were infected by the Code Red worm had their pages replaced with the following text:

HELLO! Welcome to http://www dot worm dot com! Hacked By Chinese!

The worm was also set up in a way which allowed it to perform different tasks depending on the day of the month, obtained from the victim's system clock. On the first 19 days of each month, Code Red would try to propagate itself to new systems, searching for more ISS servers online. During the days between the 20th and the 27th, the worm would launch DoS attacks on a number of predetermined web servers, including that of the White House. On the last few days of each month, Code Red would do nothing.

A short while after Code Red was first spotted and figured out, a second version appeared, with different strings of instructions in its payload and with a long string of X symbols instead of N ones to trigger the buffer overflow.