Code Red
loresecurityweb dev
The July 2001 IIS worm that defaced sites with 'Hacked By Chinese!' and infected hundreds of thousands of servers in hours.
Code Red exploited a buffer overflow in Microsoft IIS, spread with no file on disk, defaced English-language sites, and pointed a coordinated flood at the White House's address. CAIDA measured more than 359,000 infected hosts in under fourteen hours, the first hard data on how fast an Internet worm could really move. The eEye researchers who dissected it named it after the Code Red flavor of Mountain Dew they were drinking.
Code Red spread through a buffer overflow in Microsoft's web server in July 2001, defaced pages with a message, and was programmed to launch a denial of service attack against a fixed IP address belonging to the White House. The address was changed before the attack date, which blunted it.
Its interesting property was that it lived in memory only and left nothing on disk, so a reboot cleaned an infected machine, which then usually became reinfected within minutes because the underlying flaw was still there. That produced a peculiar dynamic where the population appeared to fluctuate rather than grow, and where administrators believed they had fixed something they had merely interrupted.
The hardcoded target is the part worth remembering. Malware that names a specific fixed destination is trivially defended against once discovered, and the lesson attackers took was to use dynamic target selection, which is why later families use algorithmically generated domains and peer-to-peer coordination. Defensive success against one generation is reliably an education for the next, which is the pattern of the whole field.