The Code Red worm was a computer worm observed on the Internet on July 13, 2001. It attacked computers running Microsoft's IIS web server.
The Code Red worm was first discovered and researched by eEye Digital Security employees Marc Maiffret and Ryan Permeh. They named the worm Code Red because they were drinking Pepsi's Mountain Dew Code Red over the weekend they analyzed it and because of the phrase "Hacked by Chinese!" with which the worm defaced websites.
Although the worm had been released on July 13, the largest group of infected computers was seen on July 19, 2001. On this day, the number of infected hosts reached 359,000.[1]
Contents |
How it worked
Exploited vulnerability
The worm exploited a vulnerability in the indexing software distributed with IIS, described in MS01-033, for which a patch had been available a month earlier.
The worm spread itself using a common type of vulnerability known as a buffer overflow. It did this by using a long string of the repeated character 'N' to overflow a buffer, allowing the worm to execute arbitrary code and infect the machine.
Worm payload
The payload of the worm included:
- defacing the affected web site to display:
(The last sentence became a meme to indicate an online defeat)HELLO! Welcome to http://www.worm.com! Hacked By Chinese!
- trying to spread itself by looking for more IIS servers on the Internet.
- waiting 20–27 days after it was installed to launch denial of service attacks on several fixed IP addresses. The IP address of the White House web server was among those.[1]
When scanning for vulnerable machines, the worm did not test to see if the server running on a remote machine was running a vulnerable version of IIS, or even to see if it were running IIS at all. Apache access logs from this time frequently had entries such as these:[2]
- GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNN
- NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
- NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
- NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
- NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
- NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
- NNNNNNNNNNNNNNNNNNN
- %u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801
- %u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3
- %u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0
Similar worms
On August 4, 2001 Code Red II appeared. Code Red II is a variant of the original Code Red worm. Although it uses the same injection vector it has a completely different payload. It pseudo-randomly chose targets on the same or different subnets as the infected machines according to a fixed probability distribution, favoring targets on its own subnet more often than not. Additionally, it used the pattern of repeating 'X' characters instead of 'N' characters to overflow the buffer.
eEye believed that the worm originated in Makati City, Philippines (the same origin as the VBS/Loveletter (aka "ILOVEYOU") worm).
See also
References
- ^ a b Moore, David; Colleen Shannon (2001?). "The Spread of the Code-Red Worm (CRv2)". CAIDA Analysis. http://www.caida.org/research/security/code-red/coderedv2_analysis.xml. Retrieved 2006-10-03.
- ^ The worm's payload is the string following the last 'N'. A vulnerable host interprets this string as computer instructions
External links
This entry is from Wikipedia, the leading user-contributed encyclopedia. It may not have been reviewed by professional editors (see full disclaimer)
