Code Red (2001): The Worm That Defaced Websites
While the world was captivated by the first Harry Potter movie, cybercriminals were busy launching one of the first major web server worms.
What Was Happening in the World:
The 9/11 attacks in the United States profoundly shifted global security policies, increasing focus on cybersecurity and national defense. In the meantime, the United States was preparing for military action in Afghanistan in response to terrorist threats.
Euro currency had been introduced in electronic form, changing the financial landscape in Europe.
In sports, Brazil won the Copa América 2001, and the world was preparing for the 2002 FIFA World Cup in Japan and South Korea.
Alicia Keys’s Fallin’ was the top song in the US, while Kylie Minogue’s Can’t Get You Out of My Head dominated European lists.
The Attack:
Code Red spread autonomously, exploiting buffer overflow vulnerabilities in IIS web servers. It defaced thousands of websites, replacing content with the message: "HELLO! Welcome to http://www.worm.com! Hacked By Chinese!" It also launched denial-of-service (DDoS) attacks against various targets, including the White House.
The worm infected over 350,000 servers within hours, causing millions in financial losses and disrupting critical online services.
Just like the ILOVEYOU virus, the hackers’ goal was to be recognized as such. They were not seeking financial gain or state-sponsored objectives such as industrial or political espionage, as we will see in the upcoming chapters.
How WatchGuard Would Have Stopped It:
WatchGuard’s IPS for Fireboxes and Endpoint Security products would have detected and blocked the exploit before the worm could take control of vulnerable systems.
