eEye Digital Security has published a comprehensive technical breakdown of the "Code Red" .ida worm, providing the community with the disassembly and logic needed to understand this devastating IIS exploit. The analysis, performed by Ryan "Shellcode Ninja" Permeh and Marc Maiffret, reveals that the worm’s primary propagation mechanism relies on a buffer overflow in the Indexing Service ISAPI filter, a vulnerability eEye had disclosed weeks prior. Despite the availability of Microsoft’s MS01-033 patch, the worm infected at least 12,000 hosts, highlighting a critical failure in enterprise patch management practices.

Propagation and Thread Management

The worm’s architecture is surprisingly complex for a script kiddie payload. Upon infection, the malware spawns exactly 100 threads. Ninety-nine of these threads are dedicated to propagation, generating random IP addresses to attack. However, the analysis notes a critical flaw in the randomization algorithm: the worm uses a static seed. This means every infected system scans the exact same sequence of IP addresses, leading to redundant infections and massive network congestion rather than efficient spread. The 100th thread handles the defacement logic, checking if the system language is English (US) before modifying the web server’s output.

Memory Hooking and Defacement

Code Red does not simply write a new HTML file to disk. Instead, it employs memory hooking to intercept the TcpSockSend function within w3svc.dll. By using VirtualProtect to make the DLL’s memory writable, the worm replaces the function pointer with its own code. This technique allows the worm to serve a fake "Hacked by Chinese!" webpage directly from memory for ten hours. Once the timer expires, the worm restores the original memory state and re-protects the DLL, leaving minimal forensic traces on the disk. This in-memory execution model made detection via standard file integrity monitoring nearly impossible.

The White House DDoS Trigger

Beyond defacement, the worm contains a timed denial-of-service component. Each thread checks the system clock; if the time falls between 20:00 and 23:59 UTC, the thread shifts focus from propagation to attacking www.whitehouse.gov (IP 198.137.240.91). The attack consists of sending 100KB of data to port 80 in a loop, with a sleep interval of approximately 4.5 hours between bursts. This coordinated timing meant that as the worm spread globally, the cumulative effect of thousands of infected servers launching simultaneous requests threatened to cripple the White House’s web presence during peak hours.

Key Takeaways

  • The worm’s static IP seed caused inefficient spread and network saturation due to redundant scanning.
  • Defacement was achieved via memory hooking of w3svc.dll, not file modification, evading simple disk scans.
  • A built-in c:\notworm file check allowed administrators to manually stop propagation on infected machines.
  • The DDoS component was time-gated to UTC 20:00-23:59, targeting www.whitehouse.gov specifically.

The Bottom Line

Code Red is a masterclass in how poorly patched infrastructure amplifies simple exploits. The worm’s technical elegance in memory manipulation contrasts sharply with the operational failure that allowed 12,000 servers to remain vulnerable despite a known patch. For builders and ops teams, this is a stark reminder: security is not just about code, but about the discipline of deployment.