July 13: Searchlights on Port 80

Show Notes

Code Red turned a patched Microsoft IIS flaw into one of the early web’s defining infrastructure scares. What began as strange packet logs on Friday the 13th became a self-spreading worm that used a vulnerable Index Server component to seize Windows web servers with Local System privileges, then made each infected machine hunt for the next. The result was a glimpse of the internet as a living weather system: office servers, university boxes, and small-business machines suddenly moving together under hostile code. The episode follows the frantic overnight analysis by eEye researchers, the caffeine-and-disassembly origin of the worm’s name, and the crude “Hacked by Chinese!” defacement that fueled speculation without proving attribution. More than vandalism, Code Red exposed the permanent gap between disclosure and patching: Microsoft had already warned users and released a fix, but enough servers remained open for the worm to map the web’s neglect in real time. Read the original article: https://medium.com/@dia_91230/july-13-searchlights-on-port-80-1dffce97ddd3 Subscribe to The Dead Internet Almanac: https://buttondown.com/dead-internet-almanac

What is Dead Internet Almanac?

Old games, dead platforms, forgotten memes, vanished websites, and the strange little artifacts that somehow survived.

The log line looked like a machine coughing up a necklace of capital Ns.

On Friday, July thirteenth, two thousand one, two network administrators sent packet logs to eEye Digital Security. Their servers were being hammered through a newly discovered hole in Microsoft’s web-server software. Marc Maiffret later wrote that the researchers worked through the night, trying to understand the thing moving through the wires.

By morning, the worm had a soda-can name, a crude slogan, and a target that made it sound larger than routine vandalism.

The old web was full of machines that felt local. A company web server in a closet. A university box under somebody’s desk. A home or small-business connection that mostly existed so a page could answer on port eighty.

Code Red made those machines look like weather.

The worm targeted Microsoft Internet Information Services, better known as I-I-S, the Windows web server behind a large share of public websites. The weak point was not a glamorous front door. It was a component called I-D-Q dot D-L-L, part of the Index Server and Indexing Service software that handled certain web requests.

Microsoft had warned on June eighteenth that an unchecked buffer in that component could allow an attacker to run code on an affected server with Local System privileges.

That last phrase is the part that matters. Local System was not a guest pass. It was the machine handing over the keys.

A worm does not need a bored person to click an attachment. Once it reaches one vulnerable host, it looks for the next host by itself.

Code Red carried its body inside the exploit traffic. It reached out to I-I-S servers and tried to make every newly infected machine join the search. According to eEye’s analysis, the worm created one hundred threads. Most hunted for more servers. One checked whether the infected system should display the defacement page.

For anyone outside security, this is where the story turns from patch note to haunted infrastructure.

The bug had been public for weeks. The patch existed. The worm still found enough unpatched servers to become a map.

The name came from the room as much as from the code. Maiffret’s Bugtraq analysis explained that eEye called it Code Red partly because Mountain Dew Code Red kept the researchers awake, and partly because some defaced pages displayed the slogan, “Hacked by Chinese!”

It is an almost perfect detail from the old security world: a serious internet event named by tired people staring at disassembly and caffeine.

The defacement was ugly and blunt. On some American English versions of Windows N-T and Windows two thousand, the local web page could be replaced by a message ending with that slogan.

The slogan did not prove the author’s nationality. CAIDA later said there was no evidence either supporting or refuting Chinese involvement—a dry way of saying that a web-page taunt is not an attribution report.

The first Code Red had a strange limitation. Its random-number generator used a static seed, so infected machines tended to march through the same list of addresses.

That made the first wave clumsier than it might have been. In hindsight, the accident feels almost merciful, like discovering that the burglar tripped over the same rug in every house.

Then the seed changed.

At around ten o’clock Universal Time on July nineteenth, a variant with a random seed began to spread.

CAIDA’s analysis of Code Red version two measured more than three hundred fifty-nine thousand compromised hosts in less than fourteen hours. At its peak, the worm was infecting more than two thousand new hosts every minute.

The numbers look clinical until you remember what they count: real machines, each sending out feelers, each becoming part of the noise touching other networks.

The geographic visualization remains the outbreak’s most readable artifact. Yellow turns to orange. Orange turns to red. The public internet begins to look like an illuminated storm front.

It is not merely a map of broken Windows servers. It is a picture of patch delay becoming visible.

CAIDA’s breakdown by domain made the lesson smaller and more uncomfortable. Infected machines appeared not only in obvious business spaces, but across provider networks associated with homes and small businesses.

The report put it plainly: hosts maintained by individuals at home were part of global internet health.

In two thousand one, that idea was still a little startling. Your neglected box was not just your neglected box anymore.

The worm also disturbed machines it could not infect. CAIDA recorded collateral damage to routers, switches, D-S-L modems, printers, and other devices with web interfaces. Some crashed or rebooted after receiving probes.

There is something painfully old-web about that list. The future was arriving through anything capable of serving a small administrative page.

Code Red was programmed to change phases. After spreading, it attempted a denial-of-service attack against a White House web address.

Its targeting logic made the attack less effective than it might have been. CAIDA later explained that the worm used the numerical address then associated with the White House website. The White House avoided the worst by moving or blackholing that address, rather than relying on the site’s name alone.

A contemporary ABC News report captured the public mood neatly: a virus aiming at the White House, hundreds of thousands of infected machines, government warnings, and a technical fix that sounded almost absurdly physical for an internet crisis.

Move the house number. Let the traffic run into a ditch.

That lucky awkwardness is part of what made Code Red significant. It was dangerous, but it was also full of seams.

The first variant repeated itself. The second spread with terrifying efficiency, but had a cutoff. The White House attack could be sidestepped.

The worm was a warning delivered by flawed machinery, which is sometimes the only kind of warning people believe.

The Government Accountability Office later used Code Red, Code Red Two, and SirCam as examples of why proactive security mattered. It cited more than two hundred fifty thousand Code Red infections in nine hours on July nineteenth, along with estimated economic losses of more than two point four billion dollars.

That figure should be treated as an official estimate from a messy week, not a clean receipt.

The broader point is harder to dispute. The web had become large enough for a familiar patching failure to spill into business operations, government systems, and ordinary browsing.

The cruelest sentence in Microsoft’s bulletin was also the simplest: administrators should apply the patch immediately.

It had been available since June eighteenth. The worm arrived in mid-July.

Between those dates sat all the ordinary human reasons systems remain vulnerable: maintenance windows, uncertainty, forgotten machines, fear of breaking production, overworked staff, and boxes nobody wanted to claim.

Code Red did not invent that problem. It gave it a body.

The eEye account has the roughness of people working inside an event rather than looking back on it. It discusses intrusion-detection signatures, I-I-S logging behavior, disassembly tools, and the exhausting politics of disclosure.

It also contains an observation that still sounds like a network administrator looking up from the console: even if you did everything right, your connection could still be harmed by everyone else’s infected systems.

That was the new social contract of the public internet, stated in packet logs.

Security had become neighbor behavior.

The dead-internet feeling in Code Red is not that the worm vanished. It is that the world around it became ordinary.

Automated exploitation. Patch races. Botnets. Denial-of-service traffic. Infected consumer equipment. Security bulletins everyone swears they will read later.

These are now part of the background hum, like refrigerator noise.

In two thousand one, the hum briefly became visible.

A crude page appeared. A government address moved. Researchers named a worm after the soda keeping them awake. CAIDA turned probes into a glowing map.

And the map revealed a web that was already less like a library and more like weather, with every neglected server becoming another point of pressure.

Some artifacts from the old internet feel charming because they were small.

Code Red feels old because the internet was still learning how big it had become.