The worm named after a soft drink

The story

In July 2001, two researchers at a security company were up late analyzing a new worm attacking Microsoft’s web server software. They named it after what they were drinking: Mountain Dew Code Red.

The worm spread from web server to web server on its own. On infected English-language sites, it replaced the home page with a message ending “Hacked By Chinese!” It was also programmed to flood the White House website with traffic on a set date. The White House changed its website’s internet address to dodge the attack.

Microsoft had released a fix for the flaw a month before the worm appeared. Hundreds of thousands of servers had not installed it.

Why it mattered

Code Red showed that servers left unpatched for even a few weeks could be found and taken over automatically, with no one having to click anything. It was among the worms that brought Microsoft’s security problems to the forefront, and in January 2002 the company launched an initiative it called Trustworthy Computing, with security as one of its key areas.

The lesson today

Code Red is one of the clearest early examples of a pattern that still defines security: the fix existed, and the damage happened anyway, on systems that were not updated in time.

Attackers now move faster than in 2001. A published fix tells them exactly what to look for, and automated scanning finds unpatched systems within days. Patching on a schedule, and finding the systems that missed an update, is one of the most valuable routine jobs in IT.