2001 · Security

Code Red: the worm that attacked the White House website

Last reviewed 16 October 2026

In July 2001 the Code Red worm infected hundreds of thousands of Microsoft web servers in a day, defacing pages and aiming a flood of traffic at whitehouse.gov.

What happened

Code Red was discovered in mid-July 2001 by researchers at eEye Digital Security, who named it after the Mountain Dew Code Red soft drink they were drinking while analysing it. It attacked computers running Microsoft’s Internet Information Services (IIS) web server.

On 19 July 2001 a new version spread explosively, infecting more than 350,000 servers in roughly 14 hours. Unlike email worms, it needed no one to click anything. It scanned the internet for vulnerable servers and infected them directly.

How it worked

The worm exploited a buffer overflow in the indexing service used by IIS. Microsoft had published a fix for the flaw, in security bulletin MS01-033, about a month earlier, but many servers had not been patched. Code Red ran only in memory and did not write itself to disk, so restarting a server removed it, although an unpatched server could quickly be infected again.

Infected servers with English-language settings showed a defaced page reading “HELLO! Welcome to http://www.worm.com! Hacked By Chinese!”.

The attack on the White House

The worm followed a timetable. For the first part of each month it spread. Then infected servers were set to flood the IP address of the White House website with traffic. Administrators avoided the attack by moving whitehouse.gov to a different address before it began, so the flood hit an address that no longer mattered.

Code Red II and the aftermath

In August 2001 a different worm, named Code Red II because it included the string “CodeRedII”, used the same flaw. It installed a backdoor that gave attackers remote control of infected servers, which made it more dangerous than the original. The Nimda worm followed in September.

Code Red became a standard case study in why patches must be applied promptly. It was one of the events behind Microsoft’s Trustworthy Computing initiative, announced by Bill Gates in January 2002.