Full analysis of the .ida "Code Red" worm
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
eEye Digital Security published a disassembly-based analysis of the "Code Red" worm, which spreads through the IIS .ida buffer overflow patched in Microsoft bulletin MS01-033. Each infected server runs 100 threads that probe addresses generated from a static seed, so hosts rescan the same sequence and generate heavy traffic. Time-gated floods against www.whitehouse.gov and a defacement on US English systems follow. eEye's figures, including at least 12,000 infections, come from its own testing and administrator reports, not independent verification. For builders, the point is patch speed.
Score
0.80total under rubric v2.0Contestedjudges differ by 0.57 on reader interest
- Significance0.84
- Reader interest0.76
- Audience breadth0.76
- Practical relevance0.83
- Substantiated0.90
- Technical depth0.95
- New information0.94
- Counts against: Promotional0.08
- Counts against: Overclaim0.20
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.80 | 0.85 | 0.88 | 0.84 | 0.08 | +0.25 | +0.211 |
| Reader interest | 0.41 | 0.90 | 0.98 | 0.76 | 0.57 , above the contested threshold | +0.20 | +0.153 |
| Audience breadth | 0.72 | 0.85 | 0.72 | 0.76 | 0.13 | +0.10 | +0.076 |
| Practical relevance | 0.73 | 0.90 | 0.86 | 0.83 | 0.17 | +0.15 | +0.125 |
| Substantiated | 0.95 | 0.85 | 0.90 | 0.90 | 0.10 | +0.10 | +0.090 |
| Technical depth | 0.99 | 0.90 | 0.96 | 0.95 | 0.09 | +0.10 | +0.095 |
| New information | 0.94 | 0.90 | 0.99 | 0.94 | 0.09 | +0.10 | +0.094 |
| Promotional | 0.05 | 0.10 | 0.08 | 0.08 | 0.05 | −0.15 | −0.012 |
| Overclaim | 0.18 | 0.25 | 0.18 | 0.20 | 0.07 | −0.15 | −0.030 |
| Sum of contributions | +0.802 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.802 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
Claim check
Claim check: 6 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkDate
eEye Digital Security discovered the .ida vulnerability exploited by the worm and published an advisory on it on June 18, 2001.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “the recent .ida vulnerability that eEye Digital Security discovered”
The source says No passage could be compared.
Source cited by the article: eeye.com/html/Research/Advisories/AD20010618.html
No source givenCausal conclusion
The Code Red worm's ultimate purpose appears to be a denial of service attack against www.whitehouse.gov.
The article gives no link or citation for it.
The article says “this worms purpose ultimately seems to be to perform a denial of service attack against www.whitehouse.gov”
The source says No source to compare with.
No source givenGeneralization
Only US English Windows NT/2000 systems show the defaced 'Hacked by Chinese!' web page.
The article gives no link or citation for it.
The article says “only US English Windows NT/2000 systems will show the defaced ("Hacked by Chinese !") web page”
The source says No source to compare with.
No source givenNumber
eEye's testing calculated that the worm can attempt to infect roughly half a million IP addresses a day.
The article gives no link or citation for it.
The article says “the worm can attempt to infect roughly half a million IP addresses a day”
The source says No source to compare with.
No source givenNumber
Administrators reported being probed by over 12 thousand unique hosts, which eEye took to mean at least 12 thousand hosts were infected.
The article gives no link or citation for it.
The article says “administrators that have been probed by over 12 thousand unique hosts. That basically means at least 12 thousand hosts have been infected by this worm”
The source says No source to compare with.
No source givenCausal conclusion
Every infected computer goes through the same list of 'random' IP addresses because the worm uses a static seed, causing reinfection and traffic that creates a denial-of-service effect.
The article gives no link or citation for it.
The article says “every computer infected by this worm is going to go through the same list of random IP addresses to try to infect”
The source says No source to compare with.
No source givenNumber
The worm exploits the .ida buffer overflow by overwriting EIP with 0x7801CBD3, an address in msvcrt.dll containing a 'call ebx' instruction.
The article gives no link or citation for it.
The article says “EIP is overwritten with 0x7801CBD3 which an address within msvcrt.dll. The code at 0x7801CBD3 disassembles to”
The source says No source to compare with.
Couldn’t checkDate
A Microsoft patch for the .ida vulnerability (MS01-033) had been available for over a month before the worm spread.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “A patch for this vulnerability has been available for over a month now”
The source says No passage could be compared.
Source cited by the article: microsoft.com/technet/treeview/default.asp
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 24 Oct 2026, 08:53 UTC. It played no part in the ranking.