Multimedia Gallery

Download this image.

CodeRed Worm Infections, July 19, 2001

CodeRed Worm Infections, July 19, 2001

Screen-capture of Walrus visualization showing the number of hosts infected by the CodeRed worm in the IPv4 prefix 24.0.0.0/8, broken down by announced BGP (Border Gateway Protocol, a routing protocol most commonly used between autonomous systems) prefix on July 19, 2001.

CodeRed is the name of a worm -- a computer program purposefully written to replicate itself from machine to machine across a network, or a network of networks, like the Internet -- and variants, that spread with alarming rapidity. Beginning on the morning of July 19, 2001, Universal Time (UTC), a random seed variant infected over 359,000 machines in a 14-hour period. It was also programmed to launch a denial-of-service attack against the White House Web site. Follow-up studies by the Cooperative Association for Internet Data Analysis (CAIDA) show that home users and small businesses were among the most heavily infected as a class. For further details, see CAIDA Analysis of CodeRed spreadsheet.

Worms are hostile programs by definition, and can commandeer the resources (even if only a small amount) of host machines and networks without permission. They typically spread by exploiting weaknesses or outright flaws in the design or implementation of complex software systems like Web servers. Because they are programs actually running on infected hosts, and often with elevated privileges, it only takes malicious intent to create a worm that causes irrevocable and significant damage to host machines. They also have the potential to serve as agents in a distributed denial-of-service (DDoS) attack.

This graph was created using the Walrus graph visualization tool, designed for interactively visualizing large directed graphs in 3-Dimensional space. By employing a fisheye-like distortion, it provides a display that simultaneously shows local detail and the global context. The Walrus tool was developed with support from DARPA NGI N66001-98-2-8922 and DARPA NMS N66001-01-1-8909; from National Science Foundation grants ANI 99-96248 and NSF N66001-01-1-8909; and with the support of CAIDA members. CAIDA is based at the University of California's San Diego Supercomputer Center. To learn more about the Walrus tool, or to view additional Walrus-created graphs, visit the Cooperative Association for Internet Data Analysis (CAIDA) Web site at http://www.caida.org/tools/visualization/walrus/.

Please Note: Before using this image, please read the detailed restrictions regarding any possible use, below under "Restrictions." (Date of Image: 2002) [One of two related images. See Next Image.]

Credit: © 2002 The Regents of the University of California

Special Restrictions: Permission to use, copy, modify and/or distribute any part of this image from the Walrus Gallery for educational, research and nonprofit purposes, without fee and without a written agreement, is hereby granted provided the copyright notice in the "Credit" line, this paragraph and the following paragraph appear in all copies.

Those desiring to incorporate these Walrus Gallery Images into commercial products or use for commercial purposes should contact the Technology Transfer & Intellectual Property Services, University of California, San Diego, 9500 Gilman Drive, Mail Code 0910, La Jolla, CA 92093-0910; by telephone, (858) 534-5815; by Fax, (858) 534-7345; or by e-mail, mailto:invent@ucsd.edu.

Also Available:
Download the high-resolution TIF version of the image. (571 KB)

Use your mouse to right-click (Mac users may need to Ctrl-click) the link above and choose the option that will save the file or target to your computer.