What Does Code Red Do? (2)
Worm spawns 99 threads to random IP addresses and forwards to other systems listening on 80/tcp
- IP address choices actually only quasi-random. Choice function based on attacker's address:
- Stays within a Class B equivalent 3 out of 8 times
- Stays within a Class A equivalent 4 out of 8 times
- Selects completely random address 1 out of 8 times
- Avoids 127.0.0.0 and 224.0.0.0