Code Red Scenario: Historical University Crisis (2001)
Code Red Scenario: University Technology Services Crisis (2001)
Planning Resources
Scenario Details for IMs
Hook
“It’s July 19th, 2001 at University Technology Services, and your IT department manages hundreds of Windows IIS web servers supporting 15,000 students and hundreds of academic departments. Kevin has just noticed unusual network traffic patterns – your servers are generating massive scanning activity on port 80. Within hours, academic department websites start displaying ‘HELLO! Welcome to http://www.worm.com! Hacked By Chinese!’ messages instead of course materials and research information. Unknown to your team, you’re witnessing the first major automated worm attack in internet history, and your university servers are both victims and unwilling participants in a global attack network.”
Initial Symptoms to Present:
Key Discovery Paths:
Detective Investigation Leads:
Protector System Analysis:
Tracker Network Investigation:
Communicator Stakeholder Interviews:
Mid-Scenario Pressure Points:
- Hour 1: Computer Science professor discovers his research project website defaced, questions IT security practices
- Hour 2: Network administrator reports university servers are attacking other academic institutions globally
- Hour 3: Student registration system becomes unavailable as worm consumes network bandwidth
- Hour 4: University administration demands explanation as national media reports widespread internet attack
Evolution Triggers:
- If response is delayed beyond 24 hours, university servers may participate in coordinated DDoS attacks
- If containment fails, academic reputation suffers as defaced websites remain visible publicly
- If patch deployment is inadequate, reinfection occurs as worm continues scanning campus networks
Resolution Pathways:
Technical Success Indicators:
- Manual patch deployment stops worm propagation across university IIS servers
- Network traffic monitoring identifies and isolates infected systems preventing further spread
- Academic website restoration maintains summer session operations and student services
Business Success Indicators:
- University reputation protected through rapid response and transparent communication
- Student services maintained with minimal disruption to summer registration and course access
- Academic operations continued demonstrating institutional technology resilience
Learning Success Indicators:
- Team understands automated attack evolution from manual hacking to worm-based propagation
- Participants recognize importance of patch management and security monitoring in academic environments
- Group demonstrates incident response adaptation during early internet security crisis
Common IM Facilitation Challenges:
If Manual Patch Complexity Is Underestimated:
“Kevin needs to manually download, test, and deploy MS01-033 patches to 300+ servers without automated tools. How do you coordinate manual patch deployment across distributed academic departments?”
If Internet Attack Participation Is Ignored:
“While investigating local defacements, Patricia discovers your university servers are attacking MIT, Stanford, Berkeley, and the White House. How does this change your response priorities?”
If Academic Culture Conflict Is Missed:
“A Computer Science professor insists their research server needs public internet access without ‘restrictive’ firewalls. How do you balance academic openness with security requirements during active attack?”
Success Metrics for Session:
Understanding 2001 Technology Context
This scenario represents the actual Code Red worm attack from July 2001. Key historical elements to understand:
- Internet Infrastructure: Much smaller, primarily academic and corporate networks
- Security Awareness: Buffer overflow vulnerabilities were poorly understood outside expert circles
- Patch Management: No automated update systems – all patches applied manually
- Network Architecture: Flat networks with minimal segmentation or access controls
- Response Capabilities: No dedicated incident response teams at most organizations
Collaborative Modernization Questions for Players
Present these questions after initial investigation to guide modernization:
- “How would this attack work in today’s cloud infrastructure?”
- Guide toward: API vulnerabilities, container security, multi-tenant isolation
- “What would be the equivalent of ‘website defacement’ for modern applications?”
- Guide toward: Data manipulation, service disruption, customer-facing impact
- “How has automated scanning and exploitation evolved since 2001?”
- Guide toward: Modern vulnerability scanners, exploit kits, automated toolchains
- “What would university IT infrastructure look like today?”
- Guide toward: SaaS services, cloud providers, mobile applications, remote learning
- “How would incident response be different with modern tools and practices?”
- Guide toward: Automated detection, centralized logging, threat intelligence, coordination
Modernization Discovery Process
After historical investigation, facilitate modernization discussion:
- Technology Translation: Help players identify modern equivalents to 2001 technology
- Attack Vector Evolution: Explore how automated exploitation has advanced
- Impact Amplification: Discuss how interconnected systems change incident scope
- Response Evolution: Compare 2001 manual response to modern automated capabilities
- Scenario Adaptation: Collaboratively develop contemporary version
Learning Objectives
- Historical Perspective: Understanding how cybersecurity threats have evolved
- Technology Evolution: Recognizing parallels between historical and modern vulnerabilities
- Incident Response Development: Appreciating advances in security practices and tools
- Collaborative Learning: Working together to modernize historical threats for current relevance
IM Facilitation Notes
- Start Historical: Present the 2001 scenario authentically without modern context
- Guide Discovery: Use questions to help players discover modern parallels
- Encourage Creativity: Support player ideas for modernization even if unconventional
- Maintain Learning Focus: Emphasize what the historical context teaches about current threats
- Document Evolution: Capture player modernization ideas for future scenario development
Template Compatibility
Quick Demo (35-40 min)
- Rounds: 1
- Actions per Player: 1
- Investigation: Guided
- Response: Pre-defined
- Focus: Use the “Hook” and “Initial Symptoms” to quickly establish the 2001 university crisis. Present the “Guided Investigation Clues” at 5-minute intervals. Offer the “Pre-Defined Response Options” for the team to choose from. Quick debrief should focus on recognizing first automated worm attack and manual patch management challenges.
Lunch & Learn (75-90 min)
- Rounds: 2
- Actions per Player: 2
- Investigation: Guided
- Response: Pre-defined
- Focus: This template allows for deeper exploration of early internet security challenges. Use the full set of NPCs to create realistic academic pressure and manual response limitations. The two rounds allow worm spread across campus, raising stakes. Debrief can explore balance between academic openness and security, plus brief modernization discussion.
Full Game (120-140 min)
- Rounds: 3
- Actions per Player: 2
- Investigation: Open
- Response: Creative
- Focus: Players have freedom to investigate using the “Key Discovery Paths” as IM guidance. They must develop response strategies balancing academic operations, manual patch deployment, network security, and internet attack participation responsibility. The three rounds allow for full narrative arc including historical context and comprehensive modernization discussion exploring how the 2001 worm evolved into contemporary threats.
Advanced Challenge (150-170 min)
- Rounds: 3
- Actions per Player: 2
- Investigation: Open
- Response: Creative
- Complexity: Add red herrings (e.g., legitimate academic research traffic causing false positives). Make containment ambiguous, requiring players to justify manual patch decisions with incomplete vulnerability information. Remove access to reference materials to test knowledge recall of worm behavior. Include deep modernization discussion comparing 2001 manual response to contemporary automated capabilities.
Quick Demo Materials (35-40 min)
Guided Investigation Clues
Clue 1 (Minute 5): “Web server forensics reveal Code Red worm exploiting IIS buffer overflow vulnerability (idq.dll) in the university’s servers during July 2001. Network analysis shows significant increase in outbound port 80 scanning traffic from infected IIS web servers targeting random internet addresses. Academic department websites display ‘HELLO! Welcome to http://www.worm.com! Hacked By Chinese!’ defacement messages.”
Clue 2 (Minute 10): “Log analysis shows automated exploitation without human intervention – this is the first major self-propagating worm attack in internet history. Timeline indicates simultaneous infection of multiple campus servers through unpatched IIS systems. Security assessment reveals university delayed MS01-033 patch deployment due to concerns about disrupting summer academic operations.”
Clue 3 (Minute 15): “External security community reports university servers participating in global scanning activity and attacking MIT, Stanford, Berkeley, and other academic institutions. Student registration systems becoming unavailable as worm consumes network bandwidth. A Computer Science professor’s research server is defaced, demanding explanations about university security practices while insisting on maintaining open internet access without firewalls.”
Pre-Defined Response Options
Option A: Manual Patch Deployment & Server Restoration
- Action: Download and manually apply Microsoft Security Bulletin MS01-033 patch to all 300+ affected IIS servers, coordinate physical server access across academic departments, reboot systems to clear memory-resident worm, restore defaced websites from backups.
- Pros: Directly addresses IIS indexing service vulnerability preventing reinfection; demonstrates responsible patch management establishing security foundation for future threats.
- Cons: Manual patch deployment extremely time-consuming requiring days for distributed academic infrastructure; server reboots disrupt summer academic operations; coordination complexity across autonomous departments.
- Type Effectiveness: Super effective against Worm type malmons like Code Red; memory-only worm eliminated through reboot after patching prevents reinfection.
Option B: Emergency Firewall Blocking & Traffic Control
- Action: Configure perimeter firewalls to block all outbound port 80 traffic from IIS servers except known legitimate destinations, implement emergency traffic filtering preventing worm propagation, isolate infected systems while maintaining critical academic services.
- Pros: Immediately stops worm spread and prevents university participation in global attacks; faster than manual patching enabling rapid containment.
- Cons: May disrupt legitimate academic web services requiring careful whitelist configuration; doesn’t address underlying IIS vulnerability enabling reinfection after firewall changes; manual firewall rule management across flat academic network.
- Type Effectiveness: Moderately effective against Worm threats; prevents propagation but doesn’t eliminate worm or fix vulnerability; temporary containment requiring subsequent patching.
Option C: IIS Indexing Service Disable & Temporary Mitigation
- Action: Manually disable IIS Indexing Service on all campus web servers eliminating vulnerable component, maintain basic web functionality without search features, coordinate emergency configuration changes across academic departments.
- Pros: Immediately stops attack vector without full patch deployment; faster workaround enabling rapid response; maintains most academic web services during remediation.
- Cons: Disables search functionality affecting some academic applications; requires manual configuration on each server; temporary workaround still requiring eventual patching.
- Type Effectiveness: Partially effective against Worm malmon type; removes attack surface but doesn’t eliminate existing infections; requires combination with server reboots for complete remediation.
Lunch & Learn Materials (75-90 min, 2 rounds)
Round 1: Discovery & Identification (30-35 min)
Investigation Clues:
- Clue 1 (Minute 5): Network Administrator Kevin Zhang reports that faculty are seeing defacement messages on departmental websites. “The Computer Science homepage now says ‘HELLO! Welcome to http://www.worm.com! Hacked By Chinese!’ - and it’s spreading to other departments.”
- Clue 2 (Minute 10): Server forensics reveal exploitation of Microsoft IIS Indexing Service buffer overflow (MS01-033). The attack uses a malformed HTTP GET request that’s spreading automatically between Windows 2000 IIS servers without human intervention – it’s a worm.
- Clue 3 (Minute 15): Network monitoring shows 300+ campus IIS servers generating massive scanning traffic to random internet IP addresses. The university is participating in a global internet-wide attack that’s overwhelming networks worldwide.
- Clue 4 (Minute 20): IT Director Dr. Patricia Williams reveals that Microsoft released security bulletin MS01-033 two weeks ago, but patching was delayed during summer semester to avoid disrupting faculty research web servers. “We couldn’t coordinate patch deployment across 50 autonomous departments during active research projects.”
Response Options:
- Option A: Emergency Server Reboot - Immediately reboot all affected IIS servers to clear the memory-resident worm, restore defaced websites from tape backups, delay vulnerability patching until coordinated maintenance window.
- Pros: Fastest path to website restoration; clears active worm infections; minimal summer semester disruption.
- Cons: Doesn’t patch the IIS vulnerability; servers will be reinfected within hours from internet scanning; requires physical access to 300+ distributed servers.
- Type Effectiveness: Partially effective – temporarily eliminates worm but leaves systems vulnerable to immediate reinfection.
- Option B: Firewall Emergency Rules - Configure border firewalls to block all outbound port 80 traffic from academic network except approved destinations, stop university’s participation in global attacks.
- Pros: Immediately stops university from attacking internet; faster than manual server patching; protects university reputation.
- Cons: May break legitimate faculty research requiring outbound web access; doesn’t fix underlying IIS vulnerability; requires careful whitelist management.
- Type Effectiveness: Moderately effective – contains propagation but doesn’t eliminate worm or vulnerability.
- Option C: IIS Indexing Service Disable - Manually disable IIS Indexing Service on all campus web servers to remove attack vector, coordinate across academic departments for rapid deployment.
- Pros: Removes vulnerability without full patching; faster than MS01-033 deployment; maintains most web functionality.
- Cons: Disables search features on academic sites; requires manual server-by-server configuration; temporary workaround still needs patching eventually.
- Type Effectiveness: Partially effective – removes attack surface but doesn’t clear existing infections; requires reboot combo.
Round 2: Scope Assessment & Response (30-35 min)
Investigation Clues:
Clue 5 (Minute 30): If Option A (reboot only) was chosen: Within 90 minutes, campus servers are reinfected from internet scanning. eEye Digital Security reports university is part of 359,000 compromised systems globally. “We’re back to attacking the internet again.”
Clue 5 (Minute 30): If Option B or C was chosen: Faculty researchers report broken web applications due to firewall restrictions or missing search functionality. “Our genomics research portal needs to query external databases – the firewall is blocking critical research.”
- Clue 6 (Minute 40): CERT/CC advisory reveals Code Red will trigger mass DDoS attack against www.whitehouse.gov on July 19th. University’s 300+ infected servers will participate in coordinated attack against U.S. government website unless patched.
- Clue 7 (Minute 50): University President receives call from federal agencies about academic institution participation in attacks. “NSA and FBI are contacting universities nationwide. We need to demonstrate responsible internet citizenship.”
- Clue 8 (Minute 55): IT analysis reveals that manual MS01-033 patch deployment to 300+ servers across 50 autonomous departments will require 5-7 days of coordinated effort during summer research season. July 19th DDoS trigger is 4 days away.
Response Options:
- Option A: Emergency Coordinated Patching - Mobilize all IT staff for 24/7 manual MS01-033 patch deployment across entire campus, coordinate with academic departments for emergency server access, reboot all systems after patching to clear worm.
- Pros: Completely eliminates vulnerability; prevents university participation in July 19th DDoS; demonstrates academic cybersecurity leadership to federal agencies.
- Cons: Requires extensive disruption to summer research; 24/7 IT staff mobilization; coordination complexity across autonomous academic departments.
- Type Effectiveness: Super effective against Worm type – eliminates vulnerability and infection preventing reinfection and DDoS participation.
- Option B: Phased Departmental Patching - Prioritize patching of high-visibility department servers (main websites, student services), maintain containment measures (firewall/indexing disable) for remaining systems, complete full patching post-DDoS date.
- Pros: Balances security with research continuity; protects highest-visibility systems; reduces coordination burden.
- Cons: University still participates in DDoS with some servers; differential treatment creates vulnerability gaps; extended remediation timeline.
- Type Effectiveness: Moderately effective – progressive improvement but partial DDoS participation remains.
- Option C: External Academic Consortium Support - Coordinate with Internet2 and other research universities for shared response, request federal assistance through EDUCAUSE, collaborate on academic sector patching strategies and technical resources.
- Pros: Leverages academic community resources; federal expertise accelerates response; builds higher education cybersecurity collaboration.
- Cons: Coordination complexity across institutions; potential delays in external resource availability; admission that single institution lacks sufficient capability.
- Type Effectiveness: Moderately effective – improves response quality through collaboration but extends timeline.
Round Transition Narrative
After Round 1 → Round 2:
The team’s initial response determines whether the university quickly returns to vulnerable operation (reboot approach) or maintains containment with research impact (firewall/indexing disable). Either way, the situation escalates dramatically when CERT/CC reveals that Code Red will trigger a coordinated DDoS attack against www.whitehouse.gov on July 19th – just days away. Federal agencies are contacting universities nationwide about their participation in this upcoming attack on U.S. government infrastructure. The team must now balance comprehensive security remediation with summer research continuity, while facing the reality that manual patch deployment to 300+ distributed servers may not be completable before the DDoS trigger date. The incident transforms from a local website defacement problem into a national security issue requiring inter-agency coordination and academic community collaboration.
Debrief Focus:
- Recognition of first major automated worm vs manual hacking
- Balance between academic openness and security requirements
- Manual patch management challenges in distributed infrastructure
- Brief discussion of modern equivalents (ransomworms, IoT botnets)
Full Game Materials (120-140 min, 3 rounds)
Handouts for Players
- Handout A: IIS Access Log Analysis — IIS 5.0 access logs showing buffer overflow exploit pattern and defacement
- Handout B: Network Traffic Analysis — Campus bandwidth monitoring showing exponential worm spread and DDoS attack
- Handout C: Help Desk Ticket Log — Help desk tickets documenting user impact and organizational response