A new worm that exploits a hole in some of Internet Security Systems' intrusion protection products seems to be dying down after affecting thousands of IP addresses since Saturday.
The so-called Witty worm, affecting some versions of ISS' BlackIce and RealSecure intrusion protection products, is "highly malicious" because it slowly destroys the system it infects, according to an alert from Lurhq, a managed security provider. "Rather than simply executing a 'format C:' or similar destructive command, the worm slowly corrupts the file system while it continues to spread," Lurhq's alert says.
The spread of the worm appears to be slowing down Monday, says Joe Stewart, senior security researcher at Lurhq. "It was only a big deal for the people who had the ISS products' specific versions," Stewart adds. "It was not a threat for Windows users in general."
ISS estimates the worm infected about 12,000 IP addresses, although the exact number is difficult to determine, says Dan Ingevaldson, director of X-Force research and development at ISS. Early reports had the worm infecting up to 50,000 IP addresses, but Ingevaldson says ISS' scans didn't find evidence of the worm being that widespread.
"We saw a spike in the first days of the infection, and it's been going down since then," Ingevaldson says.
The worm, which exploited an ICQ parsing vulnerability, affected non-updated versions of ISS' BlackIce and RealSecure products. A complete list of affected versions is available at ISS' alert site. An ISS update that fixes the vulnerability has been available since March 9.
In addition to the maliciousness of the worm, its timing is also significant, Stewart says. A vulnerability alert for the ISS products was released on March 18, and the worm began spreading March 20. The writer of the worm either knew of the vulnerability before the announcement or wrote and tested the worm in less than two days, Stewart says.
"Usually, you have a week or two after the vulnerability was announced," Stewart says. "This was a substantial piece of work to be done in one day."
ISS counts about 1.6 million corporate installations of the BlackIce PC intrusion detection software, and that number doesn't include home installations. The worm illustrates the importance of running updated intrusion detection and firewall software, Ingevaldson says.
"Our customers know you have to apply the most recent updates," he says. "They know that for it to work, they need to have the most recent updates, and they would not be affected at all if they did."