This fileless worm, also known as BlackIce and Blackworm, infects computers which use the following vulnerable ISS products:
RealSecure Network 7.0, XPU 22.11 and before RealSecure Server Sensor 7.0 XPU 22.11 and before RealSecure Server Sensor 6.5 for Windows SR 3.10 and before Proventia A Series XPU 22.11 and before Proventia G Series XPU 22.11 and before Proventia M Series XPU 1.9 and before RealSecure Desktop 7.0 ebl and before RealSecure Desktop 3.6 ecf and before RealSecure Guard 3.6 ecf and before RealSecure Sentry 3.6 ecf and before BlackICE Agent for Server 3.6 ecf and before BlackICE PC Protection 3.6 ccf and before BlackICE Server Protection 3.6 ccf and before
It sends its own code from computer to computer and launches the code by exploiting a flaw in the programming of ISS products.
The worm is extremely small, and varies from 768 bytes to 1148 bytes in size (the latter is the largest specimen which has been detected so far. The size of the worm may be smaller than the values given.
The worm exists only in memory, and does not copy itself to disk. It attempts to overwrite part of the vulnerable library iss-pam1.dll in ISS products with its own data.
When activated on the infected computer, the worm generates a random IP address, and sends its own code, together with the exploit for the vulnerability mentioned above, to this address. It uses UPD 4000 as the source port.
When receiving such a data packet, any remote computer which has vulnerable ISS products installed will treats it as an incoming ICQ packet and will attempt to process it accordingly.
The result of this error is that the worm’s executable code penetrates the memory of the victim computer and starts to send copies of itself.
Once the data packet has been sent from the randomly chosen IP-address, the worm repeats the process of choosing an address and sending data 20,000 times. It then attempts to write the first 65KB of data from iss-pam1.dll to a randomly chosen disk sectors of the infected computer.
Once the above operation has been completed, the entire cycle is repeated.
The text shown below can be seen in the worm’s code:
(^.^) insert witty message here. (^.^) 32Qhws2 QhsockTS QhsendTS Qhel32hkernT QhounthickChGetTTP
Implementation of attacks
To conduct attacks the worm uses one of the errors in the programming of ISS products. A description can be found on the vendor’s site
Witty exploits the vulnerability in ICQ Parsing in ISS Products, which was first identified in March 2004.
Patches for this flaw can be downloaded from the ISS site
Notably, the methods which Witty uses to propagate are almost identical to those which another fileless worm, Slammer, used in January 2003.
The worm does not present any threat to users who do not have the vulnerable ISS products installed on their systems.
The worm does not create copies of itself on disk, and is only resident in RAM. Once the infected system has been rebooted, the worm ceases to operate.
Kasperskys analysis of Internet attacks shows that as of 22nd March 2004, 48 hours after the worm first appeared, Witty ranked 13th among all currently active Internet worms (excluding email worms), with a modest 0.32% rating.