Class Net-Worm
Platform Win32

Technical Details

This fileless worm, also known as BlackIce and Blackworm, infects computers which use the following vulnerable ISS products:

RealSecure Network 7.0, XPU 22.11 and before
 RealSecure Server Sensor 7.0 XPU 22.11 and before 
 RealSecure Server Sensor 6.5 for Windows SR 3.10 and before 
 Proventia A Series XPU 22.11 and before
 Proventia G Series XPU 22.11 and before
 Proventia M Series XPU 1.9 and before
 RealSecure Desktop 7.0 ebl and before
 RealSecure Desktop 3.6 ecf and before
 RealSecure Guard 3.6 ecf and before 
 RealSecure Sentry 3.6 ecf and before 
 BlackICE Agent for Server 3.6 ecf and before
 BlackICE PC Protection 3.6 ccf and before
 BlackICE Server Protection 3.6 ccf and before

It sends its own code from computer to computer and launches the code by exploiting a flaw in the programming of ISS products.

The worm is extremely small, and varies from 768 bytes to 1148 bytes in size (the latter is the largest specimen which has been detected so far. The size of the worm may be smaller than the values given.

The worm exists only in memory, and does not copy itself to disk. It attempts to overwrite part of the vulnerable library iss-pam1.dll in ISS products with its own data.

When activated on the infected computer, the worm generates a random IP address, and sends its own code, together with the exploit for the vulnerability mentioned above, to this address. It uses UPD 4000 as the source port.

When receiving such a data packet, any remote computer which has vulnerable ISS products installed will treats it as an incoming ICQ packet and will attempt to process it accordingly.

The result of this error is that the worm’s executable code penetrates the memory of the victim computer and starts to send copies of itself.

Once the data packet has been sent from the randomly chosen IP-address, the worm repeats the process of choosing an address and sending data 20,000 times. It then attempts to write the first 65KB of data from iss-pam1.dll to a randomly chosen disk sectors of the infected computer.

Once the above operation has been completed, the entire cycle is repeated.

The text shown below can be seen in the worm’s code:

 (^.^)      insert witty message here.      (^.^) 

Implementation of attacks

To conduct attacks the worm uses one of the errors in the programming of ISS products. A description can be found on the vendor’s site

Witty exploits the vulnerability in ICQ Parsing in ISS Products, which was first identified in March 2004.

Patches for this flaw can be downloaded from the ISS site

Notably, the methods which Witty uses to propagate are almost identical to those which another fileless worm, Slammer, used in January 2003.

The worm does not present any threat to users who do not have the vulnerable ISS products installed on their systems.

The worm does not create copies of itself on disk, and is only resident in RAM. Once the infected system has been rebooted, the worm ceases to operate.

Kasperskys analysis of Internet attacks shows that as of 22nd March 2004, 48 hours after the worm first appeared, Witty ranked 13th among all currently active Internet worms (excluding email worms), with a modest 0.32% rating.

Find out the statistics of the threats spreading in your region