Parent class: VirWare
Viruses and worms are malicious programs that self-replicate on computers or via computer networks without the user being aware; each subsequent copy of such malicious programs is also able to self-replicate. Malicious programs which spread via networks or infect remote machines when commanded to do so by the “owner” (e.g. Backdoors) or programs that create multiple copies that are unable to self-replicate are not part of the Viruses and Worms subclass. The main characteristic used to determine whether or not a program is classified as a separate behaviour within the Viruses and Worms subclass is how the program propagates (i.e. how the malicious program spreads copies of itself via local or network resources.) Most known worms are spread as files sent as email attachments, via a link to a web or FTP resource, via a link sent in an ICQ or IRC message, via P2P file sharing networks etc. Some worms spread as network packets; these directly penetrate the computer memory, and the worm code is then activated. Worms use the following techniques to penetrate remote computers and launch copies of themselves: social engineering (for example, an email message suggesting the user opens an attached file), exploiting network configuration errors (such as copying to a fully accessible disk), and exploiting loopholes in operating system and application security. Viruses can be divided in accordance with the method used to infect a computer:- file viruses
- boot sector viruses
- macro viruses
- script viruses
Class: Net-Worm
Net-Worms propagate via computer networks. The distinguishing feature of this type of worm is that it does not require user action in order to spread. This type of worm usually searches for critical vulnerabilities in software running on networked computers. In order to infect the computers on the network, the worm sends a specially crafted network packet (called an exploit) and as a result the worm code (or part of the worm code) penetrates the victim computer and activates. Sometimes the network packet only contains the part of the worm code which will download and run a file containing the main worm module. Some network worms use several exploits simultaneously to spread, thus increasing the speed at which they find victims.Read more
Platform: Win32
Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.Description
Technical Details
This fileless worm, also known as BlackIce and Blackworm, infects computers which use the following vulnerable ISS products:
RealSecure Network 7.0, XPU 22.11 and before RealSecure Server Sensor 7.0 XPU 22.11 and before RealSecure Server Sensor 6.5 for Windows SR 3.10 and before Proventia A Series XPU 22.11 and before Proventia G Series XPU 22.11 and before Proventia M Series XPU 1.9 and before RealSecure Desktop 7.0 ebl and before RealSecure Desktop 3.6 ecf and before RealSecure Guard 3.6 ecf and before RealSecure Sentry 3.6 ecf and before BlackICE Agent for Server 3.6 ecf and before BlackICE PC Protection 3.6 ccf and before BlackICE Server Protection 3.6 ccf and before
It sends its own code from computer to computer and launches the code by exploiting a flaw in the programming of ISS products.
The worm is extremely small, and varies from 768 bytes to 1148 bytes in size (the latter is the largest specimen which has been detected so far. The size of the worm may be smaller than the values given.
The worm exists only in memory, and does not copy itself to disk. It attempts to overwrite part of the vulnerable library iss-pam1.dll in ISS products with its own data.
When activated on the infected computer, the worm generates a random IP address, and sends its own code, together with the exploit for the vulnerability mentioned above, to this address. It uses UPD 4000 as the source port.
When receiving such a data packet, any remote computer which has vulnerable ISS products installed will treats it as an incoming ICQ packet and will attempt to process it accordingly.
The result of this error is that the worm's executable code penetrates the memory of the victim computer and starts to send copies of itself.
Once the data packet has been sent from the randomly chosen IP-address, the worm repeats the process of choosing an address and sending data 20,000 times. It then attempts to write the first 65KB of data from iss-pam1.dll to a randomly chosen disk sectors of the infected computer.
Once the above operation has been completed, the entire cycle is repeated.
The text shown below can be seen in the worm's code:
(^.^) insert witty message here. (^.^) 32Qhws2 QhsockTS QhsendTS Qhel32hkernT QhounthickChGetTTP
Implementation of attacks
To conduct attacks the worm uses one of the errors in the programming of ISS products. A description can be found on the vendor's site
Witty exploits the vulnerability in ICQ Parsing in ISS Products, which was first identified in March 2004.
Patches for this flaw can be downloaded from the ISS site
Notably, the methods which Witty uses to propagate are almost identical to those which another fileless worm, Slammer, used in January 2003.
The worm does not present any threat to users who do not have the vulnerable ISS products installed on their systems.
The worm does not create copies of itself on disk, and is only resident in RAM. Once the infected system has been rebooted, the worm ceases to operate.
Kasperskys analysis of Internet attacks shows that as of 22nd March 2004, 48 hours after the worm first appeared, Witty ranked 13th among all currently active Internet worms (excluding email worms), with a modest 0.32% rating.
Read more
Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com