"Witty" worm wreaks havoc worldwide

Advertisement (Why?)

As reported last week, Internet security firm eEye had informed Internet Security Systems (ISS) of a vulnerability in its RealSecure and BlackICE firewall products on March 8, 2004. Now, two weeks later, the bug has been exploited, and it's wreaking havoc with supposedly "protected" systems worldwide.

Dubbed the "Witty" worm by anti-virus software vendors, the worm spreads itself using UDP port 4000, and can possibly mutate this port number on demand. But unlike many other annoying-yet-benign worms, "Witty" is extremely damaging. It remains memory-resident, spreading itself to locally available machines, and systematically overwrites the master boot record, partition tables, and random sectors of any hard drives in the compromised system. Under most circumstances this will completely destroy any data on the current hard drive. Recovery is arduous, if it's possible at all.

"Witty" got its name from a humorous message embedded in its attack packets, reading "insert.witty.message.here."

News source: Geek.com

Bug fixes:

Fixed crash when closing history window with large history.

IE was always used as the default browser if IE was open.

Added option to set outgoing port range.

Fixed several memory leaks.

Improved proxy handling.

Rare crash on opening options.

AutoNA was not set correctly when Away was set.

Visibility list did not list all users.

Icons in URL and message contact menus didn't update when icons changed.

Reduce CPU usage in file transfer dialogs (fewer screen updates).

Many other bug fixes.

AIM: Unable to save "Only reply to users in your contact list" option.

ICQ: Failed to send or receive files from ICQ 2003b.

ICQ: Fixed a number of smaller memory leaks.

ICQ: Contact e-mail info was not displayed correctly.

ICQ: Failed to retrieve user details during certain circumstances.

ICQ: URL messages could disappear when sent through a Direct Connection.

ICQ: Nick name was not deleted from server list when local nick name was deleted.

ICQ: Server side contacts could reappear after being deleted if they were on the visible/invisible lists.

ICQ: Changing status while connecting had no effect.

ICQ: A bunch of other fixes the CVS change log if you want the big list.

Jabber: Should offline all chat rooms when go invisible (because they are actually offline).

Jabber: Miranda won't exit if more than one group chat windows are left open.

Jabber: Wrong filename encoding in file sending (signed/unsigned problem).

Jabber: Crash on connect/disconnect caused by stale contacts associated with an unknown protocol.

Jabber: Deleting group chat temporary contact unintentionally closes the chat room.

Jabber: Presence is broadcast to chat room that has denied our access.

Jabber: Graceful exit while Miranda shutdown in the middle of file transfer.

MSN: A port remained opened after the file transfer cancel.

MSN: if a contact list is very long, all contacts could be shown in the Offline mode

MSN: When you set your own nickname with spaces, it appears in the options dialog URL-encoded (with %20 instead of a space char).

MSN: Opened switchboard sessions weren't closed when you go offline without closing Miranda.

MSN: File sending does not require talking anymore.

MSN: Contacts with leading digits in the e-mail were not processed properly.

MSN: Many other bug fixes.

Enhancements:

New user is typing API (supported by ICQ/MSN/Jabber).

Messaging module moved to a plugin with many UI changes (SRMM).

Auto Away can now set protocols away if the workstation becomes locked.

Improved button control (bitmap support, flat button support).

Added options to disable systray icon flashing and adjusting blink time.

Default icon packs are automatically loaded from disk if they exist.

Added report bug menu item.

Many other enhancements.

AIM: Added user search capability.

AIM: Send messages to group chat users by double clicking name.

AIM: Added file receive support.

ICQ: Added support for sending and receiving Typing Notifications.

ICQ: Now accepts messages formatted in Unicode (note: this won’t solve the problem with displaying messages with multiple char sets).

IRC: Contacts on the contact list.

IRC: Host masks.

IRC: Ignore system.

IRC: Channel manager.

Jabber: Manual registration to Jabber services.

Jabber: Can automatically remove contacts not in roster.

Jabber: Invite and accept invitation to a group chat.

Jabber: Support composing message event (message typing notification).

Jabber: Send full JID (with resource name) when appropriate.

MSN: 'User is typing' support added.

MSN: "Invite to chat" contact menu item is added.

MSN: 'block/unlock' feature is integrated with Options->Status->Visible.

MSN: New gateway support.

(2 replies) #1 Varsity on 22 Mar 2004 - 15:44

I don't understand why security warnings like the ones given to ISS need to be public. What is wrong with getting the message across quietly?

#1.1 skamp on 22 Mar 2004 - 20:30

quitely doesnt get anything done.. then they figure noone will know.. thats when you get sum huge problems look at windows.. dont tell the worlld whats going on.. and more security holes than anything

#1.2 kl33per on 23 Mar 2004 - 12:34

Just to let you know, most security problems with Windows are patched before they're exploited. People usually only face security problems in Windows because they don't stay up to date with patches. If you know what you're doing, you'll never have a problem. I use a hardware and a software (for controlling software access) firewall, plus a Virus Scanner, I keep Windows and my programs up to date, and I don't open suspicious emails, or click or suspicious links at suspicious websites. For the life of me, I can't remember the last time I had a security problem.

#2 Jon on 22 Mar 2004 - 16:34

How ironic

#3 tommie on 22 Mar 2004 - 16:41

How do these worms actually get on peoples systems... hahahah

(4 replies) #4 digitalslacker on 22 Mar 2004 - 18:03

can't wait until someone finds a hole like this in the windows firewall in xpsp2

#4.1 T0Y S0LDIER on 22 Mar 2004 - 18:09

i can, i work for an isp and when these things start killing systems, all of our subscribers seem to think its a good idea to call us and they dont like when i tell them to call someone else.

#4.2 chaos945 on 22 Mar 2004 - 18:38

I work in comptuer retail, after the ISP says call someone eles they call me and I tell them to call someone else.

**shakes head at customers**

#4.3 skamp on 22 Mar 2004 - 20:32

Computer Repair.. i usually get the last call.. fix it then tell them not to use teh program that they payed however much money for. its a constant cycle..

btw: does anyone use blackice anymore? i havent seen it forever.

#4.4 kl33per on 23 Mar 2004 - 12:37

BlackIce use to be the firewall. I used to use it. Now I use a hardware firewall and ZoneAlarm for configuring program access.

(4 replies) #5 idbuythatforadollar on 22 Mar 2004 - 20:25

I run no anti virus software or firewall, and have only ever contracted one virus in 14 years. While there is no cure for exploits, an educated user is of far more value than a virus scanner and firewall put together.,,

#5.1 rogerroger on 22 Mar 2004 - 21:05

Umm if you don't have AV software, you can you say you've never had a virus?

And if you don't have a firewall running (that means you are not runing a router either), you are WIDE open to the internet and I can guarantee you have a couple trojans, possible keyloggers, and other malicious items on your hard drive.

#5.2 Jon on 22 Mar 2004 - 22:56

QUOTE

I run no anti virus software or firewall, and have only ever contracted one virus in 14 years.

*Sigh*

Idiot comment of the decade. Most of the worms are so smart in how they bury themselfs that there is no way you'd know if you had one.

Is it sensible thinking to say "I'm a good bike rider so I don't need a helmet" ?

Q-E-f*cking-D.

#5.3 Wrath Delivery on 23 Mar 2004 - 11:45

Sheesh idbuythatforadollar! Unless your machine doesn't ever connect to the internet and has no removable media drives you are pretty unwise to believe that!

#5.4 Jessril on 24 Mar 2004 - 05:57

He's right in some way... a harden OS + a smart user is good enough.

But prevention is better than cure.

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Neowin.net