The Spread of the Witty Worm in IEEE S&P

Witty was the first widespread Internet worm to attack a security product. While technically the use of a buffer overflow exploit is commonplace, the fact that all victims were compromised via their firewall software the day after a vulnerability in that software was publicized indicates that the security model in which end users apply patches to plug security holes is not viable.

In one of the most recent IEEE Security & Privacy magazine issues, a piece covered the March, 2004, Witty worm. In The Spread of the Witty Worm, Colleen Shannon and David Moore, both from the Cooperative Association for Internet Data Analysis (CAIDA), cover the data they collected using their dark IP sensor on the Witty worm's spread. This is almost a complete reprint of their original witty worm analysis, also calledThe Spread of the Witty Worm.