Abishek Kumar

A Georgia Tech PhD candidate was one of three researchers who used an innovative technique to trace the spread of the Witty worm, which infected more than 12,000 computers in a little more than an hour in March 2004.

A report co-authored by Tech student Abishek Kumar said the researchers located a computer in Europe that was the first infected by the worm, which targeted vulnerable products from Internet Security Systems Inc.

United Press International reported that the researchers also found a set of 135 hosts at a U.S. military installation were infected by Witty and were critical to the worm's spread and that the computers were likely on a "hit list" of targeted systems.

Kumar led the study while working as a summer intern at the International Computer Science Institute at the University of California at Berkeley last year. The researchers used network telescopes to analyze Witty's spread.

Telescopes collect traffic sent to unused portions of the Internet's machine address space that inadvertently collect traffic generated by fast-moving worms. According to the report, the researchers found they could develop a more accurate picture of a worm's spread by analyzing the machines sending traffic to telescopes.

The paper's authors disassembled the worm's code and reverse engineered the pseudo-random number generator used to compile a list of computers to attack. Once they cracked the number generator, they were able to get a detailed picture of Witty's spread.

That picture allowed researchers to spot an infected computer connected to the Internet through a European service provider. The Internet address connected to that computer was passed on to law enforcement officials, according to UPI.

The amount of information gleaned from the analysis of the worm reportedly surprised even the researchers.

"I did not expect to find such precise details," Kumar is quoted as saying.

printer-friendly version of this article