 |
 |
There is a new worm that exploits a flaw in Black Ice. The worm destroys data on infected computers. Symantec calls the worm Witty. The worm attacks via UDP. There seems to be a little confusion among the reports as to what ports are used. The vendor, ISS, says the source port is 4000 and the destination port is random. It is memory resident and most antivirus products won't catch it. Here's Symantec's report: http://www.sarc.com/avcenter/venc/data/w32.witty.worm.html The vendor, has released a software update. The vendor says "The worm is very serious in nature, with potential destructive properties." A detailed ISS alert is at: http://xforce.iss.net/xforce/alerts/id/167 Also, if you go to this page: http://blackice.iss.net/contact_us.php Click on Knowedgebase and you'll see recent articles about the exploit and the Witty worm. Some reports suggest unplugging the network connection for any computer that runs Black Ice until it can be ugpraded. Anyone running Black Ice on Windows desktops or servers will want to take action. We've posted a Bulletin at help.msu.edu/status which we'll update as we learn more. /rich