The Dataset on the Witty Worm

This dataset contains information useful for studying the spread of the Witty worm. The dataset is divided into two portions: a publicly available set of files that contain summarized information that does not individually identify infected computers, and a set of files that do contain more sensitive information, including packet traces containing complete IP and UDP headers and partial payload received from hosts spreading the Witty worm.

Data included in the Witty Dataset includes:

• Publicly Available:
  • distribution of start and end times of witty-infected computers
  • distribution of durations witty-infected computers were observed to be transmitting the worm
  • country distribution of witty-infected computers
  • estimated connection types of witty-infected computers
  • RouteViews routing tables for March 20-26 (also available from www.routeviews.org)


• Restricted Access:
  • summaries of the start and end times each witty-infected computer was observed to be spreading the worm.
  • summaries of the duration each witty-infected computer was observed to be transmitting the worm
  • the country each witty-infected computer is estimated to be in
  • the hostname of each witty-infected computer as of March 24, 2004
  • a table with the start and end times of each hosts's activity with packet and byte traffic volumes
  • packet traces containing Witty worm traffic monitored by the UCSD Network Telescope between Fri Mar 19 20:01:40 PST 2004 and Wed Mar 24 23:01:40 PST 2004.

Data Use Restrictions

Acceptable Use Policy for the public access files of the Dataset on the Witty Worm

1. Witty worm data, including every file in the Dataset on the Witty Worm, will not be redistributed.

2. I will not attempt to connect to, probe, or in any other way initiate contact with a machine or machine administrator identified via the Witty Worm data.

3. In so far as possible, privacy of end users (hosts) and networks monitored by the network telescope will be respected by the researchers. Any publications will anonymize, aggregate or summarize IP addresses, network names, and domain names, as appropriate when the disclosure of such information may present a security risk to those organizations or the general Internet.

4. At the end of the research, or semi-annually (which ever is less), a summary of the research and any findings/conclusions will be reported to CAIDA. If any research is described on the WWW, a URL will be provided. This information is primarily used in reports to our funding agencies.

5. In so far as possible, research findings and conclusions using Witty Worm data will be published and/or made publicly available. All users who publish (in any venue, including presentations, web pages, and papers) data from this dataset must provide CAIDA with a copy of the publication and must cite:

   The CAIDA Dataset on the Witty Worm - March 19-24, 2004, Colleen Shannon and David Moore, http://www.caida.org/data/passive/witty_worm_dataset.xml. Support for the Witty Worm Dataset and the UCSD Network Telescope are provided by Cisco Systems, Limelight Networks, the US Department of Homeland Security, the National Science Foundation, DARPA, Digital Envoy, and CAIDA Members.

Witty Dataset Access

• Publicly Available Witty Data
• Request Access to Restricted Witty Data

References

This dataset is cataloged in DatCat with handles:

• http://imdc.datcat.org/collection/1-0019-8=CAIDA+Witty+Worm+Data%2C+public+access
• http://imdc.datcat.org/collection/1-001B-W=CAIDA+Witty+Worm+Data%2C+restricted+access

For more information on the Witty worm, see:

• ISS vulnerability
  • eEye: Internet Security Systems PAM ICQ Server Response Processing Vulnerability
  • (mirrored at) Bugtraq: Internet Security Systems PAM ICQ Server Response Processing Vulnerability
  • ISS: Vulnerability in ICQ Parsing in ISS Products
  • Symantec: W32.Witty.Worm
• Worm code and function
  • LURHQ: Witty Worm Analysis
  • (via Bugtraq) Kostya Kortchinsky: Black Ice Worm Disassembly
• Witty Worm Spread Analysis
  • The Spread of the Witty Worm
• Publications using the CAIDA Witty Worm Dataset
  • http://www.caida.org/data/publications/bydataset/index.xml#witty

Acknowledgements

Special thanks to Brian Kantor, Jim Madden, and Pat Wilson at UCSD for support of the UCSD Network Telescope Project.

UCSD Network Telescope Sponsors:

The Dataset on the Witty Worm was sponsored by:

• Cisco Systems, Inc
• Limelight Networks
• The US Department of Homeland Security
• The National Science Foundation
• The Defense Advanced Research Projects Agency
• Digital Envoy
• CAIDA Members