Kelly's article attempts to make a very interesting point, though it is not all that clear. The fact that Witty destroyed victims made its propagation and demise period fast enough that by the time it had been discovered spreading, it was no longer much of a media spectacle.

This interferes with one major principal of incident response: Learn as much as you can from others' mistakes, so that one of them does not become *your* next mistake. Even as I write this, many firewall administrators still haven't even heard of the worm.

This worm was far more destructive, and received far less attention, in spite of its target group: security products. The precedent is that these kinds of worms can almost silently exploit large populations of users and destroy their machines with impunity.

Good article, although it could have made its conclusion stronger.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/232/25720#25720