Researchers trace Witty worm to its source

Scott Pinzon over at Watchguard Wire pointed out that a trio of researchers using innovative Internet-wide forensics discovered the source of last year's Witty worm.

The conclusion? Strong evidence indiciates that the Witty worm specifically targeted a US military base and was launched via an IP address corresponding to a European ISP.

The paper shows an awesome display of how forensic investigators can use network "telescopes" (machines that record packets sent to unused blocks of Internet address space) to help pinpoint the original source of this attack. Quite impressive if you ask me. The paper goes into depth on their approach, and I would recommend anyone interested in the field to take a look. A lot can be learned here. As Scott points out, the discovery of this technique bodes well for our future ability to capture worm authors.