http://blogs.msdn.com/b/michael_howard/archive/2004/05/10/129269.aspxThanks to Joel Scambray (coauthor of the Hacking Exposed series of books) for bringing this to my attention. Not many people paid much attention to this worm, because it affected a non-Microsoft product, but the analysis is interesting neverthelessen-USTelligent Evolution Platform Developer Build (Build: 5.6.50428.7875)http://blogs.msdn.com/b/michael_howard/archive/2004/05/10/129269.aspx#9657055Fri, 29 May 2009 23:08:32 GMT91d46819-8472-40ad-a661-2c78acb4018c:9657055 Michael Howard s Web Log The Spread of the Witty Worm | Paid Surveys<p>PingBack from <a rel="nofollow" target="_new" href="http://paidsurveyshub.info/story.php?title=michael-howard-s-web-log-the-spread-of-the-witty-worm">http://paidsurveyshub.info/story.php?title=michael-howard-s-web-log-the-spread-of-the-witty-worm</a></p> <img src="http://blogs.msdn.com/aggbug.aspx?PostID=9657055" width="1" height="1">http://blogs.msdn.com/b/michael_howard/archive/2004/05/10/129269.aspx#129935Tue, 11 May 2004 18:06:00 GMT91d46819-8472-40ad-a661-2c78acb4018c:129935Michael HowardThe fact that it affected &quot;only&quot; 12,000 hosts is interesting - and it is noted in the paper - it doesn't take millions of machines to support a worm. <div style="clear:both;"></div><img src="http://blogs.msdn.com/aggbug.aspx?PostID=129935" width="1" height="1">http://blogs.msdn.com/b/michael_howard/archive/2004/05/10/129269.aspx#129808Tue, 11 May 2004 15:16:00 GMT91d46819-8472-40ad-a661-2c78acb4018c:129808Dennis Forbes&quot;...because it affected a non-Microsoft product...&quot; <br> <br>I think a fairer statement is &quot;because its maximum impact was 12,000, often `low-value' hosts&quot; (who runs add-in software firewalls on high value machines?). Microsoft does get unfairly critical attention at times, but in this case I think your analysis was flawed.<div style="clear:both;"></div><img src="http://blogs.msdn.com/aggbug.aspx?PostID=129808" width="1" height="1">