Anatomy sheds new light on Storm Worm
Print storyUnknown DDoS tool, predecessors
Posted in Spam, 9th February 2007 01:21 GMT
Free whitepaper – Extended Validation SSL Certificates
A deluge of Trojan-laced spam that slyly tricked recipients by promising information about winter storms ravaging Northern Europe last month was even more crafty than we thought.
Among the new revelations: The Storm Worm malware launched DDoS attacks on a host of websites related to spam, antispam and just about anything else that may have piqued the perpetrators' ire, according to Joe Stewart, senior security researcher for SecureWorks. It also appears to be a close descendant of worms that spread in November and December, a connection that few if any have made until now.
Storm Worm captured the grudging admiration of those in the security industry for its uncanny ability to marry technical prowess with social networking. Within days of brutal storms sacking Europe, the email assault began bearing subject lines such as "230 dead as storm batters Europe." Sadly, plenty of recipients fell for the topical come-on. Over the next week, the worm played at least a half dozen variations on a theme, using subjects such as one claiming US Secretary of State Condoleezza Rice kicked German Chancellor Angela Merkel.
It was known to install a root kit that made victims part of a botnet.
Stewart says Storm Worm is a variant of the Win32/Nuwar worm that spread as early as November. Unbeknown to most at the time, Storm Worm also also installed a DDoS attack tool that wreaked havoc on various websites. Among them was spamnation.info, which is dedicated to countering the menace of spam. According to a February 3 posting, the site was shut down for eight days by a DDoS attack suspected to have been carried out by "spammers who were unhappy about the fact that the site publishes information about stock spam" .Other sites that were also targeted by Storm Worm included stockpatrol.com and several sites Stewart guesses were run by rival spammer gangs.
Stewart provides plenty of other details in his anatomy-of-a-worm report. Among other things, the worm downloaded additional payloads using the eDonkey/Overnet P2P protocol and a highly sophisticated series of hash values to keep the download sites from getting shut down ®.
Free whitepaper – Securing your Microsoft Internet Information Services (MS IIS) web server
Image spam: the threat returns
Jump start your Application Security initiatives
The shortcut guide to managing certificate lifecycles
Avoiding 7 common mistakes of IT security compliance
Email continuity
Google cloud told to encrypt itself
Buggy 'smart meters' open door to power-grid botnet
Chinese firm hits back at cyberspy claims
BlockMaster SafeStick hardware-encrypted USB drive