Feeds

The balkanization of Storm Worm botnets

New hope in blocking prolific pest

Website security in corporate America

Creators of the Storm Worm Trojan have introduced a change to their malware that could help administrators trying to fortify their ISPs and networks against the prolific pest.

PCs infected by Storm in the past week or so use a 40-byte key to encrypt traffic sent through Overnet, a peer-to-peer protocol that helps individual bots connect to other infected machines, according to Joe Stewart, a senior researcher with SecureWorks, a provider of security services and software.

The change effectively segments the Storm botnet, estimated by Stewart to contain from 250,000 to 1 million machines, into smaller networks because each node must know the password to unencrypt the Overnet traffic.

Storm burst on the scene early this year after a flurry of emails carried subjects promising information about a winter storm that was savaging Northern Europe. Many of the recipients ended up getting infected by a Trojan that made their PC part of a network of infected computers. Criminals use such botnets to send spam and carry out distributed denial of service attacks, in which servers are flooded with more data than they can handle.

Since then, Storm has waged a series of ever-changing attacks, including pump-and-dump stock spam, fraudulent e-card messages and emails that promise racy pictures or romance to the lovestruck. The Storm botnet is hard to eradicate using traditional techniques because it relies on P2P technology, rather than connecting through a single command and control server.

New Weapon

The widespread use of encryption would provide a new weapon for administrators to fight back against Storm. Until now, one of the only ways to protect a network from the Trojan was to block all P2P traffic. That was fine for corporations and other organizations, but often proved problematic for ISPs and university networks.

Encrypted Storm traffic looks significantly different than regular P2P traffic sent using the Overnet protocol, making it relatively easy to write firewall rules that block the former while still allowing the latter, Stewart says. A researcher for the Bleedingthreats blog has devised a generic set of signatures that look for certain UDP packet sizes typical of Storm.

The balkanizing of bots into distinct botnets could be a sign that the Storm authors plan to sell services to spammers or other cyber criminals. But so far, there is little evidence such plans are in place, because Storm is only segmenting bots into two groups: those created in the last week and those created earlier.

Stewart says there could be other reasons for breaking bots into smaller groups, such as the desire for more nimble and manageable networks. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Blood-crazed Microsoft axes Trustworthy Computing Group
Security be not a dirty word, me Satya. But crevice, bigod...
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.