Feeds

The balkanization of Storm Worm botnets

New hope in blocking prolific pest

5 things you didn’t know about cloud backup

Creators of the Storm Worm Trojan have introduced a change to their malware that could help administrators trying to fortify their ISPs and networks against the prolific pest.

PCs infected by Storm in the past week or so use a 40-byte key to encrypt traffic sent through Overnet, a peer-to-peer protocol that helps individual bots connect to other infected machines, according to Joe Stewart, a senior researcher with SecureWorks, a provider of security services and software.

The change effectively segments the Storm botnet, estimated by Stewart to contain from 250,000 to 1 million machines, into smaller networks because each node must know the password to unencrypt the Overnet traffic.

Storm burst on the scene early this year after a flurry of emails carried subjects promising information about a winter storm that was savaging Northern Europe. Many of the recipients ended up getting infected by a Trojan that made their PC part of a network of infected computers. Criminals use such botnets to send spam and carry out distributed denial of service attacks, in which servers are flooded with more data than they can handle.

Since then, Storm has waged a series of ever-changing attacks, including pump-and-dump stock spam, fraudulent e-card messages and emails that promise racy pictures or romance to the lovestruck. The Storm botnet is hard to eradicate using traditional techniques because it relies on P2P technology, rather than connecting through a single command and control server.

New Weapon

The widespread use of encryption would provide a new weapon for administrators to fight back against Storm. Until now, one of the only ways to protect a network from the Trojan was to block all P2P traffic. That was fine for corporations and other organizations, but often proved problematic for ISPs and university networks.

Encrypted Storm traffic looks significantly different than regular P2P traffic sent using the Overnet protocol, making it relatively easy to write firewall rules that block the former while still allowing the latter, Stewart says. A researcher for the Bleedingthreats blog has devised a generic set of signatures that look for certain UDP packet sizes typical of Storm.

The balkanizing of bots into distinct botnets could be a sign that the Storm authors plan to sell services to spammers or other cyber criminals. But so far, there is little evidence such plans are in place, because Storm is only segmenting bots into two groups: those created in the last week and those created earlier.

Stewart says there could be other reasons for breaking bots into smaller groups, such as the desire for more nimble and manageable networks. ®

The essential guide to IT transformation

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NZ Justice Minister scalped as hacker leaks emails
Grab your popcorn: Subterfuge and slur disrupts election run up
HP: NORKS' cyber spying efforts actually a credible cyberthreat
'Sophisticated' spies, DIY tech and a TROLL ARMY – report
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?