Feeds

Storm botnet blows itself out

But will the zombie network rise again?

The Power of One eBook: Top reasons to choose HP BladeSystem

Canadian pharmacy spam, pump and dump stock manipulation, and phishing scams were the most common types of nuisance messages distributed by the botnet.

Penis pills and phishing scams

Rival botnets such as Srizbi, Mega-D and Rustock supplanted Storm as the main producers of junk mail. Marshal's figures show a steady decline of spam from Storm botnet clients since the start of the year. The firm reckons Storm-compromised clients may have been subsumed into rival botnets and are continuing to churn out junk mail. However, it justifies its assertion the worm has petered out by noting that the command and control servers directing it are lifeless.

Still, few seriously believe the Storm worm's creators have abandoned the cybercrime business altogether.

"We have seen occasional surviving Storm bot peers still trying to communicate with each other," Hay said, "but the Storm’s command and control servers are unresponsive. Our data indicates that Storm has stopped. Maybe not forever, but the most likely scenario we can envision is that Storm has become obsolete in the face of other botnets like Srizbi which are more resistant against detection and removal by anti-malware solutions.

"A distinct possibility is that the creators of Storm have abandoned it in favour of a newer botnet that they have created. If they have, it is possibly one of the top spam botnets that we continue to track. It seems unlikely that Storm’s creators simply gave up and went home."

Marshal has posted a chart tracing the rise and fall of the Storm botnet here.

Diary of the Dead

Net security blog sudosecure.net backs up Marshal's analysis, with a few qualifiers. "I have not seen any spam, DDOS attacks, or Fast Flux domain activity related to the Storm Worm since mid September," writes sudosecure.net blogger Jeremy.

Jeremy went to the trouble of deliberately infecting a machine with a Storm worm client. He discovered other clients on the Storm p2p network but servers on the TCP control network responded only with the reply: "Go away, we're not home" - evidence that for all their faults, cybercrooks are not without a sense of humour.

It could be that the Storm worm authors have put everything on hold, or are simply lying low so that law enforcement attention drifts elsewhere, Jeremy speculates. "I think the question isn't 'is Storm dead', but more like when will we see it return and what new features or tactics will it have in store for us." ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.