Storm Worm Evolves To Use Tor

An anonymous reader writes "Seems like the Storm botnet that was behind the last two waves of attacks is also responsible for this new kind of social-engineering based attacks, using spam to try and convince users of the necessity of using Tor for there communications. They 'kindly' provide a link to download a trojaned version of Tor. This blog entry has a link to the original post on or-talk mailing list which has some samples of the messages."

Are we late to the party?

[Jennifer York (1021509)]

I'm surprised that it took this long for them to try to hide their tracks through anonymizers. Perhaps they've been doing this for quite sometime, and just now are we catching on to the technique...

It just makes sense, and is obvious, and a natural progression of the technology..... Hey! Maybe I should write a patent!

Re:Are we late to the party?

[liquidpele (663430)]

It's not that it's using anonymizing techniques that's new (they've always done this by using links to files already available on public webservers, or going through proxies, or spoofing where possible). This is just that the emails have changed from "verify your credentials with Bank XXX" to "Protect your privacy, downl0ad Tor (not trojan, we promise!)"

Re:Are we late to the party?

[VGPowerlord (621254)]

I'm still not sure why people would actually listen to that. I mean... why would anyone just download a random program from a website without looking up said program in, say, google to see what it actually does?

Unlikely

[by Anonymous Coward]

Yeah, if people would do crazy shit like that then we'd have botnets consisting of billions of computers... oh wait.

Re:Are we late to the party?

[liquidpele (663430)]

If it's something they've never heard of before, people are more likely to download and try it out of curiosity I suppose. But I do agree that it's the same old thing where you have to not be thinking to clearly or just not understand computers to be fooled to run it.

TFA says it's already detected by antivirus as Email-Worm:W32/Zhelatin.IL. so as long as the users have some antivirus they should still be okay too.

Re:

[maxwell demon (590494)]

I'm still not sure why people would actually listen to that. I mean... why would anyone just download a random program from a website without looking up said program in, say, google to see what it actually does?

That's easy to solve. Just add a helpful comment to the mail saying:

If you are not sure if you should install this program, get more information at http://www.evil.org/malware/installer.exe!

Re:Are we late to the party?

[rucs_hack (784150)]

if you look at sites like gamecopyworld.com you will find a wealth of programs that people will download for legitimate (in the consumers mind) use, to mean they can keep their game dvds in their boxes. Add 'trainers' and 'fun free games' to the list and your looking at the majority of casual downloads not directly involving pron or media.

The main problem though is closed source. If source is closed, then there is no easy way to find malicious code before it is deployed on your system. Ok, I'm speaking as a programmer, so that would be useful for me, not a non coder. Still, the point remains, binary distribution only means trouble, be it storm, a sony rootkit, or just 'phone home' code in a program.

What we need is something sort of like gentoo, where all programs are compiled locally, and the code can be inspected for malicious intent. Alas such technology, while it does exist, does not exist in a form that could be disseminated and used by people with no technological background. This is a pipe dream for the moment, I know this. Especially since I tried once to compile openoffice locally (18 hours I think). Perhaps trusted compile farms that deliver fresh binaries?

Waxing lyrical I know, but there has to be an answer somewhere.

Re:

[ThisNukes4u (752508)]

Only if you can also trust the compiler chain [cmu.edu].

Re:

[CastrTroy (595695)]

Just because somebody can verify the code, doesn't mean I want to spend days/weeks looking through all the code in a newly downloaded program, just to verify that it isn't doing something I don't want it to, and hope that I didn't miss anything in the millions of lines of code. Do most people who use Gentoo even bother reading more than 1% of the code? Sure it's good after the fact if you find malware that you can pin it on someone, but the best way to deal with this stuff is don't run software from untru

Real programmers don't need source code.

[sowth (748135)]

Oh come on! You aren't a real programmer. Everyone knows the binary is the source code. My uncle eddy doesn't even need those fancy disassemblers or debuggers. He edits memory by looking at LEDs and flipping dip switches. Now that is a real programmer.

Re:

[Iron Condor (964856)]

The main problem though is closed source. If source is closed, then there is no easy way to find malicious code before it is deployed on your system. Ok, I'm speaking as a programmer, so that would be useful for me, not a non coder. Still, the point remains, binary distribution only means trouble, be it storm, a sony rootkit, or just 'phone home' code in a program.

Not really. In a binary I can at least in principle parse rudimentarily for things like "does this ever call the TCP/IP stack" and raise a fl

Re:Are we late to the party?

[plover (150551)]

Because the modestly intelligent person you are hoping for might think, "This says to install tor, let me open a new window and google for it. Hey, this tor thing looks pretty good!" It's the sort of reaction we encourage people to have, to do some research before installing.

Of course, they then follow the original link from the worm and they still get the trojan. So close, and yet so far... sigh.

Re:Are we late to the party?

[Urd.Yggdrasil (1127899)]

They aren't using Tor to hide their traffic, their trying to trick users into download a Trojan saying that it is a Tor executable and they need to protect their privacy. The Storm bot net uses a system called Fast Flux to hide traffic.

Re:

[zippthorne (748122)]

Surely they are also using their compromised TOR nodes for some nefarious deeds. Like de-anonymizing...

Re:

[Goaway (82658)]

Why the hell would they care about de-anonymizing? No money in that.

Re:

[plover (150551)]

Why the hell would they care about de-anonymizing? No money in that.

Are you kidding? If you could trace back a tor link to gaysex.com/bathroomEncounters.mpg to Senator Larry Craig's machine, don't you think TV shows like Dateline would be offering you tens of thousands of dollars for it?

Um... excuse you?

[Linkiroth (952123)]

Your link didn't work.

Re:

[Goaway (82658)]

You're expecting a SENATOR to be able to use TOR?

Storm is still a trojan, not a worm

[A beautiful mind (821714)]

As always, it works based on user stupidity, not programmer stupidity.

Re:Storm is still a trojan, not a worm

[Spy der Mann (805235)]

As always, it works based on user stupidity

Oh no, the internet's doomed! :(

Ummm.

[crhylove (205956)]

Anybody here taking this activity more seriously? For instance, is there a possibility that this is a military operation? Seems a lot more advanced than most of the usual spam/bot/virus stuff I read about. I hope they don't screw up TOR, especially since I'm living in more and more of a police state these days (US).

Re:

[memnock (466995)]

if TOR goes down, it's likely another network would pop up in it's place.

Re:Ummm.

[Colin Smith (2679)]

Seems a lot more advanced than most of the usual spam/bot/virus stuff I read about.

You mean... More intelligently designed?

 

Re:

[Silver Sloth (770927)]

For instance, is there a possibility that this is a military operation?

No, this is private entrprise at its best - the high tech goes where the money is.

What is surprising is that it's taken so long for the spammers to realise that by investing ih a high tech, well engineered solution they can make far more money than the low tech solutions we've seen in the past.

Spelling...

[rumith (983060)]

using spam to try and convince users of the necessity of using Tor for there communications.

It took me a second to understand what the author meant. Spell-checking, anyone?

Speaking on topic, I'd like to correct one of the previous posters: it's not a mere variation on the "Use XXX Bank" theme; as far as I understand, Tor has been picked among tons of other software that could be infected and supplied to users because it helps the spammers in covering their tracks, since their email is routed through Tor now.

Need editors who EDIT

[The Monster (227884)]

Arguably, what is needed is the low-tech sort of spell-checker. Before we had automated computer programs, newspapers had people called 'copy editors' who would proofread the articles submitted by the reporters. They were looking not only for spelling, grammar, and usage problems, but they also would do fact-checking.

Perhaps we could make the distinction clear this way: A machine that sells soft drinks is often referred to as a 'vender', while the guy selling hot dogs is more likely to be called a 'vendor'. With that in mind, I have toyed with a similar convention for other verb+er nouns:

The person who checks spelling could be a spell-checkor, and the computer program would remain the spell-checker; the human surfing the Web would be a browsor, using a browser program. Programs such as vi or emacs would be editers....

It's got as good a chance of adoption as *bibyte does.

Now, if Cmdr Taco could just get editors who actually EDIT... Oh. He's the 'editor' who ran this story? Never mind.

Who is behind the Storm Botnet?

[kryptkpr (180196)]

There is an excellent article in Wired from several weeks ago from when Storm was used to DDoS the entire country of Estonia for 2 weeks. A fantastic read, but here's a particularly scary excerpt: Hackers Take Down the Most Wired Country in Europe [wired.com]

If that is the case -- if Azizov isn't trying to cloud the issue -- the implication is perhaps more troubling. It suggests that there is a group of Russian hackers who, on their own, can disrupt the routine functioning of commerce, media, and government any time they want. If so, these hackers represent a stateless power -- a sort of private militia.

While the article does contain a lot of speculation and sketchy sources (like the above quoted Azizov) the evidence does seem to be pointing in a particular direction:

I ask him why anyone would trust him. After all, he seems to have a suspiciously intimate knowledge of the Estonian attacks. "Russian IT specialists are knowledgeable and experienced enough to destroy the key servers of whole states," he says. "They're the best in the world."

The implication: Clearly you want them on your side, so why not hire them? Maybe Estonia was simply an advertising campaign.

It's starting to look an awful lot like another Cold War is coming, except this time it will be a Cyber war waged by turning your enemy's (and the rest of the world's) poorly secured computers against their critical infrastructure while the actual government absolves itself of blame. Nice.

Re:

[Opportunist (166417)]

"Hackers"? "Crackers"? Could we simply say "assholes" and concentrate on something meaningful? Like, finding some solution to it before our politicians get active and replace their cluelessness with operative hectic? It's fairly certain that some kind of law will be created, most likely one that has nothing to do with the problem, doesn't adress it at all, doesn't solve a thing and cripples the net.

Who are the stormbot people?

[tjstork (137384)]

Seriously, somewhere, there ought to be a way of tracking the stormbot people back to its originators. From there, you can just send in a special forces team and just whack the guys. If one nation allows its citizens to hijacking of the assets of millions of another nation's citizens, isn't that just piracy by any other name, and if so, isn't that kind of an act of war?

Re:Who are the stormbot people?

[Urd.Yggdrasil (1127899)]

The group running the system is taking precautions to avoid detection, such as using Fast Flux [honeynet.org] Also it is speculated that they are in a former Soviet block country, which tend to have very poor laws and few resources to go after such people.

Re:

[Colin Smith (2679)]

Damnit. The bad guys get all the best software!
 

Re:

[ThinkingInBinary (899485)]

I've read that IPv6, because it includes the MAC...

IPv6 only includes the MAC if it is configured using Stateless Autoconfiguration, and if Privacy Extensions are not turned on. If it is configured using some stateful method, like DHCPv6 or a static IPv6 address, the address could be anything. Likewise, if Privacy Extensions are turned on, then Stateless Autoconfiguration will rotate among random address that don't include the MAC, but are still unlikely to collide with other hosts' addresses.

But what g

Re:Who are the stormbot people?

[by Anonymous Coward]

Seriously, somewhere, there ought to be a way of tracking the stormbot people back to its originators.

Theoretically "yes". But in practice the answer is "no".

The people running this botnet can choose from millions of computers they want to use as anonymous bouncers/routers. And they can tripwire their nodes so that after 30 minutes of use as a bouncer, the hard disks are overwritten with 0's (although in most cases this isn't required as IP addresses wouldn't be stored anyway).

A chain of 20 hacked computers spanning the globe operating as routers is not easy to trace. You have to talk to each owner in the chain one-by-one and catch the bounced connection in realtime to reveal the IP for the next node in the chain. And the attackers can obfuscate their presence by programming their bots to simulate these proxy connections at random. Imagine having to trace through 100,000 chains, each containing 20-30 routing nodes. These chains are completely dynamic and randomly change every half an hour.

The Storm botnet is almost the "perfect hack" unless the perpetrators make some big mistakes. If the owners of this botnet installed Freenet on all the bots, we'd have an unenforceable darknet which can only be blocked (maybe! - if you're really lucky) at the ISP. Anyone could tap into this new darknet and do as much internet crime as they like without ever having to worry about getting caught.

Re:

[1u3hr (530656)]

Theoretically "yes". But in practice the answer is "no". The people running this botnet can choose from millions of computers they want to use as anonymous bouncers/routers

So work from the other end. How do they make their money? Sending spam, apparently. How does spam make money? Currently, either by getting suckers to send money to them (viagra, Rolexes, etc) or pumping stocks the spammers have bought. In both cases, there must be a money trail, much easier to track than chasing a chain of proxies. T

Re:Who are the stormbot people?

[liquidpele (663430)]

"Iraq is on the upswing"

If by upswing, you mean on the verge of civil war...
I'd recommend reading bbc.co.uk instead of Fox news there buddy.

I really hope Iraq turns for the better, but right now everyone educated there is packing up and leaving so It's going to be really hard.

Look at the timeline.

[khasim (1285)]

But less so than a year ago. sectarian killings are down. Anbar is quieting up. Baghdad is, yes, basically being ethnically cleansed, and right we're really more presiding over a partition of the country than its unification.. but it is what the people of Iraq really want...

The killings are "down" in that each section has pretty much killed everyone they didn't like in that section. Or the people that were being targeted have run away.

But warlordism is not a basis for a stable country. Which is why Iraq's "

Re:

[MrNaz (730548)]

When I read opinions like yours, I am left speechless every time. Even though by now I am used to head-up-the-arse, totally ignorant people on Slashdot, people like you never cease to amaze me. You are truly a leader among fools.

When your users are illiterate ...

[DrSkwid (118965)]

it is easier to infiltrate there[sic] communications.

Re:

[DrSkwid (118965)]

are you su're ?

Misleading headline

[yuna49 (905461)]

The Storm worm isn't using Tor.

The spam email in question tells the reader that, if they are running torrents, they should use this Tor thing to cover their tracks. The link points to the trojan. The file in question is about 150K in size, or about 20x smaller than the Windows version of Tor (2-3 MB) on the actual site [eff.org].

I posted a warning about this very email on a well-known anime site since I suspected some people there might download it in response to the e-mail.

There's also a version that poses as a YouTube video.

Most of these emails have URLs that use IP addresses, not domain names. Between my SpamAssassin rules and Mozilla Thunderbird's built-in anti-malware protections, messages like these are either quarantined or tagged as dangerous. I've not seen an legitimate email from any correspondent that uses URLs with IP addresses in the host part.

I opened the YouTube version in a Windows VM that had Kaspersky installed. It identified an attempted replacement of tcpip.sys and told me it should be quarantined. Unfortunately a ClamAV scan of the file did not detect anything suspicious.

The largest problem with Anti-Virus software is...

[Svartalf (2997)]

...that it's akin to closing the barn door after all your livestock's gone out it.

In order for pretty much all Anti-Virus software to work, you're skimming for signatures patterns in the bytes
that leave a tell-tale for the software to "identify" it. It's always lagging by a bit, by the reality of the situation, so
it's truly a reactive solution to a problem that needs more of a proactive one.

That's not to say that the software is not useful for detection of attacks (much like an IDS is for networking...)

My question is..

[XenophileJKO (988224)]

If the command and control and updating is done via peer to peer instead of a centralized server, why has nobody created a "Vaccine" that would spread itself back to all the infected nodes. The code can't be that hard to crack to determine how to insert new functionality into the infected hosts. Just inject a new command to spread this update to all your peers and after you succeed, close down all of the command and control vectors. Cleanup and fixing the holes originally used for infection would clearly be useful too, but unnecessary to contain the damage. Really there are tons of things you could do.

I mean this might create an "arms race" where they continue to lock down access to the botnet, but I would love to see the looks on their faces when large sections of the botnet stop responding to commands.

Seriously as "Brilliant" as these guys are I guarantee there are probably people smarter that can crack their network. I know what I am talking about is probably not legal, but it surely is ethical.

There was such a anti-worm worm...

[Bananatree3 (872975)]

The Nachi worm [nai.com] was written to search out computers infected with the now-famous Blaster worm and patch the computer with a Microsoft patch. It replicated itself around the world, and once the patch had been implemented and the Blaster worm deleted it deleted itself. Unfortunately it created a heck of a lot of traffic on infected networks [zdnet.com], which slowed them down considerably.

time traveller from 1987 goes 20 years in future,

[circletimessquare (444983)]

gets a sneak peek at Slashdot headlines:

"hmmm, what is going on in the far off fantastical future of 2007?"

Bringing Science and Math Into Writing?

"Ah, an age old problem"

Libraries Defend Open Access

"Some sort of Fahrenheit 451 situation? has the government gone fascist? or the russians won the cold war?"

New Legislation Proposed For Nuclear Safety

"Ah! Chernobyl is still fresh in their minds! At least it seems we didn't nuke each other"

Storm Worm Evolves to Use Tor

"SWEET JESUS! DUNE IS REAL!? AND IN CAHOOTS WITH THE SCANDINAVIAN GODS? WHATR SORT OF SCIFI FANTASY FUTURE IS THIS!"

You don't have to download the file to be infected

[sjmurdoch (193425)]

Actually, if you're using an unpatched browser, you might not even have to download the file they offer to be infected. The web page includes Javascript exploits for half a dozen security vulnerabilities, which will install the trojan without user interaction. I've posted an analysis [lightbluetouchpaper.org] of the malware code on my blog.

Despite what the article says, Storm isn't using Tor (other than trying to exploit it's reputation) and the download isn't a trojaned version of Tor – it's much too small to be that. What's more, the botnet operators appear to have dropped this strategy. While on Thursday the links in the spam went to a fake Tor download [lightbluetouchpaper.org] page, on Friday they showed a fake YouTube video [lightbluetouchpaper.org], and now they show a fake NFL game tracker [johnhsawyer.com].

This is *not* using the Tor network or software

[shava (56341)]

This attack is not using our network or our software, only abusing our reputation. We sent this release to slashdot and others, days ago:

====
The Tor Project, a US non-profit organisation producing Internet
privacy software, is issuing an urgent warning about a spam email
being circulated as a fake promotion for their software.

The real Tor software provides privacy on the Internet to journalists,
bloggers and human rights activists all over the world. The spam email
promotes the virtues of the software, but then directs people to a
series of fake websites that contain malicious code that will attempt
to take over visiting machines, and the downloaded software is fake
and equally dangerous to run.

The real website is hosted at http://tor.eff.org/ [eff.org] and the Tor
software can be downloaded from there. Users are able to check that
they have received the official version by following the instructions
at: http://wiki.noreply.org/noreply/TheOnionRouter/Ver ifyingSignatures [noreply.org]

Shava Nerad, Development Director for the Tor Project said, "I am
disgusted that criminals who want to recruit more machines for their
illegal activities should trade on our reputation for providing
privacy on the Internet. Fortunately we already have systems in place
so that people can verify that they are downloading the official
software. But this is a distraction from our work that we could do
without."
====

This stuff makes us sad. But you won't even get a trojanned client, just a trojan. And the page you click through to will try to exploit holes in your browser security, so don't even click through.

Yrs,
Shava Nerad
Development Director
The Tor Project

Note to world: computer programs don't evolve

[gatkinso (15975)]

Human beings modify them, fix bugs, and upgrade them. Be it a computer virus, spreadsheet, or operating system.

Sometimes they intentionally break them.

But they don't spontaneously "evolve", "mutate", or any other such thing.

Christ.

Is Windows to blame for this situation?

[master_p (608214)]

Apart from user stupidity, is Windows to blame for this situation? if Windows had a better security model, would there be such problems?

Can a massive lawsuit against Microsoft work?

Re:

[ScrewMaster (602015)]

You'd think they would have picked something more appealing to the masses.

Probably they have. Odds are they're sending out a ton of different emails recommending various downloads. My server extracts all incoming attachments and puts them in a shared folder (my client machines never see attachments, just a note saying that there was one) but I see all kinds of executables coming in, with all kinds of rationales to convince people that clicking the link is a good idea. Tor is just one of them. Unfortunate

several ways

[Bananatree3 (872975)]

There are several ways [findarticles.com] spammers get emails. They can do massive internet searches for emails and harvest them that way (if you post on USENET with your email addy its almost gueranteed to be spammed). They also guess a username and if it doesn't bounce back they know they've got a hit.