Storm Worm Being Reduced to a Squall

Rumours of financial schemes surrounding the botnet aside, PC World has an article that should lower the blood pressure of some SysAdmins. The Storm Worm botnet is apparently shrinking. A researcher out of UC San Diego who has been tracking the network has published a report indicating it is now only 10% of its former size. "Some estimates have put Storm at 50 million computers, a number that would give its controllers access to more processing power than the world's most powerful supercomputer. But Enright said that the real story is significantly less terrifying. In July, for example, he said that Storm appeared to have infected about 1.5 million PCs, about 200,000 of which were accessible at any given time. Enright guessed that a total of about 15 million PCs have been infected by Storm in the nine months it has been around, although the vast majority of those have been cleaned up and are no longer part of the Storm network."

Spread of Windows

[Prysorra (1040518)]

Anyone else think that the rather lax enforcement of Windows piracy is helping to create the possibility of massive botnets?

Just wondering.

Re:Spread of Windows

[Colin Smith (2679)]

Hmmm... Windows as a threat to national security ...

Imagines SWAT teams dodging chairs as they storm Microsoft headquarters to screams of "You'll never take me alive copper!"

 

Re:Spread of Windows

[rustalot42684 (1055008)]

But then SWAT is beaten back by Clippy:
It looks like you're trying to raid the Redmond campus. Would you like to:

• Hunt and kill all the employees
• Destroy the supercomputer cores
• Uncover the secret plot for world domination
• Just raid the campus without help

# Don't show me this tip again

Re:

[Gerzel (240421)]

Balmer is a master of his art. There would be no dodging.

Maybe.

[khasim (1285)]

From TFA:

Then on September 11, Microsoft added Storm detection (Microsoft's name for Storm's components is Win32/Nuwar) into its Malicious Software Removal tool, which ships with every Windows system. Overnight, Storm infections dropped by another 20 percent.

Anyone have any info on whether Microsoft's tool would detect it earlier?

Re:

[sakdoctor (1087155)]

I'd say enforcement of Windows piracy is the least lax that it has ever been.
WGA raises the barrier of casual copying to lusers who's skill wouldn't have been enough to stop them getting pwned by some virus, and being incorporated into a botnet.

Re:

[by Anonymous Coward]

Thats part of the problem. One of the ways they protect against privacy is keeping you from getting updates. This leaves unpatched pirated systems out there. Since there is no real legal threat for the average user the only real motivation for a person to get a legit copy is so they can get security updates easily. Joe Six Pack is just going to borrow that pirated copy of XP his buddy picked up at a flea market. OP brings very valid point

Re:

[LO0G (606364)]

Huh? According to Microsoft they security updates to pirated versions of Windows. Source: (click on "Will users of non-genuine Windows be blocked from receiving security updates?") [microsoft.com]

It also appears that the Malicious Software Removal Tool [microsoft.com] doesn't require validation either.

So you can run the same malware removal tools on pirated versions of Windows as well.

Re:Spread of Windows

[Keruo (771880)]

> It also appears that the Malicious Software Removal Tool [goodbye-microsoft.com] doesn't require validation either.

Fixed your link.

Re:

[petermgreen (876956)]

Huh? According to Microsoft they security updates to pirated versions of Windows.
they do kind of.

If you want to run pirate windows without getting nags and you don't have access to a good (as in allocated by MS and not shitlisted because of wide distribution) corp key you have to either crack windows genunine advantage notifications or keep it off your system. Cracking it has the downside that MS could release an update at any time.

There are two easy ways to keep windows genuine advantage notifications off

Re:

[Bearhouse (1034238)]

Good post, with which I agree totally, and is probably useful for some, thus 'insightful', I guess.

I've given up on windows activation, for much the same reasons as yourself. I seem to spend my weekends re-installing friends and neighbours windows PCs, and have either purchased, or legal access to, ALL the flavours of XP, (and Vista etc.)

The easiest installs (for 'office' too) are *always* the unattended, slipstreamed 'pirate' versions found on the net, (suitably checked, of course). Update the serial num

Re:

[LO0G (606364)]

So? First off, the IE team claims that IE7's going to be available without WGA [msdn.com]. So part of that is no longer valid.

Also, I was responding to a claim that Microsoft witheld security updates for people who were running pirated versions of Windows. I provided a link from Microsoft that seems to indicate otherwise.

Why is this a problem? Are you saying that Microsoft is lying in their post?

Re:

[$RANDOMLUSER (804576)]

Or possibly it's the lax enforcement of security standards by Redmond programmers? Or the lax attitude of Microsoft about all things not directly related to increased sales and world hegemony?

Re:

[wizardforce (1005805)]

Anyone else think that the rather lax enforcement of Windows piracy is helping to create the possibility of massive botnets?

no. windows does just fine getting infected by its self, it doesn't need a pirate's help arrrr.

Re:

[vtcodger (957785)]

***Anyone else think that the rather lax enforcement of Windows piracy is helping to create the possibility of massive botnets?***

Why would anyone think that? Windows is Windows whether it's pirated or paid for. Is a drunk weaving through heavy traffic at 135kph any more or less of a menace if he's driving a stolen car rather than a car he "owns"?

Re:

[diskis (221264)]

That argument is getting a bit dated. Linux is used more and more as servers. More processing power, more bandwidth and not so competent administrators. I know a lot of machines sitting un-updated on 100mbit or faster. They have been sitting for years serving as storage for irc logs, simpsons episodes and funny pictures. Still they are not part of any botnets.

Re:

[Anpheus (908711)]

Made up statistics* count for around 9/10ths of the reason you say that.

* over the past six months, the number of made up statistics has TRIPLED! wiki it!

Good

[Colin Smith (2679)]

Now that it's down to 5 million we can all breathe a sigh of relief...

 

Oblig.

[The Living Fractal (162153)]

Couldn't this just be the 'eye' of the Storm?

Or is it possible that Windows boxes really are just getting more secure? Ohh shit I asked THAT on Slashdot?! Charles Stross will have my soul. /owenwilson

Re:Oblig.

[marcosdumay (620877)]

Windows boxes are getting more secure all the time.

But we can only guess when they will be ready for widespread use...

Re:

[ConceptJunkie (24823)]

Yes, unfortunately, it's a toss-up between whether Vista is more secure because of better security features or it's more secure because no one uses it.

Re:

[morgan_greywolf (835522)]

I think that the problem of viruses would be greatly reduced if people were less ignorant about viruses.

I think the problem of viruses would be greatly reduced if people were less ignorant about how their behavior causes them to get viruses.

Windows can be an okay operating system security-wise, if people didn't do these things:

Run Internet Explorer: IE is buggy and and insecure. If everyone replaced it with Firefox with the NoScript plugin installed, you could watch how much fewer viruses there would be.

Re:

[budgenator (254554)]

Windows XP SP2 has been out for long enough that their is no excuse for an application that can't run in a LUA environment; the only company that has gotten it right is Sun Microsystems, installing Java is standard for how all software should install on windows. In most software you have to jump through so many hoops to get it installed that most people give up and just run everything as admin. Here's the killer aunt Millie goes to a website and needs to install a plug-in to see all of the content, let's sa

don't be sure

[phantomfive (622387)]

The researcher determined this with a spider he created to crawl the storm network. How does he know that the network is shrinking and not just being partitioned? [slashdot.org]

Furthermore, the storm virus is known to be updatable. Is it possible it was updated to be even less obtrusive, thus escaping detection in other ways? Maybe it has gone into dormant mode, because the creator doesn't need so many computers at the moment.

One interesting innovation of the worm, quoted from the article:

"If you're a researcher and you hit the pages hosting the malware too much... there is an automated process that automatically launches a denial of service [attack] against you," he said. This attack, which floods the victim's computer with a deluge of Internet traffic, knocked part of the UC San Diego network offline when it first struck.

I think some part of me must be sick or something, because when I read about this I almost hope the worm will get bigger, become unstoppable, and reveal windows for the insecure piece of crap that it is. Linux, BSD, OSX, Solaris, and heck even Minux could clearly stand up to a threat like this much more easily than Windows.

Re:don't be sure

[John Hasler (414242)]

> I think some part of me must be sick or something, because when I read about this I
> almost hope the worm will get bigger, become unstoppable, and reveal windows for the
> insecure piece of crap that it is.

Already been done. Nobody cares.

Re:

[MoogMan (442253)]

Linux, BSD, OSX, Solaris, and heck even Minux could clearly stand up to a threat like this much more easily than Windows.

Bzzzt! Wrong. There are many attack vectors for Storm's entry into someone's computer (one of which is indeed an OS vulnerability). AFAIK, the majority of the attack vectors rely on people downloading some bootstrapper program via their email or web browser. Nothing is going to stop this happening to a "normal" user on *NIX.

Re:

[Master of Transhuman (597628)]

OTOH, the bot has to communicate out. As a normal user not running as root, that means it has to open a port. Many Linux distro firewalls - and some Windows third party firewalls, but not the standard Windows firewall - block incoming and outgoing ports by default unless explicitly opened. If the bot can't commmunicate, it's worthless to the botnet.

Of course, the Worm might be smart enough to trick the user into opening a port by popping up a message and requesting it masquerading as a legit program - but I

Re:

[Sancho (17056)]

Which Linux firewalls block outgoing connections by default? In my 12+ years of using Linux, I have never seen this behavior configured by default.

Re:don't be sure

[phantomfive (622387)]

Heh, I knew someone was going to trot out this old troll. The point is, it would be much easier to secure unix-type systems than windows-type systems. Compare Microsoft's budget to that of OpenBSD; now tell me, which is more secure?

For it to be effective as a virus, it is going to have to install itself to startup somehow. What is going to do, add a line to my .bashrc? Add a script to /etc/rc.d? It can't do that, only root can, and I don't browse the internet as root. Nobody does.

You may say, "it will prompt you for the password and idiot users will just type it" but you are showing your Windows bias. On windows, you get so many popup prompts that many users just ignore them and do whatever they ask. OSX has shown that it can be done differently, however. Ask any average OSX user what they would do if a downloaded attachment asked them for their root password, and they will say something to the effect of, "Freak out and delete it immmediately." It's because the warnings and prompts in OSX don't become annoying.

Security on Windows is hard. For any vulnerability, it takes a lot more effort to fix on Windows than a similar vulnerability in a Unix system. In unix-world, fixing the OS is an option.

Re:

[Sancho (17056)]

With Windows, almost everyone runs as Administrator, so the software doesn't have to do anything special to hook into the OS while beings stealthy. On Linux, being stealthy (against most non-knowledgeable users) would just mean adding a line to .xinitrc or .bashrc. If you set your parents up with Ubuntu, would they know to look there? Would most people who aren't deep into the Unix culture?

Viruses on Linux would be easier to clean as long as the user isn't running as Root all the time (and the virus does

Re:

[phantomfive (622387)]

See, this is where it breaks down. If you are clever, I'm sure you can think of half a dozen ways to defend against this. The easiest I can think of in 10 seconds is to replace the .bashrc/.xinitrc with something standard every time a user logs in. A bit annoying, maybe; but effective.

This is why unix is so much easier to harden. Because of it is well-designed, there is much more flexibility when trying to think of a defense.

Re:

[Master of Transhuman (597628)]

I was wondering about the possibility of it being partitioned myself.

The botnet has always been hard to figure out the size because of its policy of only allowing a limited number of immediate connections in its net. Partitioning and assigning control of sections to other people - and this would presumably entail cutting connections with other portions of the botnet completely in order to enforce "ownership" - would presumably make it look smaller than it is.

This guy may also be overconfident in the crawli

Bullshit

[by Anonymous Coward]

Myself and some colleagues, along with a couple of anti-malware sites have been tracking Storm infections as best we can over the last couple of months. We've mostly been using honeypots, trapping SMTP traffic and utilizing some nslookup scripts to mine Storm's fast-fluxing domains. It has not shown any sign of shrinking, particularly not by a factor of 10.

The only people who have ever estimated its size to be anywhere near 50 million hosts are paranoid tin-foil hat wearing security analysts and journalists looking to generate some ad revenue with a shocking headline or two. I've never seen any solid evidence pointing towards Storm being larger than 2-3 million hosts, so even assuming there is an exact science at work here, 1.5 million is far from a 10th of 2-3 million.

This phenomenon would be a lot easier to combat if people would stop spreading bullshit stories such as this.

Re:

[sg_oneill (159032)]

Whatever the case is, its a nasty piece of work. Theres precious little that'll stand up to that thing focusing fire on a target.

Oblig Inverse

[hksdot (1128515)]

I for one bid farewell to our swarm intelligence worm overlords.

...reduced to a Squall

[Wonko the Sane (25252)]

So it now has a scar on it's face, and carries a sword-gun?

Re:looking for details on storm botnet control

[liquidpele (663430)]

Your thinking of botnets in the 1990s. This is 2007, Storm communicates with a hacked version of the eDonkey p2p protocol, and redirects all P2P traffic and DNS requests through nodes acting as proxies to the "motherships", so it's much harder to track. All P2P traffic is encrypted with 40 BYTE encryption (not 40 bit mind you).

Re:

[v1 (525388)]

and redirects all P2P traffic and DNS requests through nodes acting as proxies to the "motherships"

ok so why are they not focusing on these "nodes"?

Re:

[nuzak (959558)]

> ok so why are they not focusing on these "nodes"?

Three guesses as to how storm supernodes get installed.

Re:

[v1 (525388)]

That's a very interesting read. I hope the authors release a similar, more up-to-date rundown of Storm. it sounds like Curious Yellow is one step before Storm in terms of worm evolution. (or that it was the successor to it?)

Re:

[ymgve (457563)]

Doesn't matter that it's 40-byte. It's using simple XOR encryption, and the key is stored in plaintext inside the unpacked executable.

(If anybody cares, the current key, atleast for the botnet partition I've seen, is F3 AA 58 0E 78 DE 9B 37 15 74 2C 8F B3 41 C5 50 33 7A 63 3D E6 13 DF 6C 46 CA BE 9A 77 48 94 02 C0 F3 66 49 EE 87 21 BB.)

Re:looking for details on storm botnet control

[ymgve (457563)]

A few days old now, but these IPs are some of the ones that have been taken over to host the malware. Add http:/// [http] to the front, and download the executables from there.

!!! WARNING - THESE SITES CONTAINS JAVASCRIPT EXPLOITS AND POSSIBLY OTHER EXPLOITS - APPROACH WITH CAUTION !!!

70.241.136.75
24.31.16.133
68.58.22.93
69.153.22.0
24.30.230.51
75.23.213.0
76.22.95.226
76.87.15.223
213.85.39.178
68.126.134.102
68.81.124.62
200.127.28.133
68.158.67.73
68.42.159.205
66.30.37.175
12.202.175.97
200.106.170.69
86.127.5.24
195.3.220.153
24.0.96.97

Re:

[bucky0 (229117)]

From what I remember, there's no central IRC control. The bots all join in a p2p network and share files with commands to be executed. The herder uploads a command file with a specific (spoofed) hash, and the bots spread them over the P2P network to the whole network. The reason noone's been able to pull the plug is because there's no central IRC server that people can target, the commands are just files on a p2p network.

Re:Mac and Linux users

[TheRaven64 (641858)]

Just breathed a collective sigh of relief... Oh wait, maybe they were just rolling their eyes and sighing.

No, we get spam from Windows zombies the same as everyone else.

Re:Mac and Linux users

[Torvaun (1040898)]

Windows can be secured. I've got an XP desktop for gaming, and I run Linux on my laptop. Neither of them get viruses. My protection suite is all free software, so there's no annual fee there. And, if enough regular people switched to something with a Unix base, they'd have virus issues too. There are viruses and rootkits for systems other than Windows. They aren't prolific because the average moron who clicks everything is on Windows.

Yes, those systems are more secure than Windows. No, they are not secure enough to deal with the assault of a wave of moronic users. Feel free to dream of an exodus away from Windows, but understand that nothing will change, even if your dream comes true.

Yes, but at what cost?

[gillbates (106458)]

Sure, you can secure Windows. You can also make Linux run Windows programs. If you're willing to put in the effort, I suppose you could run a web server on a C64 (Hey! Some people have!)

But the point is that it's a lot more practical to just buy a Mac if you're a non-technical user. You get ease of use, with none of the security and stability problems of Windows.

And if you are technical, and are going to put in the effort to learn a system in depth, why would you pick Windows? If you learn Linux, you can transfer that knowledge to working on UNIX systems, and the usefulness of your knowledge isn't subject to the capricious actions of a convicted felon (Microsoft). Sure, you could secure Windows, but every time Redmond releases another version, your knowledge becomes obsolete.

But there are a few additional points about Windows:

1. Windows has at least one - if not two or three - orders of magnitude more security vulnerabilities than Linux or Mac. This alone suggests that the problem of Windows security is much greater than that of Linux or Mac security, regardless of the reason.
2. A Windows system requires constant patching to remain relatively secure, and even so, there's always a small window of opportunity when even fully patched systems are vulnerable. (i.e, the time between the black hats discovering the exploit and the time white hats find it; and the time between notification and the time Microsoft is able to issue an update). Even though you are fully patched, your system still contains vulnerabilities yet undiscovered by the security researchers, but known to black hats.
3. Constant patching is not a viable option for most companies which must test patches for interoperability. In many cases, a company's own internal testing takes longer than it takes hackers to publish an exploit for the vulnerability. In such cases, their machines are never truly secure, even though they patch constantly.
4. You don't have the source code, so you can't audit it. Given that Microsoft was recently caught modifying files on their customers' computers without their consent, this is very troubling. You can't trust Microsoft to do what they say they will, nor can you verify they are.
5. You don't control what gets turned on by default, and sometimes a major, required component of Windows has security flaws (Blaster, anyone?). With UNIX like system, you can simply strip the box down to the bare minimum to achieve greater security.
6. Windows has a maze of interdependencies which often means that you simply cannot uninstall a problematic part of the OS. Take IE for example - though it can technically be uninstalled, it is required by even the most basic OS functions, which means that removing it is not a realistic option for the end user. Yet it continues to be a wellspring of security problems, made even worse by the fact that it isn't practical to run a system without it.

So sure, you can make Windows relatively secure, compared to other Windows boxes. But for the same amount of effort, you could secure a Linux machine to a much greater degree, and have a stable, trustworthy system as well. Sure, neither system is perfect, but for the effort you expend, you get a much better system by installing Linux or buying a Mac.

And I suppose a slashdot post wouldn't be complete without some anecdotal evidence. In the 10 years that I've been in the industry, every single one of my Windows using relatives have needed me to recover one of their crashed/unstable/unusably slow Windows systems. In fact, prior to XP, I had only met one person who both ran Windows and had not had it crash on them. And yet, even though Apple commands about 10% of the market, I have only once been asked if I could recover an Apple computer. And even then, it took only about 1/2 hour, and the guy didn't lose any of his data (he tried to update OS X, and botched it, but even then, he still was able to reco

Re:

[bigstrat2003 (1058574)]

Honestly, don't mean to troll, but you Windows users put up with so much trouble an annoyance just so you can avoid learning how a computer actually works...

That's a pretty big troll for "not meaning to troll". Using Windows is not a barrier to knowing how computers work. Hell, you wouldn't want me to go into my rant on how OSX's ui is dumbed-down compared to Windows, and even I'm not arrogant enough to claim that Mac users necessarily don't know how a computer works.

Sure, Macs are more expensive, and Linux has a steep learning curve, but isn't it worth avoiding all of the frustration you're going experience over the rest of your tech lifetime?

You know, for all the touted insecurities of Windows, I have been using it for YEARS, and have had a virus or spyware infection once. Even that one time, for that matter, it was only because I li

Re:

[tinkerghost (944862)]

If you launch an exe file, you launch the file - it's a pebkac defect not a programming one. It's independent of both the software & the OS.

Re:

[petermgreen (876956)]

my understanding is that you get taken to a page that tries a bank of browser exploits (I don't know if they are all for IE or if there are some FF ones in there too) until one works. If they all fail then it tells the user to download and run an exe.

Re:

[hasbeard (982620)]

I think I recently saw something about Microsoft pushing out an update that supposed to have cleaned a lot of these machines.