Slashdot Log In
Storm Worm Rising
Posted by
CmdrTaco
on Wed Aug 08, 2007 10:33 AM
from the goggles-do-nothing dept.
from the goggles-do-nothing dept.
The Storm worm has been an increasing problem in the last few months, but a change in tactics may mean something big is going to happen. The article discusses a bit of back story about the worm, including the somewhat frightening numbers about the millions of spam emails carrying the worm payload. They estimate between a quarter and a million infected systems usable for spam or DDOS attacks.
Related Stories
[+]
Storm Worm More Powerful Than Top Supercomputers 390 comments
Stony Stevenson writes to mention that some security researchers are claiming that the Storm Worm has grown so massive that it could rival the world's top supercomputers in terms of raw power. "Sergeant said researchers at MessageLabs see about 2 million different computers in the botnet sending out spam on any given day, and he adds that he estimates the botnet generally is operating at about 10 percent of capacity. 'We've seen spikes where the owner is experimenting with something and those spikes are usually five to 10 times what we normally see,' he said, noting he suspects the botnet could be as large as 50 million computers. 'That means they can turn on the taps whenever they want to.'"
[+]
Storm Worm Botnet Partitions May Be Up For Sale 192 comments
Bowling for cents writes "There is evidence that the massive Storm Worm botnet is being broken up into smaller networks, and a ZDNet post thinks that's a surefire sign that the CPU power is up for sale to spammers and denial-of-service attackers. The latest variants of Storm are now using a 40-byte key to encrypt their Overnet/eDonkey peer-to-peer traffic, meaning that each node will only be able to communicate with nodes that use the same key. This effectively allows the Storm author to segment the Storm botnet into smaller networks. This could be a precursor to selling Storm to other spammers, as an end-to-end spam botnet system, complete with fast-flux DNS and hosting capabilities."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
How are these numbers calculated? (Score:5, Funny)
(Last Journal: Sunday September 02, @04:01AM)
Seriously though, how does one go about estimating these numbers? Is it something as simple as an estimate of what proportion of infected e-mails are expected to result in an infected desktop? I doubt that would give a very accurate figure.
Re:How are these numbers calculated? (Score:4, Informative)
"Joe Stewart, senior security researcher at managed security company SecureWorks, at the Black Hat conference.
From the number of infected machines he's found, Stewart estimates that the Storm botnet could comprise anywhere from 250,000 to 1 million infected computers. And that raises questions, along with eyebrows. "
Re:How are these numbers calculated? (Score:5, Informative)
(http://www.secureworks.com/)
In reality, the only source that can give you a precise count for the Storm botnet is the Storm controller - and he/she's not talking. So we do the best we can at estimating its size given the data available.
Re:How are these numbers calculated? (Score:5, Funny)
(http://obsessivemathsfreak.org/ | Last Journal: Friday June 09 2006, @08:15PM)
- 1. Roll 2D6
- 2. Take the number rolled, and multiply it times the number of worm messages that have arrived in your inbox.
- 3. If your computer is actually infected, square the result.
- 4. Play a game of Solitare
- 5. Add your final score to the result
- 6. Divide the result by your Boss's vigilance.
- 7. Make a saving throw against discovery, and multiply the result by 1000
- 8. Round up to the nearest 100,000
- 9. Publish
- 10. Profit!
Lower bounds are trickier as they will require you to actually care about what you're doing.Microsoft is going to lose big (Score:3, Insightful)
(http://technical-writing.dionysius.com/ | Last Journal: Monday November 05, @03:35PM)
"The silent majority" is uninformed. (Score:5, Insightful)
They've been shown that in countless movies and TV shows and by "experts" on the news.
They're the ones you see claiming that Linux and Mac's will have the "same problems" as their market share increases.
With all the past outbreaks on Windows machines, anyone who wanted to migrate has already started their migration. This won't change anything for anyone else.
Re:"The silent majority" is uninformed. (Score:5, Interesting)
(http://www.nymar.demon.co.uk/)
More accurate, perhaps, to say that they think this is just the way computers don't work.
There was a program on last week where they had a collection of self proclaimed grumpy old women listing things they hated about computers - and you know what? Every single complaint was not about computers per se, but about Microsoft software.
There's got to be an opportunity in there somewhere for the FOSS movement. Imagine if we could convince the "I hate computers" brigade that what they mainly hate is Microsoft ...
That's just silly. People have different convincer strategies. If nothing else, there are people out there who still haven't heard that there's an alternative. There's a lot of meat left on that bone.
Re:"The silent majority" is uninformed. (Score:5, Informative)
(http://www.nymar.demon.co.uk/)
No, but they are Microsoft though - which is what I said in the first place.
You're right, I just used it as a loose example. I'd be more specific about the complaints, but I wasn't expecting a test, and I forgot to make notes. All I can do is report what I remember from the show.
meh. It's a support forum, not an advocacy site. It's not so much "Microsoft sucks" as "what do I do when when the registry fills up?". You don't get a lot of penguin heads there because... well, because we all use Linux and it's a windows support forum.
Hatred isn't a rational act, though, is it? I mean, most people don't wake up in the morning and say "now who shall I hate today? Who is the most rational target for my hatred?". It's not like that. On the other hand, there's no shortage of people who think "if that computer crashes and loses my document one more time today, it's going through that window..." My point is that a lot of the things I heard cited as inspiring this hatred were typical MS grumbling points.
And if it's a good enough reason to hate computers, it's good enough to hate Microsoft. It's just a question of education ;)
Oh quite possibly, although the latest Ubuntu is getting very good in that respect. But they'd be spared the malware, and the viruses and the worms... which is the starting point for this discussion.
Yes, perfectly. At least since flash 9 was released for Linux.
Re:"The silent majority" is uninformed. (Score:5, Funny)
(http://www.game-point.net/ | Last Journal: Monday November 14 2005, @09:19AM)
--
Try to hack my 31337 firewall! [127.0.0.1]
Yeah, you really should do; you clearly need a more secure OS than the one you're running now. I just hacked your firewall, and man have you got a lot of weird stuff on there.
Re:"The silent majority" is uninformed. (Score:4, Insightful)
- An uneducated user from executing a binary file they download from a URL they are given
- A process that user is running from executing further code with that user's privileges
- That user's processes from making outbound TCP/UDP connections
- That user's processes from accessing an SMTP server to send emails
- A user from configuring a process to run on logging in
By my thinking, that's really all that's needed for a botnet to work on a given platform. I am certainly ignorant of many details regarding the BSD/Linux kernels and I stand ready to be corrected, but I believe I've seen all those things happening individually as part of day to day user life on my linux box.Re:Microsoft is going to lose big (Score:5, Informative)
WTF are you talking about? RTFA, please. If you actually did that before funboying around, you'd notice that the program in question is not a worm at all, but a trojan. User has to manually run the attachment, probably clicking through a couple of dialogs practically begging him not to. But, since the user really, really _wants_ to see the cute kittens, or a naked celebrity, or whatever the trojan claims to be, trojan will be run. No OS can defend against the user being a sucker.
So, move along, please. Your tirade is totally off topic here.
Love the tag "situationnormal" (Score:3, Informative)
(http://www.intelligentblogger.com/ | Last Journal: Monday August 27, @11:47AM)
SNAFU (Situation Normal: All F***ed Up)
* Before I get 10 million suggestions for a decade-past issue, yes we did find more effective ways of blocking it.
Naked teens attack home director (Score:5, Informative)
(http://www.cooldark.com/ | Last Journal: Monday April 26 2004, @05:31PM)
http://en.wikipedia.org/wiki/Storm_Worm [wikipedia.org]
Question on that article (Score:4, Interesting)
http://en.wikipedia.org/wiki/Storm_Worm [wikipedia.org]
Perhaps to avoid infecting government servers (and upping the ante, if he got caught)? That's the only thing I could think of. I'm sure there's a very logical reason, but I have no idea what it might be.
worth worrying about (Score:4, Interesting)
(http://www.hotpricelist.com/ | Last Journal: Monday April 22 2002, @12:06PM)
Catalyst for change? (Score:4, Interesting)
#1. Spoofed IP addresses - not that common anymore. It used to be that you'd tie up a machine by having it send replies to machines that did not initiate the connection. There is a simple solution to this. Anyone assigned a block of IP addresses has to make sure that all outbound traffic references IP addresses on that block.
#2. Thousands of machines eating up your bandwidth - the most common type now. This is where the zombie army each makes continued requests of your machine. For webservers, they can request a page over and over and over until they use up all your bandwidth and legitimate visitors cannot get through. This is more difficult to fix. It can partially be handled by blocking the range of addresses that host the zombies. Such as Comcast and Verizon and so forth. There are more complicated attacks. Such has sending half a request.
There's not much that can be done with #2 until a law gets passed saying that the person paying for the Internet connection is responsible for $X of clean-up charges. Then people will have a financial incentive to look at more secure systems.
More information (Score:5, Informative)
(http://www.valleytechnologiesllc.com/)
Shouldn't everyone be blocking
NO! (Score:5, Insightful)
(Last Journal: Tuesday June 06 2006, @01:50PM)
NO! It's annoying enough that Google rapes through my
If I'm working on a c++ program at work and zip it up and gmail it home (lock the computer while it uploads) and forget to 'make clean'
Re:NO! (Score:4, Interesting)
Re:NO! (Score:4, Informative)
(http://slashdot.org/)
I've just switched to using RAR and as for now Google is leaving my attachments alone...
M Addario
Re:More information (Score:4, Insightful)
(Last Journal: Friday August 18 2006, @11:17PM)
For me the biggest problem with these is that there is no attachment for AV to pick off and there is hardly any text and no real advertising in the email so our spam filters don't block it either.
What does God need with a starship? (Score:2, Redundant)
(Last Journal: Wednesday November 07, @10:09AM)
For spam, a million-strong botnet might be overkill. But botnets can do much more - like launching denial-of-service attacks. These attacks aim to overwhelm a Web site or Internet server by sending it a constant stream of garbage data at a particular Web site or Internet server.
So the question is, who is controlling these botnets and why? DDoS attacks can be pretty useful if someone wants to get a point across or to extort money from someone or some company. It will be interesting to see if they can trace it back to the source.
Re:What does God need with a starship? (Score:4, Insightful)
Removal Tool (Score:3, Informative)
(http://www.valleytechnologiesllc.com/)
Re:Removal Tool (Score:5, Funny)
The goggle really might do nothing.
Re:Removal Tool (Score:5, Funny)
that is why (Score:5, Funny)
Maybe there's a silver lining here... (Score:5, Interesting)
(http://thisamericanidiot.blogspot.com/)
Beyond the slashdot effect... (Score:2, Informative)
A few years back there was a spate of DDOS attacks on root servers, for example: http://www.informationweek.com/news/showArticle.j
So, is this really such an enormous number? There seems to be a precedent for botnets of this scale....
Whats Worse? Storm or Nugache (Score:2)
(Last Journal: Thursday October 13 2005, @10:30AM)
Insert Scary Music Here
If you'd like to know more... (Score:1)
An email warning I got yesterday (Score:3, Interesting)
(Last Journal: Monday January 29 2007, @06:49PM)
As much as I hate to suggest this... (Score:2)
(http://goldspider.blogspot.com/ | Last Journal: Friday March 18 2005, @10:54AM)
Us conscientious customers shouldn't have to suffer the conditions imposed on us by people who can't bother to take even the most simple precautions. How much better would service be without all these botnets clogging the tubes?
Military? (Score:5, Interesting)
(http://www.thetao.info/tao/whitecloud1.htm)
how to know (Score:2)
(http://kisrael.com/)
Incidentally, for Windows lusers who realize they may have been practicing unsafe computing, is there any way to tell that you've been zombified? I know some of these worms are fairly stealthy. Some sort of external monitoring box between the router and the cable modem?
Had this show up (Score:3, Interesting)
Hi. Worshipper has sent you a greeting card.
See your card as often as you wish during the next 15 days.
SEEING YOUR CARD
If your email software creates links to Web pages, click on your card's direct www address below while you are connected to the Internet:
http://682.81.0.23/?9907cd64e28cae3d7703a3b01bda de (Poster's note: This URL has been altered to protect the rampant mad clickers amongst us)
Or copy and paste it into your browser's "Location" box (where Internet addresses go).
We hope you enjoy your awesome card.
Wishing you the best, Administrator, americangreetings.comMandatory Disconnect of Infected Computers (Score:3, Insightful)
Then if a botnet attack comes, turn off the overseas pipes as needed. Yeah I am a dreamer, but I am at least half way practical.
SPAM - the stupid side of things... (Score:2)
(http://www.easternstorm.net/)
For year's I've wondered why we have such a persistant SPAM problem. There are number of things that can be done - but aren't.
- I don't believe there is ANY excuse for old viruses to circulate the web. I understand a new virus, but once a virus is known it should be stopped at the ISP & backbone levels.
- Where is the government? SPAM supposedly costs business' billions of dollars a year. That would mean to me that a portion of the trillions of dollars paid to the U.S. government in taxes should be allocated to it's cessation. Nail the spammers, and nail them hard.
- I get the same Myspace SPAM message a few times a week for a year now. So do most others on MySpace. The spam uses the same image for finance loans over and over. WHY? It should have been stopped ages ago.
- How to stop it...well, the easy way is to have a government or corporate entity utilize the SPAM service and trace the money back to it's source. Oh, and don't tell me that it's outside of our jurisdiction in some 3rd world country.
- If it's in a third world country. Let's help that nation's economic situation. A nice reward for x individual and company to be shut down would do wonders. Now, if that $10,000 reward happens to have Storm Controller's head removed from his body. It'd be a downright dirty shame...but not much more.
*growls*
Cool (Score:2)
(http://slashdot.org/~nurb432/ | Last Journal: Friday August 27 2004, @03:24PM)
Then perhaps something might actually be done about this nonsense once and for all. The only way something will get done is if hits the pocket books of enough 'big players'
Re:Cool (Score:4, Interesting)
(Last Journal: Thursday December 09 2004, @09:25AM)
I'm going to call it a net win for productivity and busniess in general. Which means that it's most likely that big business is behind the internet shutdown...and the Storm worm.
Shit, where'd I put that damned tinfoil hat...
not important (Score:1)
Why not an anti-virus virus? (Score:1)
A virus that searches your memory/drive for other viruses/spam/spyware, kills and removes them if any are found, replicates, then cleans up after itself....
-CF
Linux won't run it! :( (Score:2)
(http://kim.biyn.com/)
Seriously though, I thought Windows was supposed to be more secure, and less prone to this stuff than Linux? I mean, that's what Microsoft's Get The Facts campaign was all about wasn't it? I know, one can claim that Linux just isn't much of a target because of market share, but the reality is that the security model is vastly superior.
Windows can be made secure, but so many programs are STILL coded such that administrative access is provided that backwards compatibility is Windows' Achilles' Heel. I was hoping Microsoft would use XP (and more recently, Vista) as a breaking point (like Apple did with OS X) but sadly they didn't in either case.
I hope these infections REALLY blow up and cripple the Internet for a few days, because it would make many people question the wisdom in continuing to pay for cosmetic updates to Windows.
Vigilante worms (Score:1)
sigh (Score:1)
What is Affected? (Score:1)
(http://lexx.warpedsystems.sk.ca/ | Last Journal: Wednesday October 06 2004, @12:04PM)
[REN-ISAC]Storm Worm DDoS Threat to the EDU Sector (Score:2, Informative)
Re:Nebulous numbers (Score:1)
A quarter million to a full million is still a large range.
Re:Nebulous numbers (Score:2)
(http://poltras.com/)
English is not too difficult to understand if you look at the clues.
----
Mods, that joke is on topic, look up the parent original post.
Re:What about the Twinkie? (Score:1)
(Last Journal: Tuesday October 23, @10:49AM)
Kris
Re:Question on attachments (Score:2)
(http://mysite.verizon.net/tkrotchko/)
Also, the PDF's emails are simply a way to get past spam filters; they're all viagra/meds style ads. These started appearing about a month ago.