Forgot your password?
typodupeerror
Security Spam

Storm Worm Strikes Back at Security Pros 371

Posted by ScuttleMonkey
from the skynet-worm dept.
alphadogg writes "The Storm worm, which some say is the world's biggest botnet despite waning in recent months, is now fighting back against security researchers that seek to destroy it and has them running scared, conference attendees in NYC heard this week. The worm can figure out which users are trying to probe its command-and-control servers, and it retaliates by launching DDoS attacks against them, shutting down their Internet access for days, says an IBM architect."
This discussion has been archived. No new comments can be posted.

Storm Worm Strikes Back at Security Pros

Comments Filter:
  • by riceboy50 (631755) on Wednesday October 24, 2007 @01:27PM (#21102139)
    The bot-net probes you.
    • by suitepotato (863945) on Wednesday October 24, 2007 @08:43PM (#21107683)
      ...Slashdot probes you!

      Oddly, this firewall entry:
      Date: 10/25 00:27:30 Name: spp_portscan: portscan status from 66.35.250.150: 13 connections across 1 hosts: TCP(13), UDP(0)
      Priority: n/a Type: n/a
      IP info: n/a:n/a -> n/a:n/a
      References: none found

      Led to:
      [someone@somebox ~]$ host 66.35.250.150
      150.250.35.66.in-addr.arpa is an alias for 150.0/24.250.35.66.in-addr.arpa.
      150.0/24.250.35.66.in-addr.arpa domain name pointer slashdot.org.
      [someone@somebox ~]$ whois 66.35.250.150
      [Querying whois.arin.net]
      [whois.arin.net]
      Savvis SAVVIS (NET-66-35-192-0-1)
                                                                          66.35.192.0 - 66.35.255.255
      VA Software SAVV-S234813-4 (NET-66-35-250-0-1)
                                                                          66.35.250.0 - 66.35.250.255

      # ARIN WHOIS database, last updated 2007-10-23 19:10
      # Enter ? for additional hints on searching ARIN's WHOIS database.

  • by SpaceLifeForm (228190) on Wednesday October 24, 2007 @01:28PM (#21102151)
    Have them shut down and re-install Windows (not recommended)
    or install GNU/Linux.
    • Re: (Score:3, Informative)

      by wile_e_wonka (934864)
      Interestingly, that might not even help:

      http://it.slashdot.org/article.pl?sid=07/10/05/1234217 [slashdot.org]
      • Re:Contact the users (Score:5, Interesting)

        by orclevegam (940336) on Wednesday October 24, 2007 @01:50PM (#21102555) Journal
        Yeah, buddy of mine had his Gentoo box rooted and used as some sort of base system for rooting others. He found out after his ISP notified him that they shutdown his internet access because his server had been reported as probing other servers for vulnerable PHP apps. Not entirely sure how they rooted the box, but from what I could piece together going through the logs they managed to find a old copy of PHPBB he had been mucking around with on a subdomain (never linked it to anything, so they must have found it by brute force scanning, or maybe combing through DNS records). The traffic logs from other systems and the local logs all showed a series of automated scans for about 2 dozen known vulnerabilities in various pieces of pre-packaged PHP applications in a whole tone of domains. Looked like they just lifted a big chunk of every registered domain between something like ba-fa and were just working their way through it running scans. After we wiped the system and did a fresh install the OpenSSH log showed hundreds of attempted logins under the names of I think Doug and Samantha or something like that, so it seems likely they put a back door into OpenSSH as neither of those accounts were in the old passwd file. They really did a number on that system, and we didn't even know about it for a couple weeks because no one actually logs into the server, at most it gets a new file ftped to it every few weeks or so as things are tweaked.
        • Re:Contact the users (Score:5, Informative)

          by zrq (794138) on Wednesday October 24, 2007 @02:25PM (#21103047) Journal

          ... the OpenSSH log showed hundreds of attempted logins under the names of I think Doug and Samantha or something like that, so it seems likely they put a back door into OpenSSH as neither of those accounts were in the old passwd file ...

          I see a lot of these all the time, they seem to be cycling through a list of names. At the moment they are trying account names like 'root', 'linux', 'admin', 'test', 'testftp', 'webmaster' etc. and user names like 'melissa', 'danny', 'nicholson' etc.

          I don't think this means that they added a SSH back door, just that they have enough compute resources to try hundreds of combinations of likely names and passwords in the hope they get lucky.

          • Nah, this wasn't cycling, it was the same 2 names tried constantly over and over again. It may have been part of a botnet and the C&C node was trying to log back in, because it looked automated.
          • Re:Contact the users (Score:4, Informative)

            by Culture20 (968837) on Wednesday October 24, 2007 @02:41PM (#21103251)
            then you need fail2ban http://www.fail2ban.org [fail2ban.org]
            just in case they might eventually get lucky...
            • Re: (Score:2, Interesting)

              by Anonymous Coward
              fail2ban (or something similar) should be a default in the popular distributions if you install openssh/apache/vsftp etc. Not only does it slow, and stop for a period, brute force attacks against the host - the single best feature is the email notification bringing the issue to your notice. That is the most valuable thing it brings to the table. It also highlights the idiots who forget their passwords inside your network providing much needed entertainment.
    • by PPH (736903) on Wednesday October 24, 2007 @01:36PM (#21102291)
      Contact the users' ISPs and have them cut the connection to the infected machines until they are cleaned up.
      • by blhack (921171) *
        Somehow, I don't think that you're going to get ISPs to turn off half of their customers' internet connection to fix a worm that the user doesn't even know they have/know how to remove.
        • by PPH (736903)
          If the alternative for the ISP is that all ISPs with more than some threshold level of worm traffic get cut off by their upstream providers, then yes they will.

          Cutting off users when they don't know that they have been infected may mean diverting them onto an isolated subnet with nothing but one web page that says: "Your system has been infected. Install and/or replace it and contact (the ISP's) technical support to restore access".

          • Re:Contact the users (Score:5, Interesting)

            by hairyfeet (841228) <bassbeast1968@@@gmail...com> on Wednesday October 24, 2007 @05:09PM (#21105275) Journal
            The problem with that is this, for every smart ISP policy, you have a dozen really stupid ones. Let me use myself as an example.Before finally giving up on the crap that was Sat Internet and moving to get cable(because a block and a half is too far for cable/dsl to run a damned line) I was overjoyed to find a new WISP provider set up in my area. After making sure that they understood what unlimited was (no FAP) I bought the biggest package they had-2Mb per sec at $100 a month. I kept it for all of three weeks before going back to Dway, even though there speed was crazy fast and no latency. Why?


            Because everytime I dared to use more ports than the average Internet Exploiter session they turned me off saying I had a "virus". Didn't matter that I was running a highly locked down Xandros Pro and could show them that my logs only contained my traffic. Some PHB had decided "If it's not Windows and /or uses more ports than Explorer, it MUST be a virus!" After the 9th time of dealing with them in three weeks I told to take it and stick it.


            Point is, just because You and I (and most slashdot readers) know what the signs of a virus/worm/botnet infection is, doesn't mean the PHB who'll write the policy will. I can promise you that you get something like that passed at your ISP and you'll spend every other week trying to explain to them that Emule/Bit torrent/VoIP/VPN/etc is NOT a virus only to get yourself turned off the next time you dare to run a Program/OS/Protocol that they don't understand. Trust me, as someone who has been through this, it just isn't worth it. And if you are in the U.S., and your choices are *hole ISP or dialup, What then? Not everyone can just move like I did.


            And let us not forget the "let's screw everyone for big profits" mentality going on in the US right now. The ISP would have a real good excuse-"We can't tell the difference between that (insert competitors program here) and a virus! If they want to run that thing, they should have to pay us triple for the risk!"


            I learned a long time ago to look at the absolute worse case, because in the US that's probably what you'll end up with.

      • by Intron (870560) on Wednesday October 24, 2007 @02:11PM (#21102837)
        hmmm... We need to get the word to 10 million infected users. I know! Maybe we could hire someone to send an email to all of them!
        • by Minwee (522556) <dcr@neverwhen.org> on Wednesday October 24, 2007 @03:01PM (#21103559) Homepage

          Well, it would have to sound professional and reputable. Let me see if I can write a quick draft for you:

          Dear Sir,

          Based on the recommendation made to me by a reputable official of the abuse sector of a Major South African Internet Service Provider who guaranteed me of your reliability and trustworthiness in business dealings, I wish to entrust important information with you believing that it will be of our mutual benefit; this has to be highly confidential. If I may introduce myself, I am Dr Ben Oguejiofor of the Nigerian Network Operations Centre. I was the former Director of Projects and engineering in the Nigerian Army; I retired recently after Nigeria was pwned by the Storm worm. I wish to crave your indulgence in this business relationship that I will like to establish with you...

      • I tried and failed (Score:5, Interesting)

        by Opportunist (166417) on Wednesday October 24, 2007 @03:49PM (#21104169)
        As one of the "threatened" AV researchers, I was of course interested in getting the bots offline, at least to the degree that I can (I kinda have little chance to put pressure on ISPs in some country that I can't even spell correctly).

        So I went and gathered the IP addresses of infected machines. I aggregated them and grouped them to the corresponding ISPs, complete with timestamp (just in case they use dynamic IP addresses and thus need them to contact the corresponding users), then I sent out a mail to 10 different ISPs, just as some kind of test.

        The result:

        5 didn't reply at all.
        2 replied that they are "looking into the issue". I guess they're learning the list by heart 'cause after a month now, still no further reply.
        One replied with the question whether I try to infect their system and how I dare to say that their users might do something illegal (talk about knowledge).
        One replied that they can't do jack because I could just as well have forged that list to mess with their users and they don't care.

        Only a single ISP actually thought the matter is important enough to contact me with a request for more information and whether they can do something proactively.

        One.

        The smallest one, btw. With 20 infected machines (compared to a few 100 with the biggest one, one of the first group that didn't even care enough to reply).

        You can't win this way. ISPs don't care at all, at least until the botnet starts using more bandwidth than their torrent leechers. It would mean work for them, what's worse, it means their customers bother their call center with angry calls and maybe even questions how to clean their machines and maybe they even cancel their service over it. In short, taking things like this serious costs them money but doesn't get them anything, so they won't do it.
  • Is it... (Score:4, Funny)

    by Anonymous Coward on Wednesday October 24, 2007 @01:28PM (#21102153)
    ...beginning to learn at a geometric rate?
    • Multi cellular (Score:3, Interesting)

      by goombah99 (560566)
      I got the skynet link of course, and it's apt. What we are seeing is the slow transition from single cellular behaviour to a multi cellualr organism. That is instead of being fighting on it's own, it now has a global immune response to an invader (security researcher). With the advent of virtual machine detectors last year these things now commit apoptosis when they detect they have been invaded by the security researcher.

      In other words we have changed roles. Instead of us being the host and them being t
  • by eldavojohn (898314) * <eldavojohn@nOspAM.gmail.com> on Wednesday October 24, 2007 @01:28PM (#21102157) Journal
    *An overweight bond sits at a computer desk littered with Payday bar wrappers and graphic novles. He struggles to breath as he brushes at the cheetohs crumbs stuck in his stubble. A blinking light flashes on his monitor and he reaches up with his stubby fat fingers to press the 'Accept Transmission Now' key. The video feed of an equally bloated and zit faced man, though somewhat less pastey white, comes up.*

    Cats: Good evening, Mr. Bond, I was just hitting up some 3 am Taco Bell for fourth meal ... I would like to discuss your latest attempts to probe my botnets on the interweb.
    Bond: *wheezes at the site of his archnemisis* Cats! I should have known it was you! You won't get away with this diabolical scheme!
    Cats: Oh won't I, Mr. Bond? I have all of the world's computers trapped to do my bidding. What would you say if I told you I could bring any website to its knees with a DDOS attack? I noticed you have an apache http server running, Mr. Bond. Perhaps sharing pictures with your loved ones!? Well, I hope a billion attempts to access those images won't ... SATURATE YOUR BANDWIDTH!
    Bond: My GOD! You've gone mad with power, Cats. You're a madman! You'll never get away with this. How do you even keep your franken net in check? What happens when it turns on you?
    Cats: Oh, I think I will, Mr. Bond, Caribbean law is quite kind when it comes to orchestrating botnets. Prepare to say goodnight. Good luck making your raiding schedule, I hope you won't miss those 50 DKP!
    *Bond's screen slows to a crawl as he rushes to turn off Apache*
    Bond: Nooooooooooo!
  • Who really knows (Score:4, Insightful)

    by Silver Sloth (770927) on Wednesday October 24, 2007 @01:30PM (#21102187)
    From TFA

    Still, the power of Storm, also known as Peacomm, is still hotly debated. Earlier this week another expert said the worm had pretty much run its course and was subsiding.
    I have a seaking suspicion that all the Storm Worm doomsayers are out to sell us their solution. This has echoes reminiscent of the Y2K fiasco.
    • by fredrated (639554) on Wednesday October 24, 2007 @01:36PM (#21102305) Journal
      The Y2K fiasco? What was that? Was it a fiasco because programmers had not programmed for 4 digit years, because a lot of money was spent correcting this, or because nothing happened and you interpret this as meaning nothing was going to happen?
      • by Silver Sloth (770927) on Wednesday October 24, 2007 @01:42PM (#21102419)
        We all spent a lot of time fixing things - and earning a small fortune - but the computer press, and a lot of the popular press, was full of stories about how planes would fall from the sky, autotellers would stop working, and life as we know it would self destruct. I work for a major UK financial institution and I was very much part of the Y2K effort and, after all the man hours, what did we find, one or two minor inconveniences. Still I took my wife to the Canary Islands for a holiday on the money I earnt staying sober on new years eve.
    • Re:Who really knows (Score:5, Interesting)

      by Opportunist (166417) on Wednesday October 24, 2007 @04:23PM (#21104651)
      Since I can't sell you anything to remedy it (nobody can. Don't believe in snakeoil. The best anyone can do is sell you something so you don't become part of the botnet, but nothing saves you from being a target), I can tell you upfront: It is a threat. A big one.

      We're facing a huge network here with the capability to strike a single target. It's not that any of those machines are actually a threat to any kind of server. It's the fact that there are thousands (I think millions is a wee bit exaggerated, but we're certainly facing a number in the upper 5 digits or lower 6).

      The threat isn't so much to a single server or a single corporation, the threat actually touches international borders (pardon the pun). We're talking something here that threatens the infrastructure of the internet itself.

      The reason why the internet doesn't collapse under its own weight is that nobody uses the bandwidth fully all the time, and there isn't a single target node everyone wants to connect to. Now imagine exactly that happens. Everyone (or let's say one out of 10 machines) on the net goes full bandwidth on one target.

      The problem isn't so much that this target is dead due to a DDoS. That's a given. The problem is that the backbone gets under serious stress. And that's where not only the single server but the whole infrastructure of the net around it comes under pressure. Not long ago, Denmark had a network blackout. I think it's no longer a secret what was the reason.

      What's worse is that the whole mess seems to be nothing more than a test balloon. When you look at the way this is distributed and worked, you notice that it is by far not what could be considered an "all out" attempt at infecting. It's more a rather limited effort, with days and sometimes weeks between the launch of new infections, and very, very few "real" DDoS attacks, mostly defensive. Very few offensive attacks have been launched so far.

      That's what worries me.
  • by pushing-robot (1037830) on Wednesday October 24, 2007 @01:32PM (#21102221)
    If the "command and control" servers have been found, why haven't the IPs been masked to physical addresses and physical security types with physical balaclavas and physical MP5s probing the physical door?
  • just wait till it realizes that humans are the ones doing the probing.
  • by dazedNconfuzed (154242) on Wednesday October 24, 2007 @01:32PM (#21102235)
    Letters of Marque, please?
    • Yeah, while they're at it, they can quarter some military hackers in server farms. (Make sure to declare a state of war first, and authorize quartering so as to adhere to 3rd Amendment restrictions.)
  • by jav1231 (539129) on Wednesday October 24, 2007 @01:35PM (#21102267)
    Running scared? Are they serious? Suddenly I see a scene in those old hero flicks where a woman in the crowd stands and says, "Is there no one? No one out there who will save us!?"
  • by Billosaur (927319) * <wgrother@HORSEop ... minus herbivore> on Wednesday October 24, 2007 @01:35PM (#21102277) Journal

    Didn't I just hear that the Storm worm was slowing to a crawl [slashdot.org]?

    • Re: (Score:2, Informative)

      by lskovlund (469142)
      Bruce Schneier wrote that the worm was starting to retaliate [schneier.com]. It was linked to by a poster on this Slashdot story [slashdot.org]. The guy who posted the analysis you refer to seems to be a lowly sysadmin (He's affiliated with Network Operations at the UCSD - so not a researcher) - I would tend to believe Bruce more, and viewed that analysis with some skepticism, which now appears to have been justified.
    • Re:Wait a minute (Score:4, Interesting)

      by Intron (870560) on Wednesday October 24, 2007 @03:15PM (#21103749)
      If it's grain of salt time, let's look at which is more likely:

      a) Something big changed and 10 million Windows users suddenly wised up and cleaned up their compromised systems.

      b) The people behind Storm have made it harder to detect so we only think that there are fewer compromised systems.
  • by orclevegam (940336) on Wednesday October 24, 2007 @01:36PM (#21102313) Journal
    So, these people are trying to sell these botnets for extortion and spamming purposes right? Well, seems to me that they just opened up a loophole for at least one category of customer to get free "service" by spoofing whoever he wants to DDoS and poking the botnet till it retaliates. Boom, instant DDoS and he didn't have to pay a dime for the service. I do like the idea someone else put out of spoofing as one of the other control nodes, thereby getting the net to DDoS itself, but it may be just smart enough not to do that.
    • by Lumpy (12016) on Wednesday October 24, 2007 @01:49PM (#21102525) Homepage
      Dont know about that. only if they though of it to begin with. Back in the early days of undernet a few of us figured out how to get the official administrative bots to fight each other. Wait for a net split, join as a bot's name and start a flood attack on another bot. IT get's triggered and kick/bans you. the net rejoins and the fight starts. it was fun to watch for the week we were able to do that trick until they fixed the bots.

      Unless the dev's think long and hard on how to attack it and work in ways to avoid it I doubt they put that feature in.
      • Ah, undernet, those were the days. Friend of mine got payed a visit by the police once for playing on undernet. Seems he accidently crashed a few of their servers and they didn't take kindly to it. Turns out that if you have a few hundred bots all join a channel at once, and then a few of them get it in their head to kick one of those said bots, who of course gets kicked by a few more bots, who then get kicked by even more bots, that all that kicking and joining is enough to DOS the servers into submission.
  • Old news (Score:2, Interesting)

    by Anonymous Coward
    Higher ed had some of their systems attacked in this way going back to at least July. I lost a machine because of this because the system (running FreeBSD) had a marginal disk that eventually died under the load incurred by logging "Limiting icmp ping response from..." messages. Fortunately, we were smart enough to NEVER use systems like our workstations for downloading malware from suspected sources.

    Easy lesson for those thinking of doing research: Remember to have a machine dedicated to the task of tal
  • by Anonymous Coward on Wednesday October 24, 2007 @01:40PM (#21102385)
    .. I'm still waiti
  • Counter-DOS (Score:5, Interesting)

    by RyanFenton (230700) on Wednesday October 24, 2007 @01:40PM (#21102387)
    Wouldn't the obvious counter-strategy to this be to give the botstorm enough targets to make their DOS attempts too dilute to be a threat?

    You theoretically would not need a comparable number of targets to attackers - just enough to lower the magnitude of the counter attack to the point where you could get acceptable results. You could also have targets that 'play dead' in some ways so the attackers can't fix on a minimum magnitude to counter attack with, and instead have to throw zombies until the target stops moving, where the target just gets right back up after playing dead. That way, the window you have before you 'play dead' might be used to get relatively clear results.

    Just one guy's idea.

    Ryan Fenton

    • by GoodbyeBlueSky1 (176887) <joeXbanks@hotmai ... com minus distro> on Wednesday October 24, 2007 @01:57PM (#21102661)
      Is that you Zapp Brannigan?
    • Re:Counter-DOS (Score:5, Interesting)

      by Quietust (205670) on Wednesday October 24, 2007 @02:15PM (#21102905) Homepage
      Alternatively, trick them into launching a DDoS on a site more than capable of sinking all of the attack with plenty of bandwidth to spare - there's nothing quite like trying to flood an internet backbone. Plus, if it actually did have a noticeable effect, such a massive outage would be more likely encourage appropriate law enforcement agencies (of whatever nations) to get off their collective asses and actually solve the problem at its source.

      Not particularly likely to happen, but we can all dream, can't we?
      • by Minwee (522556)

        [...] such a massive outage would be more likely encourage appropriate law enforcement agencies (of whatever nations) to get off their collective asses and actually solve the problem at its source.

        Of course it would. Those guys are very good at finding the real sources of problems.

        *knock knock*

        "Yes?"

        "Mr. Quietust? Of QMT Productions? We have information here showing that you employed a major bot-net to organize an ongoing DDoS attack against UUNET. Are you going to confess that you are the maste

  • Ponders ... (Score:3, Interesting)

    by Colin Smith (2679) on Wednesday October 24, 2007 @01:46PM (#21102485)
    What's bigger, the Storm effect... or the Slashdot effect ...

     
    • That's what we should most certainly do, post the addresses of these control servers as links in /. stories about a new Linux device, or Apple product, and watch as the network dissolves.
    • by Red Flayer (890720) on Wednesday October 24, 2007 @02:01PM (#21102723) Journal

      What's bigger, the Storm effect... or the Slashdot effect ...
      Duh -- the Storm effect, since the worm is more likely to actually RTFA.
      • What's bigger, the Storm effect... or the Slashdot effect ...
        Duh -- the Storm effect, since the worm is more likely to actually RTFA.
        Oh, that's easy to fix. Just post the story with the links labeled as Natalie Portman covered in Hot Grits, Naked and Petrified.
  • This is something that has been known and announced for many months now. Additionally, the new variants of it do not seem to trigger DDoS attacks in quite the same way.
  • Wouldn't it be funny if the worm was never intended to phone home for instructions, meaning any attempt to contact "command centers" would always be the result of probes ?
  • by darkonc (47285) <stephen_samuel@@@bcgreen...com> on Wednesday October 24, 2007 @02:17PM (#21102929) Homepage Journal
    1. Let various ISPs know that you're about to do this,
    2. Do something to trigger a DDOS,
    3. Track which machines the attacks are coming from, (basically, log the source of every packet aimed at your IP address)
    4. shut down and clean every machine that is shown to be part of the DDOS
    5. (profit???)
  • Naieve (Score:4, Insightful)

    by cdrguru (88047) on Wednesday October 24, 2007 @02:51PM (#21103389) Homepage
    I see the same sort of law-and-order assumptions here that I would like to believe in. Sadly, that phase in my life has ended.

    Sure, you can find who is DDoS'ing you. You can then call the ISP/hosting company and complain. If they are in the US they will likely as not just tell you to get a court order. Outside the US they will laugh and suggest you bribe them. Either way, it is their customer's right to operate in whatever manner they choose. If they are presented with a valid court order from a court in their jurisdiction, they will quickly and efficiently comply. Otherwise, your complaint will go in the bit bucket.

    Mostly the problem is that to a lot of ISPs their customer (and the revenue from that customer) is a whole lot more important than the negative effects their customer is having. Also, the customer may be Daddy and Sonny is the one causing all the trouble. Why would anyone want to offend bill-paying Daddy by cutting off service?

    The problem here is that regardless of the problem - a botnet infested computer, a script kiddy trying to break in, or some other mischief - if you let it go, it gets worse. Every time a script kiddy gets to feel that rush of excitement at breaking to some computer somewhere without any consequences they get bolder. In the US it is not really possible to go after them until they run up at least $25,000 in damages. Because of this, you never hear about the high schooler getting in trouble because they defaced a web site. Instead you hear about someone after many years of mischief and mayhem who is being accused of causing $12,000,000 in damages computed in some creative manner to get the FBI's attention. There is never a thought of stopping this when the cost to everyone is minimal. Minimal doesn't get the FBI involved and local law enforcement is utterly clueless.

    Nobody is really going to get taken down for this unless they do something incredibly stupid. Sure, you can find an IP address but you can't get the customer unless the ISP wants to cooperate. Can you get a court order for the ISP to identify the owner of the account? Probably not without at least $25,000 in damages that you can claim. Even then all you have found is an infected computer that the owner doesn't know anything about.
  • Is this botnet the one that keep sending the "Viagra Official Site" spam?
  • by twistedcubic (577194) on Wednesday October 24, 2007 @03:07PM (#21103651)
    The Matrix. This botnet might not be man-made. It might turn out that all these own3d computers have created a collective intelligence.

I'm all for computer dating, but I wouldn't want one to marry my sister.

Working...