Storm worm strikes back at security pros

Researcher says those discovered trying to defeat worm suffer DDoS attacks
  • (Network World)
  • — 25 October, 2007 08:43

The Storm worm is fighting back against security researchers that seek to destroy it and has them running scared, Interop New York show attendees heard this week.

The worm can figure out which users are trying to probe its command-and-control servers, and it retaliates by launching DDoS attacks against them, shutting down their Internet access for days, says Josh Korman, host-protection architect for IBM/ISS, who led a session on network threats.

"As you try to investigate [Storm], it knows, and it punishes," he says. "It fights back."

As a result, researchers who have managed to glean facts about the worm are reluctant to publish their findings. "They're afraid. I've never seen this before," Korman says. "They find these things but never say anything about them."

And not without good reason, he says. Some who have managed to reverse engineer Storm in an effort to figure out how to thwart it have suffered DDoS attacks that have knocked them off the Internet for days, he says.

As researchers test their versions of Storm by connecting to Storm command-and-control servers, the servers seem to recognize these attempts as threatening. Then either the worm itself or the people behind it seem to knock them off the Internet by flooding them with traffic from Storm's botnet, Korman says.

A recently discovered capability of Storm is its ability to interrupt applications as they boot up and either shut them down or allow them to appear to boot, but disable them. Users will see that, say, antivirus is turned on, but it isn't scan for viruses, or as Korman puts it, it is brain-dead. "It's running, but it's not doing anything. You can brain-dead anything," he says.

The worm has created a botnet of slave machines whose latent size and power is unknown. The number of infected machines available to launch spam and DoS attacks is estimated from hundreds of thousands to 50 million. Korman says he believes it's between 6 million and 15 million.

One intimidating aspect of the botnet the worm commands is that it is used infrequently, indicating that it is for sale or lease to what he terms "profit nation" -- computer hackers who do their work for money not fame. The potential exists for the botnet to be used by political entities for cyberterror attacks, he says.

"It's getting more serious the more I look at it," Korman says. "I'm more concerned not so much about where Storm is today, but where it's going."

Still, the power of Storm, also known as Peacomm, is still hotly debated. Earlier this week another expert said the worm had pretty much run its course and was subsiding.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tim Greene

Network World
Comments are now closed.

Latest News Articles

Most Popular Articles

Follow Us

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Resources

Best Deals on GoodGearGuide

Compare & Save

Deals powered by WhistleOut
Use WhistleOut's technology to compare:
Mobile phone plans & deals
Mobile phone models
Mobile phone carriers
Broadband plans & deals
Broadband providers
Deals powered by WhistleOut
WhistleOut

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?