Looking inside the Storm worm botnet

LAS VEGAS--On Wednesday, Joe Stewart, director of malware research for SecureWorks, presented his work on protocols and encryption used by the Storm worm botnet at Black Hat 2008.

He said as far as botnets go, Storm is not particularly sophisticated, nor is it our No. 1 threat. Yet while other botnets come and go, Storm remains amazingly resilient, in part because the Trojan horse it uses to infect systems changes its packing code every 10 minutes, and, once installed, the bot uses fast flux to change the IP addresses for its command and control servers.

None of this surprising, it's just handled well.

In explaining Storm worm's resiliency compared to newer and sleeker botnets, Stewart looked at the encryption used within the commands sent from the command and control server. He said the compression or packing code changes so often in order to thwart antivirus signature files.

Storm uses P2P to communicate with its various nodes and supernodes throughout the Internet. He said because of that, it has to contend with bogus media files being sent via P2P and researchers such as himself attempting man-in-the-middle attacks to see what the commands might be. To handle that, Storm has started using 64-bit RSA encryption based, in part, on the date.

Joe Stewart talks about what botnet code is available and what can be found within it.

Click here for full coverage of Black Hat 2008.

[jamalystic]

How botnets spread and create damage is no secret, but it is preventable. Not taking basic precautions is absurd. There are numerous reports stating how most computers are not satisfactorily protected and this is the underlying reason why such attacks persist: Ignore the Storm Worm Threat at Your Own Peril(http://www.internetevolution.com/author.asp?section_id=515&doc_id=145897&F_src=flftwo)

[benjaminstraight]

Interesting info on botnets.