Risk
2/11/2009
11:20 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

New And Improved Storm Botnet Morphing Malware

Waledac (which was previously known as Storm) is once again spewing gads of Valentine's Day spam and malware.

Waledac (which was previously known as Storm) is once again spewing gads of Valentine's Day spam and malware.The Storm botnet, which was previously declared dead, is back. Less than a month ago, I wrote this based on research from SecureWorks:

According to a research note published by managed security services provider SecureWorks -- the Storm botnet's death last summer resulted from a combination of punches it couldn't recover: First, a number of security researchers uncovered ways to break the encryption schemes used by the bot-masters to secure their command and control functions. Yet, because the worm utilized peer-to-peer networking, it wasn't possible to totally eradicate the network this way. However, writes Joe Stewart, director of malware research at SecureWorks, the number of bot infections was hit hard -- at least cut by hundreds of thousands -- by Microsoft's MSRT (Malicious Software Removal Tool). "Storm's numbers continued to fall off over the course of 2008, before it was apparently abandoned in September," wrote Stewart.

Not so fast, as Dark Reading reports today:

Waledac -- the new and improved Storm -- is using its favorite holiday, Valentine's Day, to spread the love with signature phony greeting cards and romance-themed e-mail that Storm so infamously spread in the past. "Over the last 24 hours, we've seen over 1,000 new variants [of Waledac code]," says Pierre-Marc Bureau, a senior researcher with Eset, which expects Waledac to eventually pump out thousands of variants a day. "It was a bit lower than what we are expecting. It may not have reached many of our clients yet." That said, it's still a big jump from the around 10 new versions a day Eset had seen the botnet creating, he adds.

However, SecureWorks researcher Joe Stewart disagrees that Waledac is Storm reincarnated:

Joe Stewart, director of malware research for SecureWorks, says Storm and Waledac are completely different when it comes to code and files. "It's definitely not the same programmers," he says.

Perhaps so. But who is programming and commanding this botnet, and whether or not they're the same as those who were previously commandeering Storm isn't what is important. What is important is that botnets are a long way from being exterminated -- and that we need more proactive ways of not only detecting them: but crushing them before they can rise to a level where they can do substantial damage.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.