Endpoint
4/28/2010
03:55 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Storm Worm Reappears

Slightly revamped version of original malware used by the infamous Storm botnet being actively spammed -- and spreading

It's baaack: The bot code used in the infamous, massive Storm botnet that was taken down nearly two years ago is being used to build another spamming botnet. Researchers have reverse-engineered the tweaked version of the original Storm code, which so far has spread somewhere between 10,000 to 20,000 machines.

Researchers don't know for sure whether it's the same botnet gang that drove the original Storm and then its predecessor, Waledac -- both of which are no more -- but they have identified two-thirds of the same elements in this latest version as in the original Storm code version. Noticeably missing is Storm's trademark peer-to-peer component: This version is all HTTP-based rather than the hybrid P2P/HTTP approach in the old botnet, which at one point swelled to a half-million bots. Storm began to fade away in the fall of 2008 after researchers were able to successfully disrupt its operations on more than one occasion.

Waledac, which boasted 60,000 to 80,000 zombies, was downed in February by a sneak attack from a team from Microsoft, Shadowserver, the University of Washington, Symantec, and a group of researchers from Germany and Austria who had first infiltrated the botnet last year.

Joe Stewart, director of malware research for the counter threat unit at Secureworks and known for his previous research on Storm, says he believes another person or group has procured the code and stripped out the P2P element. "From everything we've seen, it looks like the original Storm crew moved to Waledac...so what strikes me is that they stripped out the P2P and sold the spam code to another group to build a more simplified botnet," Stewart says. The P2P feature had been targeted by researchers, which made it less appealing, he says.

"They don't have to have peer-to-peer to make this thing work. It seems they [wanted to] get some more value from this old code base," says Stewart, who has seen between 10,000 and 20,000 infected machines thus far. "This is definitely not the same botnet -- it's a new botnet using Storm's original code."

Steven Adair, a researcher with the Shadowserver Foundation who was one of the first to spot the recycled and made-over Storm malware earlier this month, says the similarity to the original malcode is striking. "The user agent is the same, and it had a weird typo in it [like the original Storm], which is how we found it," Adair says.

He passed the sample to the Honeynet Project, which reverse-engineered it and found other similarities in the code, including the same command protocol, which is made up of a two-phase handshake, according to researchers there. Felix Leder, one of the Honeynet researchers, noted that two-thirds of the functions in the malware were basically cut and pasted from the original code.

Leder says the file itself looks different, however. "It has some protection around the actual code -- a packer -- that looks different," he says.

And there are still several weaknesses in the protocol, he says. "We are really astonished that they didn't improve that but just reused the code. Either they don't learn from their previous mistakes or it has been a different group that doesn't understand the design but just took the code, or they just don't care," says Leder, who, along with Honeynet members Mark Schloesser and Tillmann Werner, is still studying the botnet.

And its core function, like Storm, is for spamming and distributed denial-of-service (DDoS) attacks. "And it's still being controlled using the same template format," Secureworks' Stewart notes.

Stewart and Shadowserver's Adair have separately seen just one visible command-and-control server for the botnet, which they say is likely a proxy masking the rest of the botnet infrastructure. "They are already getting templates and sending out spam," says Adair, who notes that this new botnet so far doesn't appear to be as robust as Storm.

Researchers at Computer Associates, meanwhile, have spotted the new Storm malware being bundled with a Trojan downloader, along with fake antivirus software, as well. CA says the so-called Win32/Pecoan variant has been pumping out a spam email campaign using fake pharmacy, male impotency, adult dating, and celebrity scandal message lures.

The botnet so far isn't sending the same brand of socially engineered email messages that were characteristic of Storm, which capitalized on the latest news and were sent out during holidays, Stewart says. "This one is sending very typical spam," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2886
Published: 2014-09-18
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during ins...

CVE-2014-4352
Published: 2014-09-18
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.

CVE-2014-4353
Published: 2014-09-18
Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.

CVE-2014-4354
Published: 2014-09-18
Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.

CVE-2014-4356
Published: 2014-09-18
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.

Best of the Web
Dark Reading Radio