Endpoint
4/28/2010
03:55 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Storm Worm Reappears

Slightly revamped version of original malware used by the infamous Storm botnet being actively spammed -- and spreading

It's baaack: The bot code used in the infamous, massive Storm botnet that was taken down nearly two years ago is being used to build another spamming botnet. Researchers have reverse-engineered the tweaked version of the original Storm code, which so far has spread somewhere between 10,000 to 20,000 machines.

Researchers don't know for sure whether it's the same botnet gang that drove the original Storm and then its predecessor, Waledac -- both of which are no more -- but they have identified two-thirds of the same elements in this latest version as in the original Storm code version. Noticeably missing is Storm's trademark peer-to-peer component: This version is all HTTP-based rather than the hybrid P2P/HTTP approach in the old botnet, which at one point swelled to a half-million bots. Storm began to fade away in the fall of 2008 after researchers were able to successfully disrupt its operations on more than one occasion.

Waledac, which boasted 60,000 to 80,000 zombies, was downed in February by a sneak attack from a team from Microsoft, Shadowserver, the University of Washington, Symantec, and a group of researchers from Germany and Austria who had first infiltrated the botnet last year.

Joe Stewart, director of malware research for the counter threat unit at Secureworks and known for his previous research on Storm, says he believes another person or group has procured the code and stripped out the P2P element. "From everything we've seen, it looks like the original Storm crew moved to Waledac...so what strikes me is that they stripped out the P2P and sold the spam code to another group to build a more simplified botnet," Stewart says. The P2P feature had been targeted by researchers, which made it less appealing, he says.

"They don't have to have peer-to-peer to make this thing work. It seems they [wanted to] get some more value from this old code base," says Stewart, who has seen between 10,000 and 20,000 infected machines thus far. "This is definitely not the same botnet -- it's a new botnet using Storm's original code."

Steven Adair, a researcher with the Shadowserver Foundation who was one of the first to spot the recycled and made-over Storm malware earlier this month, says the similarity to the original malcode is striking. "The user agent is the same, and it had a weird typo in it [like the original Storm], which is how we found it," Adair says.

He passed the sample to the Honeynet Project, which reverse-engineered it and found other similarities in the code, including the same command protocol, which is made up of a two-phase handshake, according to researchers there. Felix Leder, one of the Honeynet researchers, noted that two-thirds of the functions in the malware were basically cut and pasted from the original code.

Leder says the file itself looks different, however. "It has some protection around the actual code -- a packer -- that looks different," he says.

And there are still several weaknesses in the protocol, he says. "We are really astonished that they didn't improve that but just reused the code. Either they don't learn from their previous mistakes or it has been a different group that doesn't understand the design but just took the code, or they just don't care," says Leder, who, along with Honeynet members Mark Schloesser and Tillmann Werner, is still studying the botnet.

And its core function, like Storm, is for spamming and distributed denial-of-service (DDoS) attacks. "And it's still being controlled using the same template format," Secureworks' Stewart notes.

Stewart and Shadowserver's Adair have separately seen just one visible command-and-control server for the botnet, which they say is likely a proxy masking the rest of the botnet infrastructure. "They are already getting templates and sending out spam," says Adair, who notes that this new botnet so far doesn't appear to be as robust as Storm.

Researchers at Computer Associates, meanwhile, have spotted the new Storm malware being bundled with a Trojan downloader, along with fake antivirus software, as well. CA says the so-called Win32/Pecoan variant has been pumping out a spam email campaign using fake pharmacy, male impotency, adult dating, and celebrity scandal message lures.

The botnet so far isn't sending the same brand of socially engineered email messages that were characteristic of Storm, which capitalized on the latest news and were sent out during holidays, Stewart says. "This one is sending very typical spam," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.