Endpoint
4/28/2010
03:55 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Storm Worm Reappears

Slightly revamped version of original malware used by the infamous Storm botnet being actively spammed -- and spreading

It's baaack: The bot code used in the infamous, massive Storm botnet that was taken down nearly two years ago is being used to build another spamming botnet. Researchers have reverse-engineered the tweaked version of the original Storm code, which so far has spread somewhere between 10,000 to 20,000 machines.

Researchers don't know for sure whether it's the same botnet gang that drove the original Storm and then its predecessor, Waledac -- both of which are no more -- but they have identified two-thirds of the same elements in this latest version as in the original Storm code version. Noticeably missing is Storm's trademark peer-to-peer component: This version is all HTTP-based rather than the hybrid P2P/HTTP approach in the old botnet, which at one point swelled to a half-million bots. Storm began to fade away in the fall of 2008 after researchers were able to successfully disrupt its operations on more than one occasion.

Waledac, which boasted 60,000 to 80,000 zombies, was downed in February by a sneak attack from a team from Microsoft, Shadowserver, the University of Washington, Symantec, and a group of researchers from Germany and Austria who had first infiltrated the botnet last year.

Joe Stewart, director of malware research for the counter threat unit at Secureworks and known for his previous research on Storm, says he believes another person or group has procured the code and stripped out the P2P element. "From everything we've seen, it looks like the original Storm crew moved to Waledac...so what strikes me is that they stripped out the P2P and sold the spam code to another group to build a more simplified botnet," Stewart says. The P2P feature had been targeted by researchers, which made it less appealing, he says.

"They don't have to have peer-to-peer to make this thing work. It seems they [wanted to] get some more value from this old code base," says Stewart, who has seen between 10,000 and 20,000 infected machines thus far. "This is definitely not the same botnet -- it's a new botnet using Storm's original code."

Steven Adair, a researcher with the Shadowserver Foundation who was one of the first to spot the recycled and made-over Storm malware earlier this month, says the similarity to the original malcode is striking. "The user agent is the same, and it had a weird typo in it [like the original Storm], which is how we found it," Adair says.

He passed the sample to the Honeynet Project, which reverse-engineered it and found other similarities in the code, including the same command protocol, which is made up of a two-phase handshake, according to researchers there. Felix Leder, one of the Honeynet researchers, noted that two-thirds of the functions in the malware were basically cut and pasted from the original code.

Leder says the file itself looks different, however. "It has some protection around the actual code -- a packer -- that looks different," he says.

And there are still several weaknesses in the protocol, he says. "We are really astonished that they didn't improve that but just reused the code. Either they don't learn from their previous mistakes or it has been a different group that doesn't understand the design but just took the code, or they just don't care," says Leder, who, along with Honeynet members Mark Schloesser and Tillmann Werner, is still studying the botnet.

And its core function, like Storm, is for spamming and distributed denial-of-service (DDoS) attacks. "And it's still being controlled using the same template format," Secureworks' Stewart notes.

Stewart and Shadowserver's Adair have separately seen just one visible command-and-control server for the botnet, which they say is likely a proxy masking the rest of the botnet infrastructure. "They are already getting templates and sending out spam," says Adair, who notes that this new botnet so far doesn't appear to be as robust as Storm.

Researchers at Computer Associates, meanwhile, have spotted the new Storm malware being bundled with a Trojan downloader, along with fake antivirus software, as well. CA says the so-called Win32/Pecoan variant has been pumping out a spam email campaign using fake pharmacy, male impotency, adult dating, and celebrity scandal message lures.

The botnet so far isn't sending the same brand of socially engineered email messages that were characteristic of Storm, which capitalized on the latest news and were sent out during holidays, Stewart says. "This one is sending very typical spam," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3409
Published: 2014-10-25
The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (device reload) via malformed CFM packets, aka Bug ID CSCuq93406.

CVE-2014-4620
Published: 2014-10-25
The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials in nsrmedisv.raw log files, which allows local users to obtain sensitive information by reading these files.

CVE-2014-4623
Published: 2014-10-25
EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force a...

CVE-2014-4624
Published: 2014-10-25
EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call.

CVE-2014-6151
Published: 2014-10-25
CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.