Endpoint
4/28/2010
03:55 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Storm Worm Reappears

Slightly revamped version of original malware used by the infamous Storm botnet being actively spammed -- and spreading

It's baaack: The bot code used in the infamous, massive Storm botnet that was taken down nearly two years ago is being used to build another spamming botnet. Researchers have reverse-engineered the tweaked version of the original Storm code, which so far has spread somewhere between 10,000 to 20,000 machines.

Researchers don't know for sure whether it's the same botnet gang that drove the original Storm and then its predecessor, Waledac -- both of which are no more -- but they have identified two-thirds of the same elements in this latest version as in the original Storm code version. Noticeably missing is Storm's trademark peer-to-peer component: This version is all HTTP-based rather than the hybrid P2P/HTTP approach in the old botnet, which at one point swelled to a half-million bots. Storm began to fade away in the fall of 2008 after researchers were able to successfully disrupt its operations on more than one occasion.

Waledac, which boasted 60,000 to 80,000 zombies, was downed in February by a sneak attack from a team from Microsoft, Shadowserver, the University of Washington, Symantec, and a group of researchers from Germany and Austria who had first infiltrated the botnet last year.

Joe Stewart, director of malware research for the counter threat unit at Secureworks and known for his previous research on Storm, says he believes another person or group has procured the code and stripped out the P2P element. "From everything we've seen, it looks like the original Storm crew moved to Waledac...so what strikes me is that they stripped out the P2P and sold the spam code to another group to build a more simplified botnet," Stewart says. The P2P feature had been targeted by researchers, which made it less appealing, he says.

"They don't have to have peer-to-peer to make this thing work. It seems they [wanted to] get some more value from this old code base," says Stewart, who has seen between 10,000 and 20,000 infected machines thus far. "This is definitely not the same botnet -- it's a new botnet using Storm's original code."

Steven Adair, a researcher with the Shadowserver Foundation who was one of the first to spot the recycled and made-over Storm malware earlier this month, says the similarity to the original malcode is striking. "The user agent is the same, and it had a weird typo in it [like the original Storm], which is how we found it," Adair says.

He passed the sample to the Honeynet Project, which reverse-engineered it and found other similarities in the code, including the same command protocol, which is made up of a two-phase handshake, according to researchers there. Felix Leder, one of the Honeynet researchers, noted that two-thirds of the functions in the malware were basically cut and pasted from the original code.

Leder says the file itself looks different, however. "It has some protection around the actual code -- a packer -- that looks different," he says.

And there are still several weaknesses in the protocol, he says. "We are really astonished that they didn't improve that but just reused the code. Either they don't learn from their previous mistakes or it has been a different group that doesn't understand the design but just took the code, or they just don't care," says Leder, who, along with Honeynet members Mark Schloesser and Tillmann Werner, is still studying the botnet.

And its core function, like Storm, is for spamming and distributed denial-of-service (DDoS) attacks. "And it's still being controlled using the same template format," Secureworks' Stewart notes.

Stewart and Shadowserver's Adair have separately seen just one visible command-and-control server for the botnet, which they say is likely a proxy masking the rest of the botnet infrastructure. "They are already getting templates and sending out spam," says Adair, who notes that this new botnet so far doesn't appear to be as robust as Storm.

Researchers at Computer Associates, meanwhile, have spotted the new Storm malware being bundled with a Trojan downloader, along with fake antivirus software, as well. CA says the so-called Win32/Pecoan variant has been pumping out a spam email campaign using fake pharmacy, male impotency, adult dating, and celebrity scandal message lures.

The botnet so far isn't sending the same brand of socially engineered email messages that were characteristic of Storm, which capitalized on the latest news and were sent out during holidays, Stewart says. "This one is sending very typical spam," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2808
Published: 2015-04-01
The PRNG implementation in the DNS resolver in Bionic in Android before 4.1.1 incorrectly uses time and PID information during the generation of random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a rel...

CVE-2014-9713
Published: 2015-04-01
The default slapd configuration in the Debian openldap package 2.4.23-3 through 2.4.39-1.1 allows remote authenticated users to modify the user's permissions and other user attributes via unspecified vectors.

CVE-2015-0259
Published: 2015-04-01
OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.

CVE-2015-0800
Published: 2015-04-01
The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2...

CVE-2015-0801
Published: 2015-04-01
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.