Storm Botnet May Co-opt Infected PCs October 18, 2007
Posted by eastvalleygeeks in 10750.trackback
Changes to some variants may mean the Trojan’s creators are ’selling’ compromised systems to spammers.
The hackers behind the pernicious, persistent Storm Trojan are getting ready to slice off pieces of the botnet created by their malware so that they can “sell” the compromised computers to spammers and denial-of-service attackers, a researcher said Tuesday.
That’s the most likely explanation for the encryption added to secure the command-and-control traffic between the bot herder and some bots, said Joe Stewart, a senior security researcher at SecureWorks Inc. According to Stewart, who has closely tracked Storm since its debut in January, the newest variants include a 40-byte key that encrypts the command traffic. Unlike other bot-building Trojans, Storm uses peer-to-peer (P2P) rather than IRC (Internet Relay Chat) to receive commands, a tactic that has made its bots harder to take down.
“One possibility is that they’re splitting [the botnet] and selling off individual botnets to spammers,” said Stewart. “If they’re going to sell, they need to have it so each botnet is on a separate network. The easiest way to do that is to scramble the peer-to-peer Overnet traffic.”
If Stewart is right and the people responsible for Storm are getting ready to cash in, it would be a first. Until now, Storm has busied itself only with spreading more copies to uninfected PCs, and with several pump-and-dump stock-scam spam campaigns. There’s no evidence that the botnet has been rented out or sold before, said Stewart.
“This could be a precursor to selling Storm to other spammers, as an end-to-end spam botnet system, complete with fast-flux DNS [domain name system] and hosting capabilities,” Steward said. “If that’s the case, we might see a lot more of Storm in the future.”
Stewart, who characterized the new encryption used by Storm as “not strong,” said that the addition would actually help security researchers in the long run: It should be easier to separate the command-and-control from the rest of the Overnet P2P traffic. “It makes it a little easier. We should be able to tell at a glance whether the traffic is coming from a Storm node or an eDonkey [P2P] client.
