Storm: the largest botnet in the world?

Timely spam blasts help spread highly aggressive malware

Researchers say the size and scope of the botnet created by the Storm worm makes it one of the most aggressive pieces of malware to date.

Storm may not be the most creative or malicious piece of malware ever written, but it’s on track to become the most productive; threat researchers’ recent estimates put the number of PCs it has infected at more than 1 million.

First showing up on researchers’ radars about a year ago, Storm is defined by some as a worm, others as a Trojan Horse   See FAQ.  Though it has gone by many names, Storm — referring to the spam blasts it’s been behind that mention storms — has stuck.

Although Storm doesn’t use any particularly inventive or malicious techniques, such as erasing files on a hard drive or recording keystrokes to capture passwords and personal information, it has gained notoriety through its writers’ ability to update and adapt both the malware’s code and the spam blasts that lure people to become infected with it — all with the purpose of building a giant botnet.

“Storm is a very aggressive worm,” says John Levine, president of consulting firm Taughannock Networks and co-chair of the Internet Research Task Force's Anti-Spam Research Group. “It’s interesting because it uses a [peer-to-peer] control structure that makes it hard to kill.”

Most threat watchers say no one knows who is behind Storm, but Finnish antivirus maker F-Secure, which takes credit for giving Storm its name, says a group called the Zhelatin Gang is responsible and whom the company believes is operating out of Russia. F-Secure also says that Storm is the largest botnet in the world with just more than 1 million infected PCs; however, other researchers say there’s no way to know how many PCs have been infected.

Compared with highly destructive pieces of malware such as Slammer and Blaster that took down many computers and services, Storm sticks to mostly sending out spam and occasionally launching distributed denial-of-service (DoS) attacks, particularly against security companies that research the malware. But because of its size, Storm’s potential for harm is serious, says Patrik Runald, technical manager at F-Secure.

“As [Storm’s owners] have roughly 1 million computers under their control, we do have to take the threat of them attacking critical networks very seriously,” he says.

How Storm attacks

The way Storm secretly installs itself on PCs is via spam, but typically Storm is not carried by the message; instead the message attempts to get the recipient to visit a Web site that downloads the malware. It’s hard to avoid Storm-related spam, which was particularly active in late summer and shows no sign of stopping. These spam blasts take advantage of whatever the malware’s owners think would most entice recipients to click on the embedded link to a Web site purportedly related to the e-mail’s subject — be it a recent event such as the Labor Day weekend or the start of the football season or pop culture items such as computer games or a YouTube video clip.  

Whoever owns Storm is “certainly in tune with American society,” says Roger Thompson, CTO of Exploit Prevention Labs. “They’re probably European — their command of English is not perfect — but they understand American culture quite well.”

If recipients of Storm-backed spam click on the link, they are taken to a Web site that automatically downloads Storm if their browsers don’t have the most recent patches installed, researchers say. If visitors to the infected Web site do have an up-to-date browser, the site will ask them to click on a few links (with social-engineering queues such as "to download software for viewing your e-card greeting, click here") that allow Storm to circumvent current patches and install itself.

“Nobody’s patched against social engineering,” says Ben Greenbaum, senior manager of Symantec’s Security Response team.

Once Storm is downloaded onto a PC, it turns that computer into part of its botnet, an army of compromised PCs that can be controlled remotely without the owner realizing it.

And that’s where the profits come in; researchers believe the people behind Storm make money by renting out portions of their botnet. Members of Storm’s botnet can be turned into spam servers, so organizations looking for an untraceable way to blast spam will rent space on these compromised PCs; when the spam sender’s IP address is investigated it leads back to the member of the botnet, not the actual spammer.

Considering how profitable crime on the Internet has become, there’s no reason to believe that Storm will die down; last month at a conference McAfee CEO David DeWalt said cybercrime has become a $105 billion business, making it worth more than the worldwide illegal drug trade.

Members of the Storm botnet also can be programmed to act as Web servers that download other malicious code, as well as participants in a distributed DoS attack, researchers say.

While Storm spam doesn’t cause much concern among enterprise IT departments — because antispam vendors usually catch on to the latest spam blast and update their filters within days, if not hours — the potential of unknowingly having corporate assets become part of this huge botnet that’s committing crime across the Internet does cause concern.

“We have real-time network traffic monitoring tools implemented across [Argonne National Laboratory]’s networks to ensure that we quickly become aware of 'bad' behavior, especially bot-type/malware behavior,” says David Salbego, Unix and operations service manager with Argonne National Laboratory’s computing and information systems department. “While no system is perfect, simply relying on not becoming infected is not sufficient — one must be able to definitely prove that machines are not infected and/or not communicating with known `bad guys.’”

Storm a step ahead

Another feature of Storm that keeps researchers on their toes is the malware’s ability to constantly change in attempts to keep one step ahead of prevention measures.

“We detect the exploits [Storm] uses to force its way in,” Thompson adds. “At one point they were actually changing what they were installing as often as every minute to avoid [antivirus] programs.”

Another antivirus vendor agrees that while Storm isn’t the worst piece of malware the Internet has seen, its versatility gives it longevity.

“I don’t think Storm is doomsday; I still think people can use the Internet safely,” says Dave Marcus, security research and communications manager at McAfee Avert Labs. “But I also don’t think it’s going to subside any time soon, because of the many ways it can be used. It’s something we have to stay vigilant about.”

Learn more about this topic

Storm FAQ

09/27/07

Storm worm gets smarter

07/26/07

Spam up in August, despite PDF type's short life

09/06/07

Storm Worm's virulence may change tactics

08/02/07

Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind.
Now read: Getting grounded in IoT