Storm Worm More Powerful Than Top Supercomputers

Stony Stevenson writes to mention that some security researchers are claiming that the Storm Worm has grown so massive that it could rival the world's top supercomputers in terms of raw power. "Sergeant said researchers at MessageLabs see about 2 million different computers in the botnet sending out spam on any given day, and he adds that he estimates the botnet generally is operating at about 10 percent of capacity. 'We've seen spikes where the owner is experimenting with something and those spikes are usually five to 10 times what we normally see,' he said, noting he suspects the botnet could be as large as 50 million computers. 'That means they can turn on the taps whenever they want to.'"

Comments

Fine the technically illiterate

[ComradeSnarky]

They should write a virus that uses exploits to install stuff like Folding@Home etc. If people pose a nuisance/danger to others in real life they get fined/jailed, if they pose a nuisance/danger online by letting their computers be compromised then they should face "punishment" by "fining" them part of their CPU power.

Re:Fine the technically illiterate

[TapeCutter]

"Fsck that, they should install a vaccine that makes the machine unbootable, and more or less requires a re-install and shutdown the system."

MS already offer a range of products that do just that, I hear they are very popular. :0

Re:Fine the technically illiterate

[fm6]

...if they pose a nuisance/danger online by letting their computers be compromised then they should face "punishment" by "fining" them part of their CPU power.

In other words, you want to punish people for not being geeks.

That sort of self-righteous bullshit is exactly how criminals rationalize their own misdeeds — such as botnets.

Re:Fine the technically illiterate

[fm6]

I would like to punish them for being naive and oblivious about the fact that a PC attached to a network is a complex responsibility.

So nobody but a geek should be allowed to have a networked computer? Not only is that morally absurd (punishing people for owning infestable technology is like punishing Pinto owners for buying a car that tends to explode), it would destroy the online economy. Off which more than a few of us make our livings.

If you want to start regulating who and what can or cannot connect to the Internet (you can't, it's not politically feasible to introduce such a rule, or practical to enforce it; but let's say you can) then you should ban all PCs from the Internet. People would only be allowed to access the Internet via network appliances like the Foleo, which are relatively resistant to malware because they don't support on-the-fly software installation.

Right now, you're sputtering and saying something that begins with "Why should I have to give up ...." Well dude, you just made a proposal that would have a lot of other people making similar protests. It's a lot easier to play social engineer when only other people are affected by your proposals.

Re:Fine the technically illiterate

[GooberToo]

According to the DoD, botnets pose a danger to national security. Accordingly, I just don't understand why the DoD, under the guise of national security, doesn't create their own worm which infects the systems which simply uninstalls its NIC driver. They can then change the screen saver, all found browser's homepage, and desktop to indicate the system has been removed from the internet for national security reasons because their system was infected. It should then instruct them to reinstall their system with a firewall installed before they reconnect to the internet.

By doing this they immediately stop both DoS and spam vectors. They alert the user owning the computer their computer has been infected. By simply uninstalling the NIC driver, they have not caused any long term damage. If they manage to annoy both the end user and ISP enough, one or the other is likely to do something to prevent recurring issues.

Obviously the botnet owner can attempt to prevent this but at least it turns into a cat and mouse game between the owner and the DoD. As such, the botnet owner must now spend resources protecting their harvest rather than exploiting its capabilities. So it seems like a win-win to me.

Re:Fine the technically illiterate

[Kpt Kill]

Warning Foo.exe is try...[OK] Warning WinCom.exe is attempting to [Allow] Warning Internet Explorer is being told to [Permit] "Ahhh Finally, I can get to the internet. These pop ups are ridiculous." And this is the problem. To use the car analogy: It can blink and beep a million times that Red 'OIL' Icon, but unless you actually know or pay attention to that warning... well poof.

Storm Worm - good name for sci-fi novel

[pzs]

Plot idea 1: Near future. Governments completely dependent on their IT infrastructure. Organised crime in control of huge botnet able to hold government to ransom. With hilarious consequences.

Plot idea 2: Now-ish. Script kiddie unleashes attack using enormous botnet. Runs out of control. Becomes so deeply imbedded into internet that it's impossible to shut down without "rebooting" the whole infrastructure. With hilarious consequences.

Plot idea 3: Medium future. Internet and control of botnets becomes so intrinsic to society that governments have less importance than internet societies. Whole "countries" exist as virtual connections of affiliated machines. With hilarious consequences.

Any of the above would work well as a Hollywood movie given Angelina Jolie and lots of gratuitous and incorrect techno-babble.

Peter

"Add the computers together"?

[gardyloo]

So this botnet rivals supercomputers for power as long as it's working on some purely parallelizeable problem. Like, for instance, sending spam messages.

Re:Follow the money

[Anonymous Coward]

As a side issue, how hard is it for an ISP to see an IP sending out the typical spam mail and closing off that IP/client. That may be dangerous ground. Show an ISP who can invade their users' traffic enough to sniff out a particular worm, and you'll have the **AA swooping in demanding that the ISP also sniff out illegal torrents, .gov insisting that their ability to catalog your pr0n collection is more important, bad parents insisting that the ISP filter out anything that might show their children a boob, etc.

Re:Not really like a supercomputer though

[ZachPruckowski]

Correct, but high-speed interconnects don't really matter for its applications.

• Sending spam is a fully parallel operation.
• Distributed Denial of Service is equally parallel. Once a bot has the instructions, it can run indefinitely (or until caught)
• Encryption cracking can be relatively parallel, especially with PGP - tell each computer to take a certain set of prime combinations to check.
• Click fraud is also distributable (tell bots to click on ads on site X once a day)

Additionally, many botnet operations don't involve the whole botnet. A few members of the botnet may be used for warez or pr0n storage, and which only involves computers working together to achieve redundancy. Also, the use of a botnet to allow for misdirection in tracking a hacker only requires the bots to be used serially.

Re:Co-opt it.. remove it.

[Richard W.M. Jones]

I think the real question is -- what are the FBI / police doing about it? There's a huge, ongoing, major crime happening, and there is apparently no police activity at all.

Rich.

Where's the investigation

[Tom]

Makes you wonder why the FBI and other police forces have enough resources to go after Joe sharing the latest CD release, but apparently not enough to do something about what probably is the largest computer crime in history.

I guess the answer has something to do with priorities. Which is exactly what I think the problem is.

monoculture problem?

[Gary W. Longsine]

I'm not convinced that the monopoly presence of Windows accounts for enormous Windows based botnets. There are what, something like 25 million Macintosh computers running Mac OS X, and most of those are running the same version of Mac OS X. That's a big enough pool, yet we don't see botnets on the Macintosh at all.

Suppose the market were evenly divided, 1/4 Windows, 1/4 Linux, 1/4 Macintosh, and 1/4 online game consoles that are always connected to the internet. Where would the botnets be hosted? Probably Windows. Botnets will begin to run on other platforms within about 48 hours after the security of Windows systems rises to a level equivalent to the other available platforms.

Re:Follow the money

[Opportunist]

I'm willing to take a few risks and take care of my own security to protect my liberty. I know, it's going out of fashion, but an old dog doesn't like learning new tricks.