Storm Worm More Powerful Than Top Supercomputers

Stony Stevenson writes to mention that some security researchers are claiming that the Storm Worm has grown so massive that it could rival the world's top supercomputers in terms of raw power. "Sergeant said researchers at MessageLabs see about 2 million different computers in the botnet sending out spam on any given day, and he adds that he estimates the botnet generally is operating at about 10 percent of capacity. 'We've seen spikes where the owner is experimenting with something and those spikes are usually five to 10 times what we normally see,' he said, noting he suspects the botnet could be as large as 50 million computers. 'That means they can turn on the taps whenever they want to.'"

Comments

Co-opt it.. remove it.

[bigattichouse]

I just don't see why if 1) there are known decompiled versions of it and 2) the network activity can be monitored. why 3) Hasn't code been written to exploit the 'sploit and shut them down. Something that infiltrates, but keeps them running for - oh, say a week - while the exploit percolates through the system, and then kills and patches the running process.

Re:Co-opt it.. remove it.

[Anonymous Coward]

I'm not aware of any decompiled version. Storm detects when it's being run in a virtual machine and features heavy obfuscation and code morphing.

I see storm as a monoculture problem, the blame can largely be leveled at Microsoft.

Re:Co-opt it.. remove it.

[ZachPruckowski]

In addition to the complexity of the Storm worm, most zombies are set to be self-patching, for exactly the reason you mention. Many trojans, worms, and viruses actually remove other threats (using a pirated version of Kaspersky's software) and generally install patches. Once the hacker has stolen your computer, he doesn't want someone else stealing it away from him.

Re:Co-opt it.. remove it.

[Abcd1234]

Well, if the CPU virtualization is imperfect, it may be possible to detect either anomalies in the emulation, or by monitoring things like CPU cycle counters. And even if the CPU is emulated perfectly, you can also check for things like known bugs in peripherals, etc, which may not have been correctly emulated.

Threat to national security?

[ckedge]

Isn't this so large that it should be deemed a threat to national security? Not just to one country's national security, but ANY country's. Shouldn't there be a half dozen senior analysts from a few different countrys and from NATO HUNTING the people that control this thing and figuring out how to neutralize it?

Microsoft can help, but isn't

[courtarro]

Why hasn't Microsoft added Storm to its Malicious Software Removal Tool?

Re:Microsoft can help, but isn't

[garcia]

Why hasn't Microsoft added Storm to its Malicious Software Removal Tool?

Why don't more ISPs (like Comcast and Roadrunner) self-police their machines on a much more frequent basis and knock these customers offline? 99% of the limited spam and the massive amounts of trackback attempts, other web attacks, etc all come from residential cable connections.

I know that Comcast can check their network for infected hosts and shut them off. They need to do a much better job of it.

Re:Microsoft can help, but isn't

[TheRaven64]

Which is why you don't completely nock them off the net, you block everything except port 80, and redirect that to a site explaining how to get rid of the infection. For bonus points, you post them a bootable CD that will scan their machine and remove the infection through the post, so the virus can't intercept the antivirus downloads and break them.

That 60s reassurance, "we can always unplug them"

[dpbsmith]

In the 50s, 60s, 70s when there was science-fiction-inspired angst about the possibilities of computers taking over the world, the standard reassurance was that "after all, we can always unplug them." And I believe there was an SF story or two about how a computer could put up resistance to being unplugged. And of course everyone remembers the heartrending scene in 2001, A Space Odyssey when Dave shuts down Hal by physically ejecting Hal's logic modules.

It's funny how things work out:

"If you add up all 500 of the top supercomputers, it blows them all away with just 2 million of its machines. It's very frightening that criminals have access to that much computing power, but there's not much we can do about it." (emphasis supplied)

So much for "we can always unplug them," eh?

Re:Storm Worm - good name for sci-fi novel

[sugarman]

Plot idea 1: Near future. Governments completely dependent on their IT infrastructure. Organised crime in control of huge botnet able to hold government to ransom. With hilarious consequences Vernor Vinge, "True Names", 1981

Plot idea 2: Now-ish. Script kiddie unleashes attack using enormous botnet. Runs out of control. Becomes so deeply imbedded into internet that it's impossible to shut down without "rebooting" the whole infrastructure. With hilarious consequences. Pat Cadigan, Synners, 1991
(for various versions of "script kiddie", I guess)

Plot idea 3: Medium future. Internet and control of botnets becomes so intrinsic to society that governments have less importance than internet societies. Whole "countries" exist as virtual connections of affiliated machines. With hilarious consequences. Cory Doctorow, Eastern Standard Tribe, 2004

Of course, the above are only approximations of the listed plots. Someone with a deeper knowledge might be able to provide a better match.

Have you considered visiting your library? =)

Can somebody explain

[CaffeineAddict2001]

Why any person can't leverage the botnet for their own use? What it the "key" that allows the creator(s) to have exclusive access? If it essentially works like a peer-to-peer network couldn't you essentially "poison" the network with a few rouge nodes?

Block tcp/25

[macdaddy]

This is exactly why I, as the admin of an ISP, chose to block outbound tcp/25 at the edge with the only exception being the ISP's SMTP servers. I do this for all dynamically-assigned customers. Do you need to use a corporate SMTP server somewhere and they refuse to utilize the mail submission port (tcp/587)? Pay $5/month to get a static IP. Making the customer undertake a conscious effort with a monetary cost filters out the people who'll take any free service offered to them. The ones who really do need it are the ones who request it.

There's a reason why we only get 1-2 spam complaints (LARTs) per week. We aren't a source of spam. Spamming botnets are all but worthless on our network. Looking at the counters on the blocked outbound tcp/25 connections in our ACLs I literally seeing billions of hits per week. That's billions, with a B. Ba, Ba, B. Considering that we're a relatively small ISP, that's saying something. These spamming botnets would be far less useful to spammers if more ISPs took a stance and fought spam. That takes effort though.

Why nothing gets done about it.

[Animats]

Remember Amit Yoran? He was "cyber-security czar" at the US Department of Homeland Security. He started talking about the vulnerabilities implicit in Microsoft's software. His position was downgraded and he resigned in 2004.

Yoran's successor, Gregory Garcia, was a professional lobbyist, not a security expert.