Slashdot Mirror

← Back to Stories (view on slashdot.org)

Storm Dismantled at USENIX LEET Workshop

Posted by Zonk on from the is-that-like-1337-leet dept.

An anonymous reader writes "The USENIX LEET workshop held earlier this week in San Francisco offered neat insights into the Storm botnet, including two papers showing the difficulty of accurately measuring the botnet's size, and one on the way it conducts its spamming campaigns (down to the template language used). There was a bunch of other cool work too, so check out the papers."

9 of 58 comments (clear)

  1. My only question by Anonymous Coward · · Score: 2, Funny

    Does this run on Linux?

  2. Re:My pet love/hate for botnets by Anonymous Coward · · Score: 4, Funny

    I think we should take over the botnet and use it as a spam filter. That would be semi-legit, right?

  3. "Shatter Her Meat Tunnel and Bash Down Walls..." by falsemover · · Score: 5, Funny

    "... With Your Humongous New Cock." (actual subject header of spam email received)

    Seriously, we haven't had this kind of inspired ribald poetry since William Shakespeare.

    I say bring it on, we need the spam entertainment.

    SAVE THE BOTNET - SPAM IS ART

    Dans la viande a bon marche, il est poesie

    --
    consider coffee a lubricant that helps one penetrate the coding zone
  4. What user-agent string is it seeking? by symbolset · · Score: 5, Funny

    We used different releases of three web browsers, resulting in a total of eight different browser versions. The results indicate that Storm exploits only web browsers with a specific User-Agent, a HTTP request header field specifying the browser version. If this header field specifies a non-vulnerable browser, the malicious server does not send the exploit to the client. However, if the client seems to be vulnerable, the server sends between three and six different exploits for vulnerabilities commonly found in this browser or in common browser-addons. The goal of all these exploits is to install a copy of the Storm binary on the visitor's machine. We observed that the actual exploit used in the malicious Web sites is polymorphic, i.e., the exploit code changes periodically, in this case every minute, which complicates signature-based detection of these malicious sites.

    So... three guesses what user-agent it's looking for.

    --
    Help stamp out iliturcy.
    1. Re:What user-agent string is it seeking? by Ford+Prefect · · Score: 4, Funny

      So... three guesses what user-agent it's looking for.

      Sarah Connor?

      --
      Tedious Bloggy Stuff - hooray?
    2. Re:What user-agent string is it seeking? by n0dna · · Score: 2, Funny

      See? Not even Botnets use Opera.

      *grin*

  5. Re:OMG by socsoc · · Score: 3, Funny

    Kill us all by destroying the Internet? But I learned last night that when the Internet stops working, everyone will just head out the Californee way.

  6. Not all bad! by illama · · Score: 3, Funny
    FTA:

    Second, Storm synchronizes the system time of the infected machine with the help of the Network Time Protocol (NTP). This means that each infected machine has an accurate clock. See, it's not all bad!
  7. Re:"Shatter Her Meat Tunnel and Bash Down Walls... by archkittens · · Score: 2, Funny

    next thing we know, it will be cracking google toolbar and getting a look at search histories associated with gmail accounts, and since all spam is invariably connected with some form of sex industry...

    i cant wait to get the line "get a larger hadron collider with our revolutionary unix-based pill!"