SecureWorks: Storm worm may be for sale

Share this article:
The infamous storm worm trojan, which first hit inboxes in January, is poised to become a for-sale spam botnet system, complete with fast-flux DNS and hosting capabilities.

According to Joe Stewart, SecureWorks' senior security researcher, the storm worm is using a 40-byte key to encrypt traffic on the Overnet distributed-client peer-to-peer (p2p) network.

"This means that each node will be able to communicate only with nodes that use the same key," he said on SecureWorks' blog. "This effectively allows the storm author to segment the storm botnet into smaller networks [and] could be a precursor to selling storm to other spammers.

“If that's the case, we might see a lot more of storm in the future," he said.

Stewart also had some good news. Network administrators will be able to easily distinguish storm traffic from other p2p network use.

Once the storm worm compromises a PC, it adds it to its bot army. Spammers have customized their tactics to deliver the trojan in different ways, including electronic greeting cards and news stories.

In a July 16 outbreak, the storm worm generated 120 million messages, according to security vendor Postini, now a part of Google. The trojan was named for the European wind storms that occurred simultaneously with the first attacks this January.

Share this article:

Sign up to our newsletters

More in News

Report: SQL injection a pervasive threat, behavioral analysis needed

Report: SQL injection a pervasive threat, behavioral analysis ...

Long lag times between detection and resolution and reliance on traditional methods impair an organization's ability to combat SQL injection attacks.

WhatsApp bug allows for interception of shared locations

Researchers identified a vulnerability in WhatsApp that could enable an attacker to intercept shared locations using a man-in-the-middle attack, or a rogue access point.

Google tweaks its terms of service for clarity on Gmail scanning

The company is currently dealing with a lawsuit that challenges its email scanning practices.