SecureWorks: Storm worm may be for sale

Share this article:
The infamous storm worm trojan, which first hit inboxes in January, is poised to become a for-sale spam botnet system, complete with fast-flux DNS and hosting capabilities.

According to Joe Stewart, SecureWorks' senior security researcher, the storm worm is using a 40-byte key to encrypt traffic on the Overnet distributed-client peer-to-peer (p2p) network.

"This means that each node will be able to communicate only with nodes that use the same key," he said on SecureWorks' blog. "This effectively allows the storm author to segment the storm botnet into smaller networks [and] could be a precursor to selling storm to other spammers.

“If that's the case, we might see a lot more of storm in the future," he said.

Stewart also had some good news. Network administrators will be able to easily distinguish storm traffic from other p2p network use.

Once the storm worm compromises a PC, it adds it to its bot army. Spammers have customized their tactics to deliver the trojan in different ways, including electronic greeting cards and news stories.

In a July 16 outbreak, the storm worm generated 120 million messages, according to security vendor Postini, now a part of Google. The trojan was named for the European wind storms that occurred simultaneously with the first attacks this January.

Share this article:

Sign up to our newsletters

More in News

DDoS attacks remain up, stronger in Q2, report says

DDoS attacks remain up, stronger in Q2, report ...

Prolexic's second quarter DDoS report noted the proliferation of shorter attacks that ate up more bandwidth.

Superman soars above fellow superheroes as most toxic search term

A McAfee study found that searches pertaining to Superman exposed users to the most infected websites.

Black Hat talk on Tor weaknesses canceled

Black Hat organizers say legal counsel for the Software Engineering Institute and Carnegie Mellon University nixed the session.