Microsoft didn't crush Storm, counter researchers

Not so fast, says Trend Micro

Microsoft didn't crush the Storm botnet as it has claimed, rival security researchers argued today. Instead, the criminals responsible for the army of compromised computers diversified last year to avoid attention and expand their business.

Paul Ferguson, a network architect with anti-virus vendor Trend Micro, and a colleague, Jamz Yaneza, a Trend Micro research project manager, disputed Microsoft's contention that the Malicious Software Removal Tool (MSRT) had beat Storm into submission .

The MSRT is a program that Microsoft updates and automatically redistributes to Windows users each month on Patch Tuesday. It includes definitions for the most popular malware, sniffs systems for malicious code and then deletes it. Microsoft first added detection for the Storm Trojan in September 2007.

By Microsoft's count, the MSRT cleaned more than 526,000 Storm-infected PCs in the final four months of last year. After some back-and-forth between the Storm bot herders and Microsoft, the former gave up, said Jimmy Kuo, a senior security architect with the Redmond, Wash. developer.

"Even though they were able to maintain parts of their botnet, they knew they were in our gun sights," Kuo said in an interview earlier this week. "And ultimately they gave up."

Not so fast, said Trend Micro.

"The MSRT had an impact on Storm," Ferguson acknowledged, citing Trend Micro statistics that showed a 20% to 25% reduction in the number of bots within the Storm botnet late last year. "But there are some key gaps in the reality on the ground.

"Storm is still out there," he said. And active. "We've seen campaigns to renew their [botnet] body count within the last 48 hours."

More important, though, is the big picture, said Ferguson and Yaneza. Storm is certainly diminished, they agreed, but not simply because of Microsoft and its MSRT.

"Storm's operators have been diversifying," said Yaneza, who has followed Storm since it first appeared in early 2007. In fact, the Storm botnet's current size -- considerably smaller than during 2007 -- was a matter of choice, not something forced on the hackers, Yaneza argued.

"They've changed business tactics, and diversified into other botnets, just like the Russian Business Network diversified by getting out of St. Petersburg [Russia] and is now working out of many facilities worldwide," he said.

Researchers, including Yaneza, have linked Storm -- and other botnets -- with the Russian Business Network (RBN), a shadowy network of malicious code and hacker hosting services. Last November, Yaneza and others reported that the RBN pulled up stakes and moved most of its operations to servers based in China. When the media noted the shift, RBN apparently split its hosting services among several Asian countries, a move analysts saw as an attempt to avoid attention and possible action by law enforcement.

"At one time, Storm was a monster that was rented out for all kinds of activities," said Ferguson, ticking off spamming, denial-of-service attacks and malware distribution. "It was one big, huge target. But they diversified. That falls into the 'fly low under the radar' theory."

Some of the botnets that are most active now, Ferguson continued, have connections to Storm, and its creators and managers. "Some of the same people who had a hand in Storm have a hand in the new botnets," he said, naming Bobax and Kracken as two which Trend links to Storm.

"It's virtually impossible to tell who is really behind each of these botnets," Ferguson admitted, "but there are a lot of similarities in methodology."

The bottom line, said the Trend Micro researchers: Storm is still breathing.

"Storm is not down and out," said Ferguson.

Recommended

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?