Researchers 'poison' Storm botnet

First publicly released research attempting to actively disrupt a peer-to-peer botnet unveiled in Germany

A group of German researchers has unveiled the first publicly released research attempting to actively disrupt a peer-to-peer botnet - using as their case study the notorious Storm worm.

The researchers were able not only to infiltrate Storm, gaining in the process the most precise estimates of its size to date, but also had success in disrupting its communications through a "poisoning" technique, according to the study.

The study, "Measurements and Mitigation of Peer-to-Peer-based Botnets," was authored by five researchers working with the University of Mannheim and Institut Eurecom, and was presented at the Usenix Workshop on Large-Scale Exploits and Emergent Threats (LEET) earlier this month in San Francisco.

Botnets have become among the most pressing threats on the internet, accounting for most spam and capable of directing large-scale denial-of-service and other categories of attacks.

Most recently, botnets such as that created by the Storm worm have begun using peer-to-peer techniques for communications, eliminating the need for a central control server and making them far more difficult to shut down.

By taking a more active approach, the researchers found a way to "poison" the communications of the Storm bots, effectively disrupting them.

"Our strategy can be used as a way to disable the communication within the Storm botnet to a large extent," they wrote in the study. "As a side effect, we are able to estimate the size of the Storm botnet, in general a hard task."

Previous research has been based on passive techniques such as observing network events such as the number of spam emails thought to have originated from a particular botnet, the researchers said.

They said the new study is the first to use active techniques, crawling the P2P network, keeping track of all peers and distinguishing infected peers from benign ones based on behavior.

Crawling the "Stormnet" every 30 minutes from the beginning of December 2007 to the beginning of February 2008, the researchers found between 5,000 and 40,000 peers online at any given time, with a sharp increase in bots during the Christmas and New Years Eve periods.

The bots were located in more than 200 countries, with the biggest proportion in the US, at 23 percent.

The "poisoning" technique involves the keys used by Storm bots to establish communication. The researchers published a large amount of false content for particular keys.

"Our experiments show that by polluting all those hashes that we identified to be storm hashes, we can disrupt the communication of the botnet," the researchers wrote.

Another technique, called a "sybil" or "eclipse" attack, aiming to separate a part of the P2P network from the rest, proved ineffective.

Active interference with a botnet may carry serious legal consequences for researchers, since the botnet hosts are effectively computer systems belonging to third parties, who ordinarily are unaware that their systems are being misused.

In part because of this factor, previous research has focused on passive techniques for identifying the size and control structure of a botnet, leaving law enforcement authorities to take action, the researchers acknowledged.

The researchers said future efforts will focus on analyzing a second tier of systems that issue the actual commands, which might allow the identification of the operators of the Storm worm.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Matthew Broersma

Techworld.com
Show Comments

Cool Tech

Bang and Olufsen Beosound Stage - Dolby Atmos Soundbar

Learn more >

Toys for Boys

Nakamichi Delta 100 3-Way Hi Fi Speaker System

Learn more >

ASUS ROG, ACRONYM partner for Special Edition Zephyrus G14

Learn more >

Sony WF-1000XM3 Wireless Noise Cancelling Headphones

Learn more >

Family Friendly

Mario Kart Live: Home Circuit for Nintendo Switch

Learn more >

Philips Sonicare Diamond Clean 9000 Toothbrush

Learn more >

Stocking Stuffer

SunnyBunny Snowflakes 20 LED Solar Powered Fairy String

Learn more >

Teac 7 inch Swivel Screen Portable DVD Player

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Shining a light on creativity

MSI has long pushed the boundaries of invention with its ever-evolving range of laptops but it has now pulled off a world first with the new MSI Creative 17.

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?