NESTA Crime Online - University of Brighton Repository

The Storm botnet case study: the survival of the fastest in upgrading
The Storm Worm botnet is a global network of compromised computers that was
estimated to control between one and five million machines, and is capable of sending
over three billion spams a day. Initially, the Storm Worm gang relied on social-
engineering techniques to lure victims to open an attachment that contained a piece of
malicious malware, a Trojan. This Trojan silently took control of the infected machines
and linked them together into a botnet, which was mainly used to send vast amounts of
spam and distributed denial of service attacks (DDoS). For some months, Storm Worm
was simply spreading and gaining strength, rapidly becoming one of the largest in the
world. It even started developing upgraded malware to avoid signature-based detection,
with new variants being created every 15 minutes.
Soon the Storm Worm had become the base that nearly all cybercriminals use to exploit
the Internet and hide their theft of millions of users' identities. By the end of 2007 it was
reported to comprise around 13 per cent of the entire malcode set collected. In 2008
Storm Worm launched for the first time a large blended attack that combined
sophisticated social engineering with malware [product upgrading] that not only enrolled
the infected PCs as part of Storm's botnet but also captured keystrokes, load viruses,
copy and transmit or delete files [functional upgrading]. 162
To remain operative, the Storm Worm botnet controllers introduced innovative
improvements in their camouflaging techniques. Currently, the locations of the remote
servers that control the botnet are hidden behind a constantly changing Domain Name
System (DNS) using a technique called ‘fast flux’. This technique changes the name and
location of the DNS servers, often on a minute by minute basis, making external
monitoring and disabling of the system more difficult. There is no central ‘command and
control point’ in the Storm botnet that can be shut down [process upgrading].
To add to these developments, there has been a recent segmentation of the botnet into
smaller, more discreet networks, which allows the controllers to hire-out each segment
162 Vikram Thakur from Symantec noted how Storm Worm moved from simply using social-engineering
techniques to spread malware to actually exploiting vulnerabilities.
Page 55