Microsoft didn't crush Storm, counter researchers
Botnet operators diversified of their own accord, argues Trend Micro
Computerworld - Microsoft Corp. didn't crush the Storm botnet as it has claimed, rival security researchers argued today. Instead, the criminals responsible for the army of compromised computers diversified last year to avoid attention and expand their business.
Paul Ferguson, a network architect, and Jamz Yaneza, a research project manager, both at Trend Micro Inc., disputed Microsoft's contention that its Malicious Software Removal Tool (MSRT) had beaten Storm into submission.
The MSRT is a program that Microsoft updates and automatically redistributes to Windows users each month on Patch Tuesday. It includes definitions for the most popular malware, sniffs systems for malicious code and then deletes it. Microsoft first added detection for the Storm Trojan horse in September 2007.
By the company's count, the MSRT cleaned more than 526,000 Storm-infected PCs in the final four months of last year. After some back and forth between the Storm bot herders and Microsoft, the former gave up, said Jimmy Kuo, a senior security architect at the company.
"Even though they were able to maintain parts of their botnet, they knew they were in our gun sights," Kuo said in an interview earlier this week. "And ultimately they gave up."
Not so fast, said Trend Micro.
"The MSRT had an impact on Storm," Ferguson acknowledged, citing Trend Micro statistics that showed a 20% to 25% reduction in the number of bots within the Storm botnet late last year. "But there are some key gaps in the reality on the ground.
"Storm is still out there," he said. And active. "We've seen campaigns to renew their [botnet] body count within the last 48 hours," Ferguson said.
More important, though, is the big picture, said Ferguson and Yaneza. Storm is certainly diminished, they agreed, but not simply because of Microsoft and its MSRT.
"Storm's operators have been diversifying," said Yaneza, who has followed Storm since it first appeared in early 2007. In fact, the Storm botnet's current size -- considerably smaller than during 2007 -- was a matter of choice, not something forced on the hackers, Yaneza argued.
"They've changed business tactics and diversified into other botnets, just like the Russian Business Network diversified by getting out of St. Petersburg [Russia] and is now working out of many facilities worldwide," he said.
Researchers, including Yaneza, have linked Storm -- and other botnets -- with the Russian Business Network (RBN), a shadowy network of malicious code and hacker hosting services. Last November, Yaneza and others reported that the RBN pulled up stakes and moved most of its operations to servers based in China. When the media noted the shift, RBN apparently split its hosting services among several Asian countries, a move analysts saw as an attempt to avoid attention and possible action by law enforcement.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts