BleepingComputer.com: Storm Worm Strikes Back

Jump to content

Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

Storm Worm Strikes Back

#1 User is offline   quietman7 

  • Bleepin' Janitor
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Global Moderator
  • Posts: 25,511
  • Joined: 09-July 05
  • Gender:Male
  • Location:Virginia, USA

Posted 26 October 2007 - 08:07 AM

Quote

The Storm worm is fighting back against security researchers that seek to destroy it...The worm can figure out which users are trying to probe its command-and-control servers, and it retaliates by launching DDoS attacks against them, shutting down their Internet access for days...A recently discovered capability of Storm is its ability to interrupt applications as they boot up and either shut them down or allow them to appear to boot, but disable them...

networkworld.com
Microsoft MVP - Consumer Security 2007-2012 Posted Image
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#2 User is offline   rowal5555 

  • Just enough info to be armed & dangerous...
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Members
  • Posts: 2,644
  • Joined: 18-March 06
  • Gender:Male
  • Location:St Kilda, Dunedin. South Island. NZ

  Posted 29 October 2007 - 08:34 PM

It would appear that STORM is quietly mutating and infecting millions of PCs while gathering itself for a massive attack against the Internet. Because it is doing very little at the moment, it is not receiving the media attention that flashier attacks do.

My question is, will my present armour protect me, or are special???? measures required?

IMHO, those responsible should be hunted down the same as any other terrorist.

This one really worries me and I would appreciate any opinions.

Cheers
rowal5555 (Rob )                                                             
Avid supporter of Bleeping Computer's
Team 38444

You can help find a cure

 


#3 User is offline   harrywaldron 

  • Security Reporter
  • PipPipPipPip
  • Find Topics
  • Group: Members
  • Posts: 509
  • Joined: 10-April 04
  • Gender:Male
  • Location:Roanoke, Virginia

  Posted 30 October 2007 - 03:43 PM

^ Hi Rob - Excellent questions ... Yes, most likely you'll stay protected if you do the following:

- Stay up-to-date with AV protection (most update daily and even autoupdate for you behind the scenes in some cases)

- Most importantly, being careful is your #1 ally in the security defense process. I had read where most "mass spam" attacks only have about 30% coverage on day one (although some may heuristically find SW variants). As long as you avoid URLs and attachments in suspicious emails designed to trick folks, you're going to stay clean. Still, the 1st e-card SW variant I got some months ago almost tricked me, as I got a copy before anyone posted info or alerts (still, the numeric IP address was a tale-tell sign to avoid this completely).

- Try running weekly scans periodically ... Most times you won't find something. One trick the SW authors are using is to make the AV protection seem like it's working when it's not behind the scenes. Running scans, updating, etc., all help ensure your AV environment is operational

- Spam filtering helps separate legitimate email verses spoofed email attacks. Almost all the copies I have received (and there have been bunches) were thrown in the SPAM or BULK folders

- Keep your PC up-to-date on all Windows and other product patches. Some SW attacks have used exploits to automatically install malware code silently on an infected PC without the user knowing

- Monitoring new developments will help. Certainly watching the forums here, blogs, and other security sites will help keep you informed on all major attacks.

While there's nothing magic about SW, it is a well-done attack by probably the most advanced malware gang in the world. Staying cautious can save you from hours of hard work to get back to where you were before you clicked -- and unfortunately sometimes you might even loose something permanently as a result of not being careful.

Regards, Harry

#4 User is offline   harrywaldron 

  • Security Reporter
  • PipPipPipPip
  • Find Topics
  • Group: Members
  • Posts: 509
  • Joined: 10-April 04
  • Gender:Male
  • Location:Roanoke, Virginia

  Posted 30 October 2007 - 03:46 PM

Also wanted to follow-up on QM's original post above ... McAfee (AVERT Labs) has actually discovered a way to bypass the DDoS attacks and some of the other aspects preventing research. If only we could get the bad guys :thumbsup:

http://www.avertlabs.com/research/blog/ind...ar-not-so-much/

Share this topic:


Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users