View source for Storm botnet

{{Short description|Computer botnet}}
{{distinguish|text=the unrelated [[Eggdrop]] bot script "stormbot.tcl."}}
{{For|more details on the worm|Storm Worm}}
{{Update|inaccurate=yes|date=November 2010}}

{{Infobox computer virus
| fullname         = 
| image            = Image:Circle of spam.svg|300px|right|thumb|The typical lifecycle of spam that originates from a botnet
| caption          = The typical lifecycle of spam that originates from a botnet:<br />(1)&nbsp;Spammer's web site (2)&nbsp;Spammer (3)&nbsp;Spamware (4)&nbsp;Infected computers (5)&nbsp;Virus or trojan (6)&nbsp;Mail servers (7)&nbsp;Users (8)&nbsp;Web traffic
| common_name      = Storm Botnet
| technical_name   = 
* '''As Dorf'''
** Mal/Dorf-[Letter] ([[Sophos]])
** Trojan.Win32.Dorf.[Letter] (v) ([[VIPRE|Sunbelt Software]])
* '''As Ecard'''
** Trojan:Win32/ECardViewer ([[Microsoft]])
| aliases          = Dorf, Ecard
| family           = 
| classification   = 
| type             = 
| subtype          = 
| isolation_date   = 
| origin           = [[Russia]]
| infection_vector =
| author           = [[Russian Business Network]] (speculated)
| ports_used       =
| OS               = [[Windows 95]], [[Windows 98]], [[Windows ME]], [[Windows XP]]
| filesize         =
| language         =
}}

The '''Storm botnet''' or '''Storm Worm botnet''' (also known as '''Dorf botnet''' and '''Ecard malware'''<ref name="EW_20071024">{{cite web | url=http://www.eweek.com/c/a/Security/Storm-Worm-Botnet-Lobotomizing-AntiVirus-Programs | title=Storm Worm Botnet Lobotomizing Anti-Virus Programs | publisher=eWeek | date=2007-10-24 | access-date=4 July 2015 | author=Lisa Vaas}}</ref>) was a remotely controlled network of [[Zombie computer|"zombie" computers]] (or "[[botnet]]") that had been linked by the [[Storm Worm]], a [[Trojan horse (computing)|Trojan horse]] spread through [[e-mail spam]]. At its height in September 2007, the Storm botnet was running on anywhere from 1 million to 50 million computer systems,<ref name=NEO_090707>{{cite news | last = Spiess | first = Kevin | title = Worm 'Storm' gathers strength | publisher = Neoseeker | date = September 7, 2007 | url = http://www.neoseeker.com/news/story/7103/ | access-date = 2007-10-10}}</ref><ref name=NW_020807>{{cite news | title = Storm Worm's virulence may change tactics | publisher = British Computer Society | date = August 2, 2007 | url = http://www.networkworld.com/news/2007/080207-black-hat-storm-worms-virulence.html | access-date = 2007-10-10 | url-status = dead | archive-url = https://web.archive.org/web/20071012115210/http://www.networkworld.com/news/2007/080207-black-hat-storm-worms-virulence.html | archive-date = October 12, 2007 }}</ref> and accounted for 8% of all [[malware]] on [[Microsoft Windows]] computers.<ref name=IEET_092407>{{cite news | last = Dvorsky | first = George | title = Storm Botnet storms the Net | publisher = Institute for Ethics and Emerging Technologies | date = September 24, 2007 | url = http://ieet.org/index.php/IEET/more/dvorsky20070927/ | access-date = 2007-10-10}}</ref> It was first identified around January 2007, having been distributed by [[email]] with subjects such as "230 dead as storm batters [[Europe]]," giving it its well-known name. The botnet began to decline in late 2007, and by mid-2008 had been reduced to infecting about 85,000 computers, far less than it had infected a year earlier.<ref name=CW_040909>{{cite news|last=Keizer|first=Gregg|title=Top botnets control 1M hijacked computers|url=http://www.computerworld.com/s/article/9076278/Top_botnets_control_1M_hijacked_computers|access-date=24 December 2012|newspaper=Computer World|date=9 April 2008}}</ref>

As of December 2012, the original creators of Storm have not been found. The Storm botnet has displayed defensive behaviors that indicated that its controllers were actively protecting the botnet against attempts at tracking and disabling it, by specifically attacking the online operations of some security vendors and researchers who had attempted to investigate it.<ref>{{cite news | last = Leyden | first = John | title = Storm Worm retaliates against security researchers | publisher = The Register | date = September 25, 2007 | url = https://www.theregister.co.uk/2007/10/25/storm_worm_backlash/ | access-date = 2007-10-25}}</ref> Security expert Joe Stewart revealed that in late 2007, the operators of the botnet began to further decentralize their operations, in possible plans to sell portions of the Storm botnet to other operators. It was reportedly powerful enough to force entire countries off the [[Internet]], and was estimated to be capable of executing more [[instructions per second]] than some of the world's top [[supercomputer]]s.<ref name=InfoWeek_091807>{{cite news | last = Gaudin | first = Sharon | title = Storm Worm Botnet Attacks Anti-Spam Firms | publisher = [[InformationWeek]] | date = September 18, 2007 | url = http://www.informationweek.com/news/showArticle.jhtml?articleID=201807222 | access-date = 2007-10-10}}</ref> The [[United States]] [[Federal Bureau of Investigation]] considered the botnet a major risk to increased [[bank fraud]], [[identity theft]], and other [[cybercrime]]s.<ref name="SS_SB_102207">{{cite news | first=Dennis | last=Fisher | title=Experts predict Storm Trojan's reign to continue | date=2007-10-22 | publisher=Search Security | url=http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1278241,00.html | access-date=2007-12-26 | archive-date=2007-12-17 | archive-url=https://web.archive.org/web/20071217215344/http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1278241,00.html | url-status=dead }}</ref><ref name="IBA_SB_121807">{{cite news | first=Rick | last=Coca | title=FBI: 'Botnets' threaten online security | date=2007-12-18 | publisher=Inside Bay Area | url =http://www.insidebayarea.com/dailyreview/localnews/ci_7750067 | access-date = 2007-12-27 }}</ref>

== Origins ==
First detected on the Internet in January 2007, the Storm botnet and worm are so-called because of the [[storm]]-related subject lines its infectious [[e-mail]] employed initially, such as "230 dead as storm batters Europe." Later provocative subjects included "Chinese missile shot down USA aircraft," and "U.S. Secretary of State [[Condoleezza Rice]] has kicked German Chancellor [[Angela Merkel]]."<ref name=NEO_090707/><ref name=Infoworld_070807>{{cite news | last=Brodkin | first=Jon | title=Financially motivated malware thrives | date=September 7, 2007 | url=http://www.infoworld.com/article/07/09/07/Financially-motivated-malware-thrives_1.html | access-date=2007-10-10}}</ref><ref name="Yahoo!_SB_102207">{{cite news | first=Christopher | last=Null | title=Devastating "Storm" Computer Worm Waiting in the Wings | date=2007-10-22 | publisher=Yahoo! News | url=https://tech.yahoo.com/blogs/null/54983/devastating-storm-computer-worm-waiting-in-the-wings | access-date=2007-12-26 }}</ref> It is suspected by some [[information security]] professionals that well-known fugitive [[spamming|spammers]], including [[Leo Kuvayev]], may have been involved in the operation and control of the Storm botnet.<ref name=InfoWeek_091707>{{cite news | last=Utter | first=David | title=Storm Botnet Driving PDF Spam | date=July 13, 2007 | url=http://www.securitypronews.com/news/securitynews/spn-45-20070713StormBotnetDrivingPDFSpam.html | access-date=2007-10-10 | archive-date=2007-09-23 | archive-url=https://web.archive.org/web/20070923002343/http://www.securitypronews.com/news/securitynews/spn-45-20070713StormBotnetDrivingPDFSpam.html | url-status=dead }}</ref> According to technology journalist [[Daniel Tynan]], writing under his "[[Robert X. Cringely]]" pseudonym, a great portion of the fault for the existence of the Storm botnet lay with [[Microsoft]] and [[Adobe Systems]].<ref name=Cringely_101707>{{cite news | last=Cringely | first=Robert X. | title=The Gathering Storm | publisher=InfoWorld | date=October 17, 2007 | url=http://www.infoworld.com/d/windows/gathering-storm-393}}</ref> Other sources state that Storm Worm's primary method of victim acquisition was through enticing users via frequently changing social engineering ([[confidence trick]]ery) schemes.<ref name=Holz_041308>{{cite news | last=Holz | first=Thorsten | title=Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm | publisher=Usenix | date=April 9, 2008 | url=http://www.usenix.org/event/leet08/tech/full_papers/holz/holz_html/ | access-date = 2008-04-23}}</ref> According to Patrick Runald, the Storm botnet had a strong American focus, and likely had agents working to support it within the United States.<ref name="WiredSB_120707">{{cite news | first=Ryan | last=Singel | title=Report: Cybercrime Stormed the Net in 2007 | date=2007-12-07 | publisher=Wired News | url=https://www.wired.com/politics/security/news/2007/12/2007_security | access-date=2007-12-27 }}</ref> Some experts, however, believe the Storm botnet controllers were [[Russia]]n, some pointing specifically at the [[Russian Business Network]], citing that the Storm software mentions a hatred of the [[Moscow]]-based security firm [[Kaspersky Lab]], and includes the Russian word ''"buldozhka,"'' which means "[[bulldog]]."<ref name="PCW_SB_120307">{{cite news | first=Erik | last=Larkin | title=The Internet's Public Enemy Number One | date=2007-12-03 | publisher=PC World | url=http://www.pcworld.com/article/138694/the_internets_public_enemy_number_one.html | access-date=2010-03-21 |archiveurl=https://web.archive.org/web/20090316190244/https://www.pcworld.com/article/138694/the_internets_public_enemy_number_one.html|archivedate=2009-03-16}}</ref>

== Composition ==
The botnet, or zombie network, comprises computers running [[Microsoft Windows]] as their [[operating system]].<ref name=InfoWeek_090607>{{cite news | last = Gaudin | first = Sharon | title = Storm Worm Botnet More Powerful Than Top Supercomputers | date = September 6, 2007 | url = http://www.informationweek.com/news/showArticle.jhtml?articleID=201804528 | access-date = 2007-10-10}}</ref> Once infected, a computer becomes known as a [[Malbot|bot]]. This bot then performs automated tasks—anything from gathering data on the user, to attacking web sites, to forwarding infected e-mail—without its owner's knowledge or permission. Estimates indicate that 5,000 to 6,000 computers are dedicated to propagating the spread of the worm through the use of e-mails with infected attachments; 1.2 billion virus messages have been sent by the botnet through September 2007, including a record 57 million on August 22, 2007 alone.<ref name=InfoWeek_090607 /> Lawrence Baldwin, a [[computer forensics]] specialist, was quoted as saying, "Cumulatively, Storm is sending billions of messages a day. It could be double digits in the billions, easily."<ref name=NEO_090707/> One of the methods used to entice victims to infection-hosting web sites are offers of free music, from artists such as [[Beyoncé Knowles]], [[Kelly Clarkson]], [[Rihanna]], [[The Eagles]], [[Foo Fighters]], [[R. Kelly]], and [[Velvet Revolver]].<ref name=InfoWeek_090407>{{cite news | last = Gaudin | first = Sharon | title = After Short Break, Storm Worm Fires Back Up With New Tricks | publisher = [[InformationWeek]] | date = September 4, 2007 | url = http://www.informationweek.com/security/showArticle.jhtml?articleID=201803920 | access-date = 2007-10-10}}</ref>  Signature-based detection, the main defense of most computer systems against virus and malware infections, is hampered by the large number of Storm variants.<ref name="SS_SB_121907">{{cite news | first=Dennis | last=Fisher | title=Storm, Nugache lead dangerous new botnet barrage | date=2007-12-17 | publisher=Search Security | url=http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1286808,00.html | access-date=2007-12-27 | archive-date=2007-12-24 | archive-url=https://web.archive.org/web/20071224200159/http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1286808,00.html | url-status=dead }}</ref>

Back-end servers that control the spread of the botnet and Storm worm automatically re-encode their distributed infection software twice an hour, for new transmissions, making it difficult for anti-virus vendors to stop the virus and infection spread. Additionally, the location of the remote servers which control the botnet are hidden behind a constantly changing [[Domain name system|DNS]] technique called '[[fast flux]]', making it difficult to find and stop virus hosting sites and mail servers. In short, the name and location of such machines are frequently changed and rotated, often on a minute by minute basis.<ref name=ChanRegister_091407>{{cite news | last = Leyden | first = John | title = Storm Worm linked to spam surge | publisher = The Register | date = September 14, 2007 | url = http://www.channelregister.co.uk/2007/09/14/storm_worm_analysis/ | access-date = 2007-10-17}}</ref> The Storm botnet's operators control the system via [[peer-to-peer]] techniques, making external monitoring and disabling of the system more difficult.<ref name=Wired_100407>{{cite news | last = Schneier | first = Bruce | title = Gathering 'Storm' Superworm Poses Grave Threat to PC Nets | publisher = [[Wired News]] | date = October 4, 2007 | url = https://www.wired.com/politics/security/commentary/securitymatters/2007/10/securitymatters_1004 | access-date = 2007-10-17}}</ref><ref name=InfoWeek_100307>{{cite news | last = Gaudin | first = Sharon | title = Hackers Breaking Up Botnets To Elude Detection | publisher = [[InformationWeek]] | date = October 3, 2007 | url = http://www.informationweek.com/news/showArticle.jhtml?articleID=202200755 | access-date = 2007-10-17}}</ref> There is no central "[[Command and control (military)|command-and-control]] point" in the Storm botnet that can be shut down.<ref name=Star_101507>{{cite news | last = Sorensen | first = Chris | title = Storm Worm the 'syphilis' of computers | work = The Star | date = October 15, 2007 | url = https://www.thestar.com/Business/article/266834 | access-date = 2007-10-17}}</ref> The botnet also makes use of [[Encryption|encrypted]] traffic.<ref name=SecurityProNews_101607>{{cite news | last = Utter | first = David | title = Storm Botnets Using Encrypted Traffic | publisher = Security Pro News | date = October 16, 2007 | url = http://www.securitypronews.com/insiderreports/insider/spn-49-20071016StormBotnetsUsingEncryptedTraffic.html | access-date = 2007-10-17 | archive-date = 2007-12-10 | archive-url = https://web.archive.org/web/20071210194554/http://www.securitypronews.com/insiderreports/insider/spn-49-20071016StormBotnetsUsingEncryptedTraffic.html | url-status = dead }}</ref> Efforts to infect computers usually revolve around convincing people to download [[e-mail attachment]]s which contain the virus through [[Social engineering (security)|subtle manipulation]]. In one instance, the botnet's controllers took advantage of the [[National Football League]]'s opening weekend, sending out mail offering "football tracking programs" which did nothing more than infect a user's computer.<ref name=Virusbulletin_091007>{{cite news | title = Storm DDoS hits anti-scam sites | publisher = Virus Bulletin.com | date = September 10, 2007 | url = http://www.virusbtn.com/news/2007/09_10.xml | access-date = 2007-10-17}}</ref><ref name=InfoWeek_091007>{{cite news | last = Gaudin | first = Sharon | title = NFL Kickoff Weekend Brings Another Storm Worm Attack | publisher = [[InformationWeek]] | date = September 10, 2007 | url = http://www.informationweek.com/news/showArticle.jhtml?articleID=201805274 | access-date = 2007-10-17}}</ref> According to Matt Sergeant, chief anti-[[Spam (electronic)|spam]] [[Technology|technologist]] at MessageLabs, "In terms of power, [the botnet] utterly blows the supercomputers away. If you add up all 500 of the top supercomputers, it blows them all away with just 2 million of its machines. It's very frightening that criminals have access to that much computing power, but there's not much we can do about it."<ref name=InfoWeek_090607 /> It is estimated that only {{nowrap|10{{hsp}}–20%}} of the total capacity and power of the Storm botnet is currently being used.<ref name=EITPlanet_090407>{{cite news | last = Hernandez | first = Pedro | title = Storm Worm Rewrote the Botnet and Spam Game | publisher = Enterprise IT Planet | date = October 4, 2007 | url = http://www.enterpriseitplanet.com/security/features/article.php/3703431 | access-date = 2007-10-17}}</ref>

Computer security expert Joe Stewart detailed the process by which compromised machines join the botnet: attempts to join the botnet are made by launching a series of [[EXE]] files on the compromised machine, in stages. Usually, they are named in a sequence from ''game0.exe'' through ''game5.exe'', or similar. It will then continue launching executables in turn. They typically perform the following:<ref>{{cite web|last1=Stewart|first1=Joe|title=Storm Worm DDoS Attack|url=https://www.secureworks.com/research/storm-worm|website=Secureworks.com|publisher=SecureWorks|access-date=9 March 2016}}</ref>

# <code>game0.exe</code> {{En dash}} [[Backdoor (computing)|Backdoor]]/downloader
# <code>game1.exe</code> {{En dash}} SMTP relay
# <code>game2.exe</code> {{En dash}} E-mail address stealer
# <code>game3.exe</code> {{En dash}} E-mail virus spreader
# <code>game4.exe</code> {{En dash}} [[DDoS#Distributed attack|Distributed Denial of Service]] (DDoS) attack tool
# <code>game5.exe</code> {{En dash}} Updated copy of Storm Worm dropper

At each stage the compromised system will connect into the botnet; [[fast flux]] DNS makes tracking this process exceptionally difficult.

This code is run from ''%windir%\system32\wincom32.sys'' on a Windows system, via a [[Kernel (computer science)|kernel]] [[rootkit]], and all connections back to the botnet are sent through a modified version of the [[eDonkey network|eDonkey]]/[[Overnet]] communications protocol.

== Method ==
The Storm botnet and its variants employ a variety of attack vectors, and a variety of defensive steps exist as well. The Storm botnet was observed to be defending itself, and attacking computer systems that scanned for Storm virus-infected computer systems online.<ref name=InformationWeek_201800635>{{cite news | last = McCloskey | first = Paul | title = Storm Warning: Botnet Gearing Up To Attack Defenders | publisher = [[InformationWeek]] | date = September 14, 2007 | url = http://www.informationweek.com/news/showArticle.jhtml?articleID=201800635 | access-date = 2007-10-17}}</ref> The botnet will defend itself with DDoS counter-attacks, to maintain its own internal integrity.<ref name=autogenerated1>{{cite news | last = Gaudin | first = Sharon | title = Storm botnet puts up defenses and starts attacking back | publisher = [[InformationWeek]] | date = September 17, 2007 | url = https://www.informationweek.com/it-sectors/storm-botnet-puts-up-defenses-and-starts-attacking-back | access-date = 2024-11-06}}</ref> At certain points in time, the Storm worm used to spread the botnet has attempted to release hundreds or thousands of versions of itself onto the Internet, in a concentrated attempt to overwhelm the defenses of anti-virus and malware security firms.<ref name="SF_SB_122607">{{cite news | title=Storm Worm offers coal for Christmas | date=2007-12-26 | publisher=Security Focus | url =http://www.securityfocus.com/brief/649 | access-date = 2007-12-27 }}</ref> According to Joshua Corman, an [[IBM]] security researcher, "This is the first time that I can remember ever seeing researchers who were actually afraid of investigating an exploit."<ref name="DR_SB_102907">{{cite news | first=Tim  | last= Wilson| title=Researchers Fear Reprisals From Storm | date=2007-10-29 | publisher=Dark Reading | url =https://www.darkreading.com/cybersecurity-analytics/researchers-fear-reprisals-from-storm | access-date = 2024-11-06 }}</ref> Researchers are still unsure if the botnet's defenses and counterattacks are a form of automation, or manually executed by the system's operators.<ref name="DR_SB_102907" /> "If you try to attach a debugger, or query sites it's reporting into, it knows and punishes you instantaneously. [Over at] [[SecureWorks]], a chunk of it DDoS-ed [distributed-denial-of-service attacked] a researcher off the network. Every time I hear of an investigator trying to investigate, they're automatically punished. It knows it's being investigated, and it punishes them. It fights back", Corman said.<ref name="EW_20071024" />

Spameater.com as well as other sites such as [[419eater.com]] and [[Artists Against 419]], both of which deal with [[advance fee fraud|419 spam e-mail fraud]], have experienced [[Ddos#Distributed attack|DDoS]] attacks, temporarily rendering them completely inoperable. The DDoS attacks consist of making massed parallel network calls to those and other target IP addresses, overloading the servers' capacities and preventing them from responding to requests.<ref name=arstechnica_091207>{{cite news | last = Paul | first = Ryan | title = Spammers launch denial of service attacks against antispam sites | publisher = Ars Technica News | date = September 12, 2007 | url = https://arstechnica.com/news.ars/post/20070912-spammers-launch-denial-of-service-attacks-against-antispam-sites.html | access-date = 2007-10-17}}</ref> Other anti-spam and anti-fraud groups, such as the [[Spamhaus Project]], were also attacked. The webmaster of Artists Against 419 said that the website's server succumbed after the attack increased to over 100[[Megabit|Mbit]].  Similar attacks were perpetrated against over a dozen anti-fraud site hosts. Jeff Chan, a spam researcher, stated, "In terms of mitigating Storm, it's challenging at best and impossible at worst since the bad guys control many hundreds of megabits of traffic. There's some evidence that they may control hundreds of Gigabits of traffic, which is enough to force some countries off the Internet."<ref name=InfoWeek_091807/>

The Storm botnet's systems also take steps to defend itself locally, on victims' computer systems. The botnet, on some compromised systems, creates a computer process on the Windows machine that notifies the Storm systems whenever a new program or other processes begin. Previously, the Storm worms locally would tell the other programs—such as anti-virus, or anti-malware software, to simply not run. However, according to IBM security research, versions of Storm also now simply "fool" the local computer system into thinking it has run the hostile program successfully, but in fact, they are not doing anything. "Programs, including not just AV [[EXE|exes]], [[Dynamic-link library|dlls]] and [[.sys|sys]] files, but also software such as the [[Peer-to-peer|P2P]] applications [[BearShare]] and [[eDonkey2000|eDonkey]], will appear to run successfully, even though they didn't actually do anything, which is far less suspicious than a process that gets terminated suddenly from the outside", said Richard Cohen of [[Sophos]]. Compromised users, and related security systems, will assume that security software is running successfully when it in fact is not.<ref>{{cite web | url=https://nakedsecurity.sophos.com/2007/10/22/process-patching-the-dorf-way/ | title=Process-patching, the Dorf way | publisher=Naked security | date=2007-10-22 | access-date=4 July 2015 | author=Sophos Labs}}</ref>

On September 17, 2007, a [[Republican Party (United States)|Republican Party]] website in the [[United States]] was compromised, and used to propagate the Storm worm and botnet.<ref name=Inquirer_091707>{{cite news|last=Farrell |first=Nick |title=Republicans infect voters with Storm Trojan |publisher="The Inquirer" |date=September 17, 2007 |url=http://www.theinquirer.net/?article=42375 |access-date=2007-10-17 |archive-url=https://web.archive.org/web/20160121162837/http://www.theinquirer.net/?article=42375 |archive-date=January 21, 2016 |url-status=unfit }}</ref><ref name=PCworld_091407>{{cite news | last = Keizer | first = Gregg | title = Hacked GOP Site Infects Visitors with Malware | publisher = Computerworld | date = September 14, 2007 | url = http://www.pcworld.com/article/id,137226-c,hackers/article.html | access-date = 2007-10-17 | archive-date = 2007-10-15 | archive-url = https://web.archive.org/web/20071015184805/http://www.pcworld.com/article/id%2C137226-c%2Chackers/article.html | url-status = dead }}</ref> In October 2007, the botnet took advantage of flaws in [[YouTube]]'s [[captcha]] application on its mail systems, to send targeted spam e-mails to [[Xbox (console)|Xbox]] owners with a scam involving winning a special version of the [[video game]] ''[[Halo 3]]''.<ref name=CNET_101007>{{cite news | last = Tung | first = Liam | title = 'Storm worm' exploits YouTube | publisher = [[CNET]] News | date = October 10, 2007 | url = http://www.news.com/Storm-worm-exploits-YouTube/2100-7349_3-6212674.html | access-date = 2007-10-17 | archive-date = 2020-08-22 | archive-url = https://web.archive.org/web/20200822003355/https://www.cnet.com/news/ | url-status = dead }}</ref> Other attack methods include using appealing animated images of laughing cats to get people to click on a trojan software download, and tricking users of [[Yahoo!]]'s [[GeoCities]] service to download software that was claimed to be needed to use GeoCities itself.<ref name=Computerworld_101201>{{cite news | last = Keizer | first = Gregg | title = Storm Trojan flaunts crazy cat to build out botnet | publisher = ComputerWorld | date = October 12, 2007 | url = http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9042384&intsrc=news_ts_head | access-date = 2007-10-17 | url-status = dead | archive-url = https://web.archive.org/web/20071013045214/http://computerworld.com/action/article.do?command=viewArticleBasic&articleId=9042384&intsrc=news_ts_head | archive-date = October 13, 2007 }}</ref><ref name="PCW_SB_111607">{{cite news | first=Gregg | last=Keizer | title=Storm Botnet Spreading Malware Through GeoCities | date=2007-11-16 | publisher=PC World | url=http://www.pcworld.com/printable/article/id,139736/printable.html | access-date=2007-12-27 | archive-date=2007-11-21 | archive-url=https://web.archive.org/web/20071121015146/http://www.pcworld.com/printable/article/id,139736/printable.html | url-status=dead }}</ref> The GeoCities attack in particular was called a "full-fledged attack vector" by Paul Ferguson of [[Trend Micro]], and implicated members of the [[Russian Business Network]], a well-known spam and malware service.<ref name="PCW_SB_111607" /> On Christmas Eve in 2007, the Storm botnet began sending out holiday-themed messages revolving around male interest in women, with such titles as "Find Some Christmas Tail", "The Twelve Girls of Christmas", and "Mrs. Claus Is Out Tonight!" and photos of attractive women. It was described as an attempt to draw more unprotected systems into the botnet and boost its size over the holidays, when security updates from protection vendors may take longer to be distributed.<ref name="PCW_SB_122407">{{cite news | first=Robert | last=McMillan | title=Storm Worm Tempts With Christmas Strip Show | date=2007-12-24 | publisher=PC World | url=http://www.pcworld.com/article/id,140806-c,trojanhorses/article.html | access-date=2007-12-27 | archive-date=2007-12-27 | archive-url=https://web.archive.org/web/20071227165943/http://www.pcworld.com/article/id%2C140806-c%2Ctrojanhorses/article.html | url-status=dead }}</ref><ref name="AT_SB_122507">{{cite news | first=Joel | last=Hruska | title=Storm Worm delivering coal this Christmas | date=2007-12-25 | publisher=Ars Technica | url =https://arstechnica.com/news.ars/post/20071225-storm-worm-delivering-coal-this-christmas.html | access-date = 2007-12-27 }}</ref> A day after the e-mails with Christmas [[stripper]]s were distributed, the Storm botnet operators immediately began sending new infected e-mails that claimed to wish their recipients a "Happy New Year 2008!"<ref name="PCW_SB_122607">{{cite news | first=Gregg | last=Keizer | title=Storm Botnet Drops Strippers Lure, Switches to New Year's | date=2007-12-26 | publisher=PC World | url =https://www.pcworld.com/article/140827/storm_botnet_drops_strippers_lure_switches_to_new_years.html | access-date = 2007-12-27 }}</ref>

In January 2008, the botnet was detected for the first time to be involved in [[phishing]] attacks against major financial institutions, targeting both [[Barclays]] and [[Halifax (United Kingdom bank)|Halifax]].<ref name = "SC_SB_010808"/>

== Encryption and sales ==
Around October 15, 2007, it was uncovered that portions of the Storm botnet and its variants could be for sale.<ref name=SecureworksStewart_101507>{{cite news | last = Stewart | first = Joe | title = The Changing Storm | publisher = Secure Works | date = October 15, 2007 | url = https://www.secureworks.com/blog/research-21011 | access-date = 2007-10-17}}</ref><ref name=tech.blorge_101607>{{cite news | last = Francia | first = Ruben | title = Researcher: Storm Worm botnet up for sale | publisher = Tech.Blorge | date = October 16, 2007 | url = http://tech.blorge.com/Structure:%20/2007/10/15/researcher-storm-worm-botnet-up-for-sale/ | access-date = 2007-10-17 | url-status = dead | archive-url = https://web.archive.org/web/20071016163749/http://tech.blorge.com/Structure%3A%20/2007/10/15/researcher-storm-worm-botnet-up-for-sale/ | archive-date = October 16, 2007 }}</ref> This is being done by using unique security keys in the encryption of the botnet's Internet traffic and information.<ref name=SecurityProNews_101607/> The unique keys will allow each segment, or sub-section of the Storm botnet, to communicate with a section that has a matching security key. However, this may also allow people to detect, track, and block Storm botnet traffic in the future, if the security keys have unique lengths and signatures.<ref name=SecureworksStewart_101507/> Computer security vendor Sophos has agreed with the assessment that the partitioning of the Storm botnet indicated likely resale of its services. [[Graham Cluley]] of Sophos said, "Storm's use of encrypted traffic is an interesting feature which has raised eyebrows in our lab. Its most likely use is for the cybercriminals to lease out portions of the network for misuse. It wouldn't be a surprise if the network was used for spamming, distributed denial-of-service attacks, and other malicious activities."<ref name="ComputerWorld_101607">{{cite news | last = Espiner | first = Tom | title = Security expert: Storm botnet 'services' could be sold | publisher = CNet news | date = 2007-10-16 | url = http://www.news.com/Security-expert-Storm-botnet-services-could-be-sold/2100-7349_3-6213781.html | access-date = 2007-10-17 | archive-date = 2008-05-17 | archive-url = https://web.archive.org/web/20080517153546/http://www.news.com/Security-expert-Storm-botnet-services-could-be-sold/2100-7349_3-6213781.html | url-status = dead }}</ref> Security experts reported that if Storm is broken up for the malware market, in the form of a "ready-to-use botnet-making spam kit", the world could see a sharp rise in the number of Storm related infections and compromised computer systems.<ref name=EWeek_101607>{{cite news | last = Vaas | first = Lisa | title = Storm Botnet Kits Loom on the Horizon | publisher = EWeek | date = October 16, 2007 | url = http://www.eweek.com/article2/0,1895,2199034,00.asp | access-date = 2007-10-17 | archive-date = 2020-08-22 | archive-url = https://web.archive.org/web/20200822003419/https://www.eweek.com/mobile/hp-touchpad-needs-6-to-8-weeks-for-additional-shipments | url-status = dead }}</ref> The encryption only seems to affect systems compromised by Storm from the second week of October 2007 onwards, meaning that any of the computer systems compromised after that time frame will remain difficult to track and block.<ref name=ChanRegister_101507>{{cite news | last = Goodin | first = Dan | title = The balkanization of Storm Worm botnets | publisher = The Register| date = October 15, 2007 | url = http://www.channelregister.co.uk/2007/10/15/storm_trojan_balkanization/ | access-date = 2007-10-17}}</ref>

Within days of the discovery of this segmenting of the Storm botnet, spam e-mail from the new subsection was uncovered by major security vendors. On the evening of October 17, security vendors began seeing new spam with embedded [[MP3]] sound files, which attempted to trick victims into investing in a [[penny stock]], as part of an illegal [[pump-and-dump]] stock scam. It was believed that this was the first-ever spam e-mail scam that made use of audio to fool victims.<ref name=Computerworld_101807>{{cite news | last = Keizer | first = Gregg | title = Spammers pump up volume with major spoken scam slam | publisher = Computerworld | date = October 18, 2007 | url = http://computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=cybercrime_and_hacking&articleId=9043242&taxonomyId=82&intsrc=kc_top | access-date = 2007-10-19 | url-status = dead | archive-url = https://web.archive.org/web/20070302144543/http://www.computerworld.com/action/article.do?command=viewArticleBasic | archive-date = March 2, 2007 }}</ref> Unlike nearly all other Storm-related e-mails, however, these new audio stock scam messages did not include any sort of virus or Storm malware payload; they were simply part of the stock scam.<ref name=Eweek_101807>{{cite news | last = Prince | first = Brian | title = MP3 Spam Scam Hits In-boxes | publisher = EWeek | date = October 18, 2007 | url = http://www.eweek.com/article2/0,1895,2202129,00.asp | access-date = 2007-10-19 | archive-date = 2020-08-22 | archive-url = https://web.archive.org/web/20200822003422/https://www.eweek.com/mobile/hp-touchpad-needs-6-to-8-weeks-for-additional-shipments | url-status = dead }}</ref>

In January 2008, the botnet was detected for the first time to be involved in [[phishing]] attacks against the customers of major financial institutions, targeting banking establishments in [[Europe]] including [[Barclays]], [[Halifax (United Kingdom bank)|Halifax]]<ref name="SC_SB_010808">{{cite news | first=Jack | last=Rogers | title=Fortinet: Storm Worm botnet used to mount phishing attacks on Barclays, Halifax banks | date=2008-01-08 | publisher=SC Magazine | url=http://www.scmagazineus.com/Fortinet-Storm-Worm-botnet-used-to-mount-phishing-attacks-on-Barclays-Halifax-banks/article/100506/ | access-date=2008-01-09 | url-status=dead | archive-url=https://web.archive.org/web/20080111040244/http://www.scmagazineus.com/Fortinet-Storm-Worm-botnet-used-to-mount-phishing-attacks-on-Barclays-Halifax-banks/article/100506/ | archive-date=2008-01-11 }}</ref> and the [[Royal Bank of Scotland]].<ref name=CNET_20080109 /> The unique security keys used indicated to [[F-Secure]] that segments of the botnet were being leased.<ref name=CNET_20080109>{{cite news | last = Vamosi | first = Robert | title = Phishers now leasing the Storm worm botnet | publisher = [[CNET]] News | date = January 9, 2008 | url = http://www.news.com/8301-10789_3-9847276-57.html | access-date = 2008-05-11 | archive-date = 2008-11-22 | archive-url = https://web.archive.org/web/20081122005234/http://www.news.com/8301-10789_3-9847276-57.html | url-status = dead }}</ref>

== Claimed decline of the botnet ==
On September 25, 2007, it was estimated that a Microsoft update to the [[Windows Malicious Software Removal Tool]] (MSRT) may have helped reduce the size of the botnet by up to 20%.<ref name=Register_092507>{{cite news | last = Beskerming | first = Sûnnet | title = Guessing at compromised host number | publisher = The Register | date = September 25, 2007 | url = https://www.theregister.co.uk/2007/09/25/microsoft_malicious_software_removal_tool/ | access-date = 2007-10-17}}</ref> The new patch, as claimed by Microsoft, removed Storm from approximately 274,372 infected systems out of 2.6 million scanned Windows systems.<ref name=ZDNet_092507>{{cite news | last = Naraine | first = Ryan | title = Storm Worm botnet numbers, via Microsoft | publisher = ZDNet | date = September 24, 2007 | url = http://blogs.zdnet.com/security/?p=533 | access-date = 2007-10-17 | archive-date = 2007-10-24 | archive-url = https://web.archive.org/web/20071024002252/http://blogs.zdnet.com/security/?p=533 | url-status = dead }}</ref> However, according to senior security staff at Microsoft, "the 180,000+ additional machines that have been cleaned by MSRT since the first day are likely to be home user machines that were not notably incorporated into the daily operation of the 'Storm' botnet," indicating that the MSRT cleaning may have been symbolic at best.<ref name=WashPost_090107>{{cite news | last = Krebs | first = Brian | title = Just How Bad Is the Storm Worm? | newspaper = The Washington Post | date = October 1, 2007 | url = http://blog.washingtonpost.com/securityfix/2007/10/the_storm_worm_maelstrom_or_te.html?nav=rss_blog | access-date = 2007-10-17}}</ref>

As of late October 2007, some reports indicated that the Storm botnet was losing the size of its Internet footprint, and was significantly reduced in size.<ref name="VNUnet_SB_102207">{{cite news | first=Matt | last=Chapman | title=Storm Worm may have blown itself out | date=2007-10-22 | publisher=VNUnet | url =http://www.vnunet.com/vnunet/news/2201721/storm-worm-blown-itself | access-date = 2007-12-26 |archive-url = https://web.archive.org/web/20071225153339/http://www.vnunet.com/vnunet/news/2201721/storm-worm-blown-itself |archive-date = December 25, 2007|url-status=dead}}</ref> Brandon Enright, a [[University of California, San Diego|University of California at San Diego]] security analyst, estimated that the botnet had by late October fallen to a size of approximately 160,000 compromised systems, from Enright's previous estimated high in July 2007 of 1,500,000 systems.<ref name="Blorge_SB_102107">{{cite news | first=Ruben | last=Francia | title=Storm Worm network shrinks to about one-tenth of its former size | date=2007-10-21 | publisher=Tech.Blorge | url=http://tech.blorge.com/Structure:%20/2007/10/21/2483/ | access-date=2007-12-26 | archive-url=https://web.archive.org/web/20130826032141/http://tech.blorge.com/Structure:%20/2007/10/21/2483/ | archive-date=2013-08-26 | url-status=dead }}</ref> Enright noted, however, that the botnet's composition was constantly changing, and that it was still actively defending itself against attacks and observation. "If you're a researcher and you hit the pages hosting the malware too much… there is an automated process that automatically launches a denial of service [attack] against you", he said, and added that his research caused a Storm botnet attack that knocked part of the UC San Diego network offline.<ref name="PCWorld_SB_102107">{{cite news | first=Robert | last=McMillan | title=Storm Worm Now Just a Squall | date=2007-10-21 | publisher=PC World | url=http://www.pcworld.com/article/id,138721-c,virusesworms/article.html | access-date=2007-12-26 | archive-date=2008-01-03 | archive-url=https://web.archive.org/web/20080103043441/http://www.pcworld.com/article/id%2C138721-c%2Cvirusesworms/article.html | url-status=dead }}</ref>

The computer security company [[McAfee]] is reported as saying that the Storm Worm would be the basis of future attacks.<ref name="CA_SB_120707">{{cite news | first=Andrea-Marie | last=Vassou | title=Cyber war to escalate in 2008 | date=2007-11-29 | publisher=Computer Active | url=http://www.computeractive.co.uk/computeractive/news/2204685/cyber-spying-biggest-threat | access-date=2007-12-27 | url-status=dead | archive-url=https://web.archive.org/web/20080102154534/http://www.computeractive.co.uk/computeractive/news/2204685/cyber-spying-biggest-threat | archive-date=2008-01-02 }}</ref> Craig Schmugar, a noted security expert who discovered the [[Mydoom worm]], called the Storm botnet a trend-setter, which has led to more usage of similar tactics by criminals.<ref name="NW_SB_121107">{{cite news | first=Ellen | last=Messmer | title=Attackers poised to exploit Olympics, presidential elections in 2008 | date=2007-12-11 | publisher=Network World | url=http://www.networkworld.com/news/2007/121107-crystal-ball-security-threats.html | access-date=2007-12-27 | url-status=dead | archive-url=https://web.archive.org/web/20071227090421/http://www.networkworld.com/news/2007/121107-crystal-ball-security-threats.html | archive-date=2007-12-27 }}</ref> One such derivative botnet has been dubbed the "Celebrity Spam Gang", due to their use of similar technical tools as the Storm botnet controllers. Unlike the sophisticated social engineering that the Storm operators use to entice victims, however, the Celebrity spammers make use of offers of nude images of celebrities such as [[Angelina Jolie]] and [[Britney Spears]].<ref name="SecureComputing_SB_120307">{{cite news| title=New botnet as powerful as Storm worm revealed| date=2007-11-29| publisher=Secure Computing| url=http://www.securecomputing.net.au/news/66021,new-botnet-as-powerful-as-storm-worm-revealed.aspx| access-date=2007-12-27}}{{Dead link|date=June 2018 |bot=InternetArchiveBot |fix-attempted=no }}</ref> [[Cisco Systems]] security experts stated in a report that they believe the Storm botnet would remain a critical threat in 2008, and said they estimated that its size remained in the "millions".<ref name="SCMag_SB_122607">{{cite news | first=Jack | last=Rogers | title=Cisco reports Storm botnet may be sublet to criminals in 2008 as holiday-themed attacks proliferate | date=2007-12-26 | publisher=SC Magazine | url=http://www.scmagazineus.com/Cisco-reports-Storm-botnet-may-be-sublet-to-criminals-in-2008-as-holiday-themed-attacks-proliferate/article/100154/ | access-date=2007-12-27 | url-status=dead | archive-url=https://web.archive.org/web/20071228230413/http://www.scmagazineus.com/Cisco-reports-Storm-botnet-may-be-sublet-to-criminals-in-2008-as-holiday-themed-attacks-proliferate/article/100154/ | archive-date=2007-12-28 }}</ref>

As of early 2008, the Storm botnet also found business competition in its black hat economy, in the form of Nugache, another similar botnet which was first identified in 2006. Reports have indicated a price war may be underway between the operators of both botnets, for the sale of their spam E-mail delivery.<ref name="TW_SB_010708">{{cite news | first=John E. | last=Dunn | title=Nugache – the next Storm? | date=2008-01-07 | publisher=Tech World | url=http://www.techworld.com/security/blogs/index.cfm?blogid=1&entryid=760 | access-date=2008-01-07 | url-status=dead | archive-url=https://web.archive.org/web/20080108140921/http://www.techworld.com/security/blogs/index.cfm?entryid=760&blogid=1 | archive-date=2008-01-08 }}</ref> Following the [[Christmas]] and [[New Year's Day|New Year's]] holidays bridging 2007–2008, the researchers of the [[Germany|German]] [[Honeypot (computing)|Honeynet]] Project reported that the Storm botnet may have increased in size by up to 20% over the holidays.<ref name="SPN_SB_010408">{{cite news | first=David | last=Utter | title=Storm Botnet Triples In Size | date=2008-01-04 | publisher=Security Pro News | url=http://www.securitypronews.com/insiderreports/insider/spn-49-20080104StormBotnetTriplesInSize.html | access-date=2008-01-07 | archive-date=2008-01-23 | archive-url=https://web.archive.org/web/20080123113043/http://www.securitypronews.com/insiderreports/insider/spn-49-20080104StormBotnetTriplesInSize.html | url-status=dead }}</ref> The ''MessageLabs Intelligence'' report dated March 2008 estimates that over 20% of all spam on the Internet originates from Storm.<ref>{{cite news | title=One fifth of all spam springs from Storm botnet | work=MessageLabs Intelligence: Q1 / March 2009 | url=http://www.messagelabs.co.uk/mlireport/MLI_Report_March_Q1_2008.pdf | publisher=MessageLabs | date=2008-04-01 | url-status=dead | archive-url=https://web.archive.org/web/20080517110046/http://www.messagelabs.co.uk/mlireport/MLI_Report_March_Q1_2008.pdf | archive-date=2008-05-17 }}</ref>

== Present state of the botnet ==
The Storm botnet was sending out spam for more than two years until its decline in late 2008.<ref name="A Breeze of Storm">{{cite web |url=https://www.honeynet.org/node/539 |title=A Breeze of Storm |author=Felix Leder |date=2010-04-28|work=Honeynet Project Blog |access-date=2010-05-24}}</ref> One factor in this—on account of making it less interesting for the creators to maintain the botnet—may have been the Stormfucker<ref>[http://seclists.org/fulldisclosure/2008/Dec/588 Full Disclosure: Stormfucker<!-- Bot generated title -->]</ref> tool, which made it possible to take control over parts of the botnet.<ref>{{cite video|people=Georg 'oxff' Wicherski, Tillmann Werner, Felix Leder, Mark Schlösser |date=2008 |title=Stormfucker: Owning the Storm Botnet |url=http://media.ccc.de/browse/congress/2008/25c3-3000-en-stormfucker_owning_the_storm_botnet.html |medium=Conference talk |publisher=Chaos Computer Club e.V. |access-date=2010-05-24 |url-status=dead |archive-url=https://web.archive.org/web/20091006100315/http://media.ccc.de/browse/congress/2008/25c3-3000-en-stormfucker_owning_the_storm_botnet.html |archive-date=October 6, 2009 }}  </ref>

== Stormbot 2 ==
On April 28, 2010, [[McAfee]] made an announcement that the so-called "rumors" of a Stormbot 2 were verified. Mark Schloesser, Tillmann Werner, and Felix Leder, the German researchers who did a lot of work in analyzing the original Storm, found that around two-thirds of the "new" functions are a copy and paste from the last Storm code base. The only thing missing is the [[Peer-to-peer|P2P]] infrastructure, perhaps because of the tool which used P2P to bring down the original Storm. Honeynet blog dubbed this Stormbot 2.<ref>{{cite news | first=Toralv | last= Dirro | title=Dark and Stormy–Comeback of a Botnet? | date=2010-04-28 | publisher=McAfee Research Blog | url =http://blogs.mcafee.com/mcafee-labs/dark-and-stormy-comeback-of-a-botnet | access-date = 2010-05-01 }}</ref>

== See also ==
* [[Alureon]]
* [[Bagle (computer worm)]]
* [[Botnet]]
* [[Conficker]]
* [[E-mail spam]]
* [[Gameover ZeuS]]
* [[Helpful worm]]
* [[Internet crime]]
* [[Internet security]]
* [[McColo]]
* [[Operation: Bot Roast]]
* [[Rustock botnet]]
* [[Regin (malware)]]
* [[Srizbi botnet]]
* [[Zombie (computer science)]]
* [[ZeroAccess botnet]]
* [[Zeus (malware)]]

== References ==
{{Reflist|2}}

== External links ==
* {{youtube|kH8cS1AkqiI|A video released by Secure Labs, showing the spread of the botnet}}
<!-- Sources to integrate into the article -->
* [http://blogs.guardian.co.uk/technology/2007/10/22/the_storm_worm_can_you_be_certain_your_machine_isnt_infected.html "The Storm worm: can you be certain your machine isn't infected?"] The target page is no longer on this website.
* [http://www.trustedsource.org/TS?do=threats&subdo=storm_tracker "TrustedSource Storm Tracker": Top Storm domains and latest web proxies] {{Webarchive|url=https://web.archive.org/web/20210302233341/http://www.trustedsource.org/TS?do=threats&subdo=storm_tracker |date=2021-03-02 }} The target page is no longer on this website.

{{Spoken Wikipedia|Storm_botnet.ogg|date=2008-05-19}}

{{Botnets}}
{{Hacking in the 2000s}}

{{DEFAULTSORT:Storm Botnet}}
[[Category:Internet security]]
[[Category:Distributed computing projects]]
[[Category:Spamming]]
[[Category:Botnets]]