Fergie's Tech Blog

Segmenting the Storm Botnet

Joe Stewart writes on the SecureWorks Blog:

The latest Storm variants have a new twist. They now use a 40-byte key to encrypt their Overnet P2P traffic. This means that each node will only be able to communicate with nodes that use the same key.

This effectively allows the Storm author to segment the Storm botnet into smaller networks. This could be a precursor to selling Storm to other spammers, as an end-to-end spam botnet system, complete with fast-flux DNS and hosting capabilities.

If that’s the case, we might see a lot more of Storm in the future.

posted by Fergie @ 10/15/2007 11:14:00 AM