Storm Gets Polluted

The Storm botnet became legend thanks, in part, to its impenetrable, unknowable command and control structure. But researchers have discovered the botnet's Achilles' heel.

Researchers Infiltrate and 'Pollute' Storm Botnet - Dark Reading

Quote:

---

The researchers, from the University of Mannheim and the Institut Eurecom, recently infiltrated Storm to test out a method they came up with of analyzing and disrupting P2P botnets. Their technique is a spinoff of traditional botnet tracking, but with a twist: it not only entails capturing bot binaries and infiltrating the P2P network, but it also exploits weaknesses in the botnet’s P2P protocol to inject “polluted” content into the botnet to disrupt communication among the bots, as well as to study them more closely. The researchers tested their pollution method out on Storm -- and it worked. They presented their research this month at Usenix.

---

To continue the Storm buzz... :)

is it just my imagination or is it stupid to publicize, in detail, the means by which these bots are being thwarted? Why not just call up the developers and say hey we found a flaw in your bot, this is how it works so you can fix it.

Quote:

---

Originally Posted by JPnyc

is it just my imagination or is it stupid to publicize, in detail, the means by which these bots are being thwarted? Why not just call up the developers and say hey we found a flaw in your bot, this is how it works so you can fix it.

---

uh, what?

dead,
~sarcasm on jpync's part there

If anything, it displays the cunning, patience and methodical nature of some hackers. Plus, we've been hearing how Storm and botnets like it are untouchable. Not so much anymore... :)

Yeah but just wait until the Russian programmers hear about this. I have a feeling they'll be updating all of their bots with a new strain to counteract this.

Of course they will, that's my point. I don't know that I'd be so quick to publicize this so widely, and so thoroughly. I know there is a need to inform but the other side of the coin is, it helps the battle to be a never-ending one.

I know two things and those are the battle will never end, and obscurity is never a good form of security.

Usenix article: http://www.usenix.org/event/leet08/t...olz/holz_html/

My hat goes off to everyone involved in this...

-sp0nge

I know the battle will never end, but does that mean they have to make it so much easier for the opponent to respond?

I just feel that not only have they alerted Storm's operator, but they have helped shine the way for anyone who has the technical ability who wishes to experiment with this as well.

The technology involved with botnets has infinite potential and personally I look forward to being able to learn more about such things in the future. I wish I had the ability to do something similar :(

It is such a shame that the party involved with the creation of such a network had such poor motives. This would all make such a good lecture at the Black Hat conference, and if this was able to function as sort of a distributed computing network...

-sp0nge