The infamous and rather destructive Storm Worm botnet has been blown open. A team of researchers from Bonn and RWTH Aachen Universities has proven that it is not as invincible as once thought. Georg Wicherski, Tillmann Werner, Felix Leder and Mark Schlösser have developed software which they have partially disclosed claiming that they can rapidly eliminate the Storm Worm botnet. The Storm Worm has been causing havoc for over two years now, transforming more than a billion computers into drones. Following a surprisingly unsuccessful mission by Microsoft’s Malicious Software Removal Tool around 100,000 drones still remain. So how did these researchers do it? They began by reverse translating large parts of the machine code from the drone client program, analysing it and looking closely at the functions for communications between the drone and the server. Once this background knowledge had been gained, they were able to develop their own client which in turn linked itself back into the peer-to-peer structure of the Storm Worm network. As soon as this was accomplished, existing drones looking for new command servers could be routed to it and thereby diverted to a new server. Next was to analyse the protocol for passing commands and direct the drones to a simple server. This provided a platform to write a program to eliminate the Storm Worm network completely. However, there is a problem with this discovery. The team has not yet tested this on a real Storm Worm botnet because it might face legal issues in doing so. When accessing third-party computers they could fall afoul of the law by tampering with data. Although legal issues would only come up if someone complained, which no one likely would, they are still unable at present to go ahead with eliminating the botnet.
( www.theinquirer.net )
Post a Comment