How Big is the Storm Botnet?

Home / Blogs

How Big is the Storm Botnet?

	By John Levine Author, Consultant & Speaker
	October 24, 2007 Views: 14,911 Add Comment

The Storm worm has gotten a lot of press this year, with a lot of the coverage tending toward the apocalyptic. There’s no question that it’s one of the most successful pieces of malware to date, but just how successful is it?

Last weekend, Brandon Enright of UC San Diego gave a informal talk at the Toorcon conference in which he reported on his analysis of the Storm botnet. According to his quite informative slides, Storm has evolved quite a lot over the past year, with both upgrades to the underlying engine and a variety of applications, most of which involve sending spam. (If you’ve gotten pump and dump spam with the message in an MP3 audio file, that’s Storm’s latest campaign.)

Enright says that although Storm’s peer-to-peer control structure makes it harder to map than centrally controlled botnets, its P2P design is relatively simple, and is similar enough to the eDonkey network that he could adapt tools designed for eDonkey to map Storm. While it’s never possible to find the exact size of a P2P network since nodes are constantly going on and off line, his statistics suggest that Storm consists of hundreds of thousands of nodes, not millions. While that’s a lot, it’s in the same range as other botnets. What really sets Storm apart is its operators’ skillful social engineering that constantly comes up with new tricks to get people to click on links that infect their Windows PCs.

The slides are somewhat technical but easy enough to follow, and are worth a look.

By John Levine, Author, Consultant & Speaker

Filed Under

Comments

The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

VINTON CERF
Co-designer of the TCP/IP Protocols & the Architecture of the Internet