Posted by Virus Bulletin on Oct 17, 2007
Latest change in tactics could mean zombie clusters for hire.
The latest twist in the long-running 'Storm' saga, the use of encryption in communications between infected hosts and command-and-control systems, has led to widespread speculation that the ever-growing botnet being built up by the criminals behind the attack is being split into segments in preparation for renting out as a spam or DDoS tool.
A blog entry by a researcher at SecureWorks, describing the use of encrypted traffic in the Overnet/eDonkey P2P protocol used by the latest waves of trojans, suggests that the segmented network would be a formidable weapon for hire, with a full range of functionality and self-defence mechanisms.
While there have been some suggestions that the latest changes make the Storm traffic easier to distinguish from legitimate data - largely unnecessary as the official eDonkey system was shut down last year after copyright violation issues - the possibility of a major, well-designed botnet with potentially hundreds of thousands of infected hosts could pose a threat to sites vulnerable to DDoS and has the potential to produce vast amounts of spam.