Storm worm: all teeth, no shell?

[bascule]

Researchers disassembling the client of the Storm worm discovered that the peer-to-peer protocol it uses for controlling zombies is in no way authenticated. Anyone can set up a control server and route zombies to it.

The researchers considered setting up a control server which would instruct the zombies to remove the Storm worm from themselves, but were too worried about the legal/ethical implications.

[frank^2]

Re: Storm worm: all teeth, no shell?

Interesting. I remember a talk at Toorcon in '07 by a researcher from UCSD discussing how he was making attempts to traverse the vast Stormworm network, only to have the entire network DDoS the school's connection. Looks like he was wrong in saying that the attack was automated.