Fri, Oct 26, 2007 page7

• Windows PCs threatened by `Storm Worm'

  STORM BREWING The backdoor Trojan horse could have already infected millions of computers worldwide to form a massive `botnet'

  • THE OBSERVER
  • • 
    • 
    • 

  A specter is haunting the Internet but, outside of techie circles, nobody seems to be talking about it. The threat it represents to our security and wellbeing may be less dramatic than anything posed by global terrorism, but it has the potential to wreak much more havoc. And so far, nobody has come up with a good idea on how to counter it.

  It's called the Storm Worm. It first appeared at the beginning of the year, hidden in e-mail attachments with the subject line: "230 dead as storm batters Europe." The PC of anyone who opened the attachment became infected and was secretly enrolled in an ever-growing network of compromised machines called a "botnet."

  The term "bot" is a derivation of "software robot," which is another way of saying that an infected machine effectively becomes the obedient slave of its (illicit) owner.

  If your PC is compromised in this way then, while you may own the machine, someone else controls it. And they can use it to send spam, to participate in distributed denial-of-service attacks on banks, e-commerce or government Web sites, or for other even more sinister purposes.

  Storm has been spreading steadily since January, gradually constructing a huge botnet. It affects only computers running Microsoft Windows, but that means that more than 90 percent of the world's PCs are vulnerable. Nobody knows how big the Storm botnet has become, but reputable security professionals cite estimates of between 1 million and 50 million computers worldwide.

  To date, the botnet has been used only intermittently, which is disquieting: What it means is that someone, somewhere, is quietly building a doomsday machine that can be rented out to the highest bidder, or used for purposes that we cannot yet predict.

  Of course, computer worms are an old story, which may explain why the mainstream media has paid relatively little attention to what's been happening. Old-style worms -- the ones with names like Sasser and Slammer -- were written by vandals or hackers and designed to spread as quickly as possible. Slammer, for example, infected 75,000 computers in 10 minutes and therefore attracted a lot of attention. The vigor of the onslaught made it easier for anti-virus firms to detect the attack and come up with countermeasures. In that sense, old-style worms were like measles -- an infectious disease that shows immediate symptoms.

  Storm is different. It spreads quietly, without drawing attention to itself. Symptoms don't appear immediately and an infected computer can lie dormant for a long time.

  "If it were a disease, it would be more like syphilis, whose symptoms may be mild or disappear altogether, but which will come back years later and eat your brain," said one expert, Bruce Schneier.

  Schneier said Storm represents "the future of malware" because of the technical virtuosity of its design. For example, it works rather like an ant colony, with separation of duties. Only a small fraction of infected hosts spread the worm. A much smaller fraction are command-and-control servers; the rest stand by to receive orders.

  By only allowing a small number of hosts to propagate the virus and act as command-and-control servers, Storm is resilient against attack because even if those hosts shut down, the network remains largely intact.
• Most Popular

  • 1

    LA Dodgers beat Braves to secure 7th straight win

  • 2

    Notes from Central Taiwan: Taiwan’s health system is going to erode, not collapse

  • 3

    PSG make final as Arsenal fall short

  • 4

    Taiwan celebrates V-E Day for first time

  • 5

    Taiwan lauds US House bills of support