The Storm Worm

[cy]

Although it's most commonly called a worm, Storm is really more: a worm, a Trojan horse and a bot all rolled into one. It's also the most successful example we have of a new breed of worm, and I've seen estimates that between 1 million and 50 million computers have been infected worldwide. ~

Worms like Storm are written by hackers looking for profit, and they're different. These worms spread more subtly, without making noise. Symptoms don't appear immediately, and an infected computer can sit dormant for a long time. If it were a disease, it would be more like syphilis, whose symptoms may be mild or disappear altogether, but which will eventually come back years later and eat your brain.

Storm represents the future of malware. Let's look at its behavior:

1. Storm is patient. A worm that attacks all the time is much easier to detect; a worm that attacks and then shuts off for a while hides much more easily.

2. Storm is designed like an ant colony,

http://www.schneier.com/crypto-gram-0710.html#1

 

[PhantomPhoton]

That's a decent run down. Thanks for the read.
So it appears storm is only targeting windows machines (for now)?

Makes me more motivated to zero my windows box and re install. I generally try to do it every year or less. It is so easy to catch junk; and things are getting harder and harder to detect.

 

[cy]

here's a detailed analysis of how worm works by Joe Stewart, a security researcher. His site was attacked in retaliation.

http://www.secureworks.com/research/threats/storm-worm/?threat=storm-worm

 

[tvodrd]

Update from The Register.

Larry