THE PERFECT STORM (NAGL)

The networkerIn millions of Windows, the perfect Storm is gatheringJohn NaughtonSunday October 21, 2007The ObserverA spectre is haunting the net but, outside of techie circles, nobody seems to be talking about it. The threat it represents to our security and wellbeing may be less dramatic than anything posed by global terrorism, but it has the potential to wreak much more havoc. And so far, nobody has come up with a good idea on how to counter it.It's called the Storm worm. It first appeared at the beginning of the year, hidden in email attachments with the subject line: '230 dead as storm batters Europe'. The PC of anyone who opened the attachment became infected and was secretly enrolled in an ever-growing network of compromised machines called a 'botnet'. The term 'bot' is a derivation of 'software robot', which is another way of saying that an infected machine effectively becomes the obedient slave of its - illicit - owner. If your PC is compromised in this way then, while you may own the machine, someone else controls it. And they can use it to send spam, to participate in distributed denial-of-service attacks on banks, e-commerce or government websites, or for other even more sinister purposes.Article continuesStorm has been spreading steadily since last January, gradually constructing a huge botnet. It affects only computers running Microsoft Windows, but that means that more than 90 per cent of the world's PCs are vulnerable. Nobody knows how big the Storm botnet has become, but reputable security professionals cite estimates of between one million and 50 million computers worldwide. To date, the botnet has been used only intermittently, which is disquieting: what it means is that someone, somewhere, is quietly building a doomsday machine that can be rented out to the highest bidder, or used for purposes that we cannot yet predict.Of course, computer worms are an old story, which may explain why the mainstream media has paid relatively little attention to what's been happening. Old-style worms - the ones with names like Sasser and Slammer - were written by vandals or hackers and designed to spread as quickly as possible. Slammer, for example, infected 75,000 computers in 10 minutes, and therefore attracted a lot of attention. The vigour of the onslaught made it easier for anti-virus firms to detect the attack and come up with countermeasures. In that sense, old-style worms were like measles - an infectious disease that shows immediate symptoms.Storm is different. It spreads quietly, without drawing attention to itself. Symptoms don't appear immediately, and an infected computer can lie dormant for a long time. 'If it were a disease,' says one expert, Bruce Schneier, 'it would be more like syphilis, whose symptoms may be mild or disappear altogether, but which will come back years later and eat your brain.'Schneier thinks Storm represents 'the future of malware' because of the technical virtuosity of its design. For example, it works rather like an ant colony, with separation of duties. Only a small fraction of infected hosts spread the worm. A much smaller fraction are command-and-control servers; the rest stand by to receive orders. By only allowing a small number of hosts to propagate the virus and act as command-and-control servers, Storm is resilient against attack because even if those hosts shut down, the network remains largely intact and other hosts can take over their duties.More fiendishly, Storm doesn't have any noticeable performance impact on its hosts. Like a parasite, it needs the host to be intact and healthy for its own survival. This makes it harder to detect, because users and network administrators won't notice any abnormal behaviour most of the time.And instead of having all hosts communicate with a central server or set of servers, Storm uses a peer-to-peer networking protocol for its command-and-control servers. This makes the botnet much harder to disable because there's no centralised control point to be identified and shut down.It gets worse. Storm's delivery mechanism changes regularly. It began as PDF spam, then morphed into e-cards and YouTube invites. It then started posting blog-comment spam, again trying to trick viewers into clicking infected links. Similarly, the Storm email changes all the time, with new, topical subject lines and text. And last month Storm began attacking anti-spam sites focused on identifying it. It has also attacked the personal website of a malware expert who published an analysis of how it worked.At the moment, nobody knows who's behind this. Is it a Russian mafia operation? An al-Qaeda scheme? The really creepy thing is that, to date, the controllers of Storm have used it for such relatively trivial purposes. The suspicion has to be that they are biding their time, waiting for the moment when, say, 100 million naive Windows users have clicked on an infected link and unwittingly added their machines to the botnet.Only then will we know what a perfect storm in cyberspace is like.[email]john.naughton@observer.co.uk[/email]