- Joined
- Mar 5, 2002
- Messages
- 25,751
- Reaction score
- 1,210
A new technique leaves anti-virus products running, but brain-dead; an expert says we haven't come close to witnessing Storm's true power.
NEW YORK—The ever-mutating, ever-stealthy Storm worm botnet is adding yet another trick to its vast repertoire: Instead of killing anti-virus products on target systems, it's now doing a hot fix with a memory patch to render them brain-dead.
The finding was made by Sophos and was mentioned by Joshua Corman, a principal security strategist for IBM Internet Security Systems, Oct. 23 in his presentation here at Interop on the challenge of evolving cyber-threats.
According to an Oct. 22 posting by Sophos analyst Richard Cohen, the Storm botnet—Sophos calls it Dorf, and it's also known as Ecard malware—is dropping files that call a routine that gets Windows to tell it every time a new process is started. The malware checks the process file name against an internal list and kills the ones that match—sometimes. But Storm has taken a new twist: It now would rather leave processes running and just patch entry points of loading processes that might pose a threat to it. Then, when processes such as anti-virus programs run, they simply return a value of 0. "Programs, including not just AV exes, dlls and sys files, but also software such as the P2P applications BearShare and eDonkey, will appear to run successfully, even though they didn't actually do anything, which is far less suspicious than a process that gets terminated suddenly from the outside," Cohen wrote in the posting.
The strategy means that users won't be alarmed by their anti-virus software not running. Even more ominously, the technique is designed to fool NAC (network access control) systems, which bar insecure clients from registering on a network by checking to see whether a client is running anti-virus software and whether it's patched.
"It's running but brain-dead. It's worse than shutting it off," as it opens the door for Storm bots to waltz past even networks considered to be hardened with NAC, Corman said during his Interop presentation.
It's the latest evidence of why Storm is "the scariest and most substantial threat" security researchers have ever seen, he said. Storm is patient, it's resilient, it's adaptive in that it can defeat anti-virus products in multiple ways (programmatically, it changes its signature every 30 minutes), it's invisible because it comes with a rootkit built in and hides at the kernel level, and it's clever enough to change every few weeks. It has its own mythology: Composed of up to 50 million zombie PCs, it has as much power as a supercomputer, the stories go, with the brute strength to crack Department of Defense encryption schemes.
Read on at ... http://www.eweek.com/article2/0,1895,2205606,00.asp
NEW YORK—The ever-mutating, ever-stealthy Storm worm botnet is adding yet another trick to its vast repertoire: Instead of killing anti-virus products on target systems, it's now doing a hot fix with a memory patch to render them brain-dead.
The finding was made by Sophos and was mentioned by Joshua Corman, a principal security strategist for IBM Internet Security Systems, Oct. 23 in his presentation here at Interop on the challenge of evolving cyber-threats.
According to an Oct. 22 posting by Sophos analyst Richard Cohen, the Storm botnet—Sophos calls it Dorf, and it's also known as Ecard malware—is dropping files that call a routine that gets Windows to tell it every time a new process is started. The malware checks the process file name against an internal list and kills the ones that match—sometimes. But Storm has taken a new twist: It now would rather leave processes running and just patch entry points of loading processes that might pose a threat to it. Then, when processes such as anti-virus programs run, they simply return a value of 0. "Programs, including not just AV exes, dlls and sys files, but also software such as the P2P applications BearShare and eDonkey, will appear to run successfully, even though they didn't actually do anything, which is far less suspicious than a process that gets terminated suddenly from the outside," Cohen wrote in the posting.
The strategy means that users won't be alarmed by their anti-virus software not running. Even more ominously, the technique is designed to fool NAC (network access control) systems, which bar insecure clients from registering on a network by checking to see whether a client is running anti-virus software and whether it's patched.
"It's running but brain-dead. It's worse than shutting it off," as it opens the door for Storm bots to waltz past even networks considered to be hardened with NAC, Corman said during his Interop presentation.
It's the latest evidence of why Storm is "the scariest and most substantial threat" security researchers have ever seen, he said. Storm is patient, it's resilient, it's adaptive in that it can defeat anti-virus products in multiple ways (programmatically, it changes its signature every 30 minutes), it's invisible because it comes with a rootkit built in and hides at the kernel level, and it's clever enough to change every few weeks. It has its own mythology: Composed of up to 50 million zombie PCs, it has as much power as a supercomputer, the stories go, with the brute strength to crack Department of Defense encryption schemes.
Read on at ... http://www.eweek.com/article2/0,1895,2205606,00.asp