Storm Warning: Worm Threat Escalates

The Storm worm has grown into an online siege 10 times larger than any other e-mail attack in the last two years, amassing a botnet of nearly 2 million computers, with worrying implications, researchers say.

Before Storm, an average day saw about 1 million virus-laden e-mails crossing the Internet, says Adam Swidler, senior manager of software security firm Postini. On July 24, researchers tracked 46.2 million malicious messages, more than 99% of them from the Storm worm.

The number of zombie computers the Storm worm authors have amassed has skyrocketed in the past two months, says SecureWorks senior researcher Joe Stewart. From the first of January to the end of May, there were 2,815 bots launching Storm attacks. By the end of July, that number had leaped to 1.7 million. "It's been building with exponential growth," says Stewart. "It's one of the largest botnets I've ever heard of."

All of the bots are set up to launch denial-of-service attacks, and that's what Stewart and Swidler fear most. "It's harnessing the benefits of the grid computing architecture for evil purposes," says Swidler. "I shudder to think should they turn this botnet on an organization."

SecureWorks is warning IT managers and home users to avoid becoming part of the botnet by being aware of the scams connected to the Storm worm, which include e-mails with links leading to fake e-cards and news stories highlighting catastrophic events. IT managers can protect their systems by blocking peer-to-peer networking. By doing that, says Stewart, then when the malware tries to link infected computers via P2P networks, the user's computer can't become a bot.