CSLTechnicalNoteOctober10,2方案.PDFVIP

CSL Technical Note • October 10, 2007 A Multi-perspective Analysis of the Storm (Peacomm) Worm Phillip Porras and Hassen Saıdi and Vinod Yegneswaran ¨ Computer Science Laboratory http://www.cyber-ta.og/pubs/StormWorm/ Computer Science Laboratory•333 Ravenswood Ave.•Menlo Park, CA 94025•(650) 326-6200 •Facsimile: (650) 859-2844 A Multi-perspective Analysis of the Storm (Peacomm) Worm ¨ Phillip Porras and Hassen Saıdi and Vinod Yegneswaran Computer Science Laboratory 1 Introduction Since early 2007 a new form of malware has made its presence known on the Internet by its prolific growth rate, its ability to distribute large volumes of spam, and its ability to avoid detection and eradication. Storm Worm (or W32.Peacomm, Nuwar, Tibs, Zhelatin), as it is known, is a highly prolific new generation of malware that has gained a significant foothold in un- suspecting Microsoft Windows computers across the Internet. Storm, like all bots, distinguishes itself from other forms of malware (viruses, Trojan horses, worms) by its ability to establish a control channel that allows its infected clients to operate as a coordinated collective, or botnet. However, even among botnets Storm has further distinguished itself by being among the first to introduce a fully P2P control channel, to utilize fast-flux [10] to hide its binary distribution points, and to aggressively defend itself from those who would seek to reverse engineer its logic. The developers of Storm have retrofitted and improved its codebase over the last year, but its primary mission has remained to be a prolific propagator of spam (