Storm Botnet Subsides For Now

Stony Stevenson points out an iTnews Australia story about the decline of the biggest botnet of recent times, excerpting "The Storm botnet decreased to just five percent of its original size during April, but overall web-based malware levels increased by 23.3 percent, new monitoring data reveals. MessageLabs' Intelligence Report for April 2008 said that new malicious software removal tools aimed at removing Storm infections were responsible for the sudden reduction in Storm-infected computers." According to their estimate, Storm-compromised computers are now down to about 100,000 rather than numbers closer to two million.

Re:Two birds, one stone

[MightyYar]

I'm one of the guilty ones, and the reason is really stupid.

I run a tiny PHP application that automatically shares any photos stored in my pictures folder, so that I don't have to upload anything to get an online photo album, and I don't have to abandon the 10-year-old system I have of dumping photos into directories by date/event.

A simple rsync might do it, but many of my pictures are in TIFF format from scans and collectively are too big to host anywhere affordable. Plus the little PHP script also shares video. So, I've been slowly writing a script that converts anything in the pictures folder into jpegs and THEN uploads them... but I've been working on that for quite some time now and still haven't finished.

Until then... the computer is on 24/7 :(

(I also like being able to ssh in, but that is secondary.)

Victory or Defeat?

[MozeeToby]

Is this really a sign of victory or defeat? If the article had said that storm decreased to 5% its largest size because of such and such efforts it would be a victory but it doesn't say what caused the reduction. It seems to imply that Storm is being removed by other malicious software, not the efforts of researchers.

For all we know this is just the operators of Storm paring down the system to a more usable, less scary size or hibernating large portions of the network so that if a bot killer is implemented they still have 95% to recover. It could also be the "selling off" that everyone was talking about earlier except instead of selling the botnets power they actually sold off access to the computers themselves (We'll open the backdoor to install your software then remove ourselves so you have freedom to act). Unless they can find a good reason that the network is shrinking this actually makes me more nervous, not less.