The access key for accessibility features is 0. Press alt 0 to come back here at any time.

Access Keys:

Skip to content | Go to site-wide navigation bar
Employment Opportunities
Faculty | Staff
Search Michigan Engineering:
you are here Home  /  CAEN  /  CAEN News  /  CAEN News Articles  /  ITSS advises on the spread of the Storm Worm  /  ITSS advises on the spread of the Storm Worm
Categories | General Computing | Network Services | Operating Systems | IT Security
Contact Information
  • Name: CAEN Staff
  • Email: security@engin.umich.edu
  • Phone: (734) 764-CAEN
Releases Quick Access
Thursday, August 23, 2007

ITSS advises on the spread of the Storm Worm

This article was written to make the community aware of malware that propagates via email called the Storm Worm. With students and faculty returning to campus for the school year, we'd like to make everyone aware of the threat, and what can be done to minimize its impact.

PLATFORMS AFFECTED

All Windows systems where a user reads email and consents to either opening an attachment or a web site.

TECHNICAL DESCRIPTION

The Storm Worm has multiple variations, but it appears as an email with either an executable (EXE) attachment or a link to a web site. The text of the email varies, but is designed to entice the recipient to either open the EXE attachment or visit the malicious web site. One of the more common variations appears as an ecard, with a subject like "You've received a greeting ecard from a Worshipper". If the email appears as a link to a web site, upon clicking the user will be asked to run an EXE file. Some recent variations include web browser exploits which will launch the EXE file without user intervention. Once the malware is launched, the Storm Worm uses the peer-to-peer protocol eDonkey to connect to other infected machines. This protocol uses UDP over arbitrary port numbers. The worm will immediately begin to send mass amounts of email to other addresses. Many of the variations also include rootkit functionality to hide the executable sending the mail.

There have been reports that machines infected with the Storm Worm will respond to network scans by launching a network denial-of-service attack on the scanning machine. We've observed RootkitRevealer from Microsoft will detect the rootkit as an EXE or SYS file in the C:\WINDOWS or C:\WINDOWS\SYSTEM32 directories.

It's important to understand that this worm is constantly evolving and may begin to behave differently, and require different methods of detection. The email messages the worm generates are changing on an almost daily basis.

RESPONSE

ITSS is using Arbor Networks' Peakflow X to monitor the campus for signs of infected machines. They have also been working with ResNet and U-M VirusBusters to ensure students are aware of the threat. The central mail servers on campus scan incoming email for viruses, but some messages, particuarly ones containing only links, may continue to be delivered.

ACTION ITEMS

  • Make your users aware of the threat, and advise them to immediately delete unsolicited email containing executable attachments or links.
  • Ensure your machines are running the latest anti-virus software.
  • Ensure your machines have security patches regularly applied.
  • If you find an infected machine, please let us know by sending email to security@engin.umich.edu so we can monitor the situation.

REFERENCES