Researchers who monitor Storm strictly from a SPAM aspect have come to a
conclusion that Storm is dead (for now), but actually from a botnet point of view, Storm is
very much alive and kicking. Read on to see our analysis about how we've been able to see live Storm bots.
There is an old saying that says something like "The best way to kill a bear is to use his own power against him."
This is precisely what happened with Storm. People in and around the industry talked at length about the beauty of the Storm Peer to Peer architecture and its use of fast-flux networks. But, in fact, Storm's P2P communication was the main reason that the security community had an opportunity to monitor, detect, and decrypt Storm traffic, as all inter-Bot traffic was very noisy. Going one step further, the easily crackable communication gave those with more nefarious intentions the ability to poison, or straight take over, Storm bots.
I decided to write this article as I read the findings from Jeremy’s article published on 5 October 2008.
http://www.sudosecure.net/archives/264