According to Joe Stewart, SecureWorks' senior security researcher, the storm worm is using a 40-byte key to encrypt traffic on the Overnet distributed-client peer-to-peer (p2p) network.
"This means that each node will be able to communicate only with nodes that use the same key," he said on SecureWorks' blog. "This effectively allows the storm author to segment the storm botnet into smaller networks [and] could be a precursor to selling storm to other spammers.
“If that's the case, we might see a lot more of storm in the future," he said.
Stewart also had some good news. Network administrators will be able to easily distinguish storm traffic from other p2p network use.
Once the storm worm compromises a PC, it adds it to its bot army. Spammers have customized their tactics to deliver the trojan in different ways, including electronic greeting cards and news stories.
In a July 16 outbreak, the storm worm generated 120 million messages, according to security vendor Postini, now a part of Google. The trojan was named for the European wind storms that occurred simultaneously with the first attacks this January.
See original article on SC Magazine US