Storm Side C&C Channel
This new variant of Storm is using a short TCP connection for direct commands apparently. Reverse engineered by Joe Stewart at Secureworks. It’s in essence 4bytes up from the drone, 4bytes back to setup and authenticate eachother.
These sigs will catch that setup. I can’t imagine many situations where these would false, but it is possible. Please report any issues.
alert tcp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:”BLEEDING-EDGE TROJAN Storm Making initial outbound connection”; flowbits:isnotset,BE.stormtcp.init; flow:established,to_server; dsize:4; classtype:trojan-activity; flowbits:noalert; flowbits:set,BE.stormtcp.init; reference:url,doc.bleedingthreats.net/bin/view/Main/StormWorm; sid:2007640; rev;1;)
alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET 1024:65535 (msg:”BLEEDING-EDGE TROJAN Storm Controller Response to Drone via tcp”; flowbits:isset,BE.stormtcp.init; flow:established,from_server; dsize:4; classtype:trojan-activity; reference:url,doc.bleedingthreats.net/bin/view/Main/StormWorm; sid:2007641; rev:1;)
October 16th, 2007 at 11:28 pm
Skype and perhaps other P2P applications appear to create false positives to these rules. (I was able to confirm, just having skype running, and not even engaging in any use of the service, my linux desktop was able to set this off a number of times)