REN-ISAC Cautioned Colleges & Universities of Storm Worm Infections

The REN-ISAC (Research and Education Networking Information Sharing and Analysis Center) issued a warning on 9th August 2007 after colleges and universities experienced various attacks by the Storm worm. The Center advised IT managers of the schools to act promptly against any infection that may strike their networks.

Officials at REN-ISAC said the distributed Denial of Service (DoS) attacks by the Storm worm seem to pound on the network of any system, which scans an infected machine.

The attacks take the shape of Internet Message Control Protocol (ICMP), usually stay for more than 24 hours, relate to many sources located across the globe, and are capable of generating significant traffic, warned REN-ISAC. As the students return for autumn classes, the 'distributed denial of service following scanning' behavior leaves the education sector at risk.

The REN-ISAC warning is the latest on the Storm Worm. This worm first appeared in January 2007 through large surges of e-mail sent from already compromised PCs. Each burst of e-mail delivers a custom variant that attempts to infect computer systems before it is possible to update the anti-virus solutions deployed on the systems. The program gains control of the systems by tempting the users with subject lines on news events, including the ravage storms in Europe, encouraging them to eventually open the malicious attachments in the messages.

The Storm Worm's botnet has also expanded significantly. SecureWorks estimated that during June to July 2007, the total number of compromised PCs in the botnet was 1.7 Million. Botnets are created to send spam in large amounts.

SecureWorks insisted that parties suffering the brunt of the situation share their experiences and knowledge because soon, millions of students would rejoin the college and university classes who might be having computers connected to unknown sources and possibly infected with unknown malware, said Joe Stewart, senior security researcher with SecureWorks in a statement. Security Focus published it on August 15, 2007.

According to REN-ISAC's recommendations, universities need to respond promptly to infections to kill the possibility of compromised systems becoming nodes of distribution, which could launch an attack. Also, schools need to monitor their networks and have open communications with their ISPsThe REN-ISAC (Research and Education Networking Information Sharing and Analysis Center) issued a warning on 9th August 2007 after colleges and universities experienced various attacks by the Storm worm. The Center advised IT managers of the schools to act promptly against any infection that may strike their networks.

Officials at REN-ISAC said the distributed Denial of Service (DoS) attacks by the Storm worm seem to pound on the network of any system, which scans an infected machine.

The attacks take the shape of Internet Message Control Protocol (ICMP), usually stay for more than 24 hours, relate to many sources located across the globe, and are capable of generating significant traffic, warned REN-ISAC. As the students return for autumn classes, the 'distributed denial of service following scanning' behavior leaves the education sector at risk.

The REN-ISAC warning is the latest on the Storm Worm. This worm first appeared in January 2007 through large surges of e-mail sent from already compromised PCs. Each burst of e-mail delivers a custom variant that attempts to infect computer systems before it is possible to update the anti-virus solutions deployed on the systems. The program gains control of the systems by tempting the users with subject lines on news events, including the ravage storms in Europe, encouraging them to eventually open the malicious attachments in the messages.

The Storm Worm's botnet has also expanded significantly. SecureWorks esti...

» SPAMfighter News - 8/30/2007