Talk:Storm botnet

message: There is no new information (as of 2009) that I can see in this article. While citing references at FA quality is not my strong suit, I would like to draw the attention of those more skilled editors than myself with an ~{~{outofdate~}~} tag.  Dragonnas (talk) 21:05, 14 November 2009 (UTC)
thread_title:  Article is Out of Date 

message: Apparently the botnet has been compromised and is in the process of being taken down.
http://www.heise-online.co.uk/security/Storm-Worm-botnet-cracked-wide-open--/news/112385
210.50.248.62 (talk) 19:06, 12 January 2009 (UTC)
thread_title:  Compromise 

message: The DDoS attacks appear to be utilising both Syn attacks, and just basic html connection overloading attacks. See http://www.castlecops.com/f285-DDoS.html for more info.  —Preceding unsigned comment added by 80.229.38.101 (talk) 14:20, 13 September 2007 (UTC)
thread_title: DDoS attacks

message: I just pulled this from the article:
It should be noted that the distributed and anonymous nature of the botnet would make it difficult to be used on any computing task that relies on being able to access information from other computers in the botnet. Most supercomputers have fast interconnects between nodes, and all nodes are easily addressable, whereas the botnet has little to no interconnection between nodes, and nodes aren't easily addressable.
Matt Sergeant was also using the absolute upper-most estimates for the size of the botnet, which aren't based on evidence, have massive uncertainty, and will have been popularized by a media looking for whoever will give the largest estimate. (Other estimates in the range of 250,000 to 1,000,000 are often ignored in favor of the 10,000,000 to 50,000,000 estimate which is more frequently cited.)
1-50 million computers?  Seems like a pretty wide range... Sounds very fishy.  —Preceding unsigned comment added by 76.181.245.163 (talk) 05:19, 14 August 2008 (UTC)
replies: text: I really doubt the second, but WP:BEANS never applied so hard... Wnt (talk) 19:55, 11 January 2008 (UTC)
replies: text: There's a lot of info here that's going to end up as some corner of information technology folklore, I'm sure. "Boy, back in the winter a' two thousand dickety seven, I seen me the biggest botnet you ever did seen!" Lawrence Cohen 22:19, 14 January 2008 (UTC)

text: I don't think anyone's done a good analysis of what they could do with that much CPU power. One thing that they can/do do is generate unique messages for every email, and regenerate the worm signatures on the fly by mutating the payload. SteveLoughran (talk) 20:48, 23 January 2008 (UTC)
thread_title:  Unsourced info 

message: *Try to avoid one paragraph sections.  Either expand them or combine them with other sections.
*The article needs more background.  What type of virus/worm is this?  How does it relate to other worms/viruses?  What is the evolution of computer infections that led to this one?  What are the possible motivations of its creator?
*"Way forward" section.  What are the plans of network/security engineers to defeat it?  What are the plans to safeguard against this type of infection in the future?
*How does this internet attack relate to the "big picture"?  What does it mean for internet security and usage in general?  What are its long-term ramifications?
All in all, though, a good start on the article. Cla68 06:57, 14 October 2007 (UTC)
thread_title: Peer review

message: I added them all. Feel free to help out on the article if you're interested. • Lawrence Cohen 20:34, 17 October 2007 (UTC)
thread_title:  To-do list, more headers, milestones 

message: I am glad to report that this article nomination for good article status has been promoted. This is how the article, as of October 21, 2007, compares against the  six good article criteria:
:1. Well written?: Fascinating article.  Well worded, good use of language, clear and understandable.
:2. Factually accurate?: 35 citations used, with good formatting, looks like the Wikipedia:Citation templates were used.  Nice work.
:3. Broad in coverage?: The four main sections do cover a broad area.  Looking at the talk page, moving forward to FA status eventually, I would suggest following that informal Peer Review and expanding it further, i.e. what has been done lately about this, even more developing current events, etc.  The next place to seek advice is Wikipedia:Peer Review.
:4. Neutral point of view?: Worded quite neutrally, no sense of any bias here.
:5. Article stability? Article seems quite stable, I only saw one vandalism issue, keep an eye on this.
:6. Images?: No images.  Therefore, there are no image licensing problems - but it would be nice going towards FA if there were some relevant images that could be included.
If you feel that this review is in error, feel free to take it to Good article reassessment. Thank you to all of the editors who worked hard to bring it to this status, and congratulations. 
— Cirt 00:51, 24 October 2007 (UTC)
thread_title: Successful [[Wikipedia:Good articles|good article]] nomination

message: There is little mention of the botnet's current size. A recent story in PC World (http://www.pcworld.com/article/id,138721-c,virusesworms/article.html) says "The Storm Worm botnet has been shrinking steadily and is about 10 percent of its former size". How about incorporating some such recent estimation of the botnet's size into the article? lennarth 22:36, 27 October 2007 (UTC)
replies: text: Definitely. There are lots of good sources that came out since I list hit it, but I've been short on time/distracted by other articles. Feel free to take a whack at it if you're game. :) • Lawrence Cohen 14:51, 28 October 2007 (UTC)
thread_title:  decline of the storm worm 

message: I'm going to personally get back to work on expanding this out more in December. Its been idle for too long. In the meanwhile, does anyone have any suggestions for images for this article? The images on malware and botnet type articles are passable, but not the very best. Suggestions? • Lawrence Cohen 19:48, 27 November 2007 (UTC)
replies: text: How about a graph (hits vs time) of one of the DDoS attacks mentioned in the article?  It seems like that data should be available somewhere.  --W0lfie (talk) 17:25, 28 November 2007 (UTC)
replies: text: I think that could work, and wouldn't be original research. I'm pretty terrible at any sorts of graphing or graphics work, though. Is that something you can do? • Lawrence Cohen 17:43, 29 November 2007 (UTC)
replies: text: I think the preferred format for graphs here is SVG.  I'll look and see if there's a good tool to manipulate data and spit out an SVG file.  Would you be able to get the data? --W0lfie (talk) 22:48, 13 December 2007 (UTC)

text: PS Wikipedia:Collaboration to convert graphs to SVG --W0lfie (talk) 22:54, 13 December 2007 (UTC)
replies: text: I haven't been able to find a good RS for that sort of information, unfortunately, yet. Lawrence Cohen 22:53, 27 December 2007 (UTC)
thread_title:  Images for the article 

message: I've submitted the article for a Feature Article Review. Thanks everyone that helped! Lawrence Cohen 23:00, 27 December 2007 (UTC)
replies: text: Thank you! :) And yes, the masterminds behind it all are frighteningly clever--especially since unless you're an IT professional, you may never know you're under their control. And even then, maybe not? Lawrence Cohen 20:19, 28 December 2007 (UTC)
thread_title:  FAC request 

message: Is there a public posting of current locations of the malware servers?  How many times or in what way do they have to be accessed to trigger a DDOS attack from the botnet?  It does not seem to me that it would be in any way unethical for a dissatisfied employee or protesting student to intentionally mimic a DDOS researcher's actions to provoke such an attack against his network, since it simply redirects the ongoing activities of a criminal organization, and it would have the curious side effect of making life easier for the researchers.  But is that what people involved in security and enforcement believe? Wnt (talk) 18:08, 6 January 2008 (UTC)
replies: text: Most of this from my understanding of digging up this article is that the researchers (and obviously the botmasters) guard this information very carefully, so no one gives away to much, except to law enforcement. If you could possibly find something like this in a valid source, I'd love to add it. Could be very interesting. Lawrence Cohen 06:18, 7 January 2008 (UTC)
replies: text: Sorry, I thought the community collaboration to track these people would be more open than that - I certainly have no special knowledge and was surprised when I couldn't find it in a Web search. Wnt (talk) 02:44, 8 January 2008 (UTC)
thread_title:  Location of malware servers? 

message: Re: The section header "Purported decline of the botnet", Purported is quite a loaded word to use in a front page FA section header. The original wording of Reported, changed in December 2007, seems more in keeping with NPOV policy and is backed by the section's content (a report need not be accurate in everyone's view; being backed by substantial verifiable sources, as here, suffices). Even Claimed, though not entirely free of bias, would be a better choice for neutrality.
I personally believe there is a content slant throughout the article which is at odds with featured article critera #1d "Neutral" means that the article presents views fairly and without bias, but at a minimum, I think most can agree it is vital to avoid using titles which immediately cast doubt on the truth of the content. -- Michael Devore (talk) 06:54, 14 March 2008 (UTC)
replies: text: I don't disagree with this point specific to this article, and will update it. Lawrence § t/e 14:52, 15 March 2008 (UTC)
replies: text: Thanks for the change. I appreciate the consideration. -- Michael Devore (talk) 16:39, 15 March 2008 (UTC)
thread_title:  Purported? 

message: Why is the image in this article not used on the main page? It is in the public domain so I don't see any fair use problems with it, and I think it illustrates the idea behind this article very well. Gary King (talk) 00:05, 16 March 2008 (UTC)
thread_title:  No image for main page? 

message: Come on, first video games as feature articles and now this? Grow up, wikipedia. Andrew zxc (talk)  —Preceding comment was added at 01:31, 16 March 2008 (UTC)
replies: text: What a ridiculous comment. tyx (talk) 03:15, 16 March 2008 (UTC)

text: I would like to ask why you think this fails notoriety? If anyone needs to do growing up, it may be you Rotovia (talk) 03:16, 16 March 2008 (UTC)

text: Good articles are good articles. 99.230.152.143 (talk) 15:26, 16 March 2008 (UTC)
replies: text: This is a great article.  Really well written, fascinating topic.  Congrats to the principal authors.   Tempshill (talk) 05:55, 17 March 2008 (UTC)
thread_title: Grow up, wikipedia

message: Whoa, I just noticed the article I began got there!! Where was the discussion for that, I totally missed it (I am not complaining, though, wow)! Lawrence § t/e 04:29, 16 March 2008 (UTC)
thread_title:  Front page of WP 

message: This is one hell of a "multi-virus" so to speak. I wouldn't be surprise if it visited this page...  —Preceding unsigned comment added by 71.119.129.200 (talk) 06:18, 16 March 2008 (UTC)
replies: text:  Yeah I kept thinking of what the makers of the virus thought of this page. They could easily take down Wiki or take control of this pages content. I assume they are okay with it. Rekija (talk) 23:25, 16 March 2008 (UTC)
thread_title: Holy Crap

message: This article clearly needs a section on Storm botnet's attempt to locate and kill Sarah Connor. --Xyzzyplugh (talk) 14:41, 16 March 2008 (UTC)
replies: text: Cute. I always did wonder when building this article if the defensive steps where done manually, or if they actually wrote some sort of system into Storm to have it respond in a list of ways to certain things. Lawrence § t/e 18:09, 16 March 2008 (UTC)
replies: text:  I too couldn't help but draw similarities between this and Skynet. If there was someone notable connecting the dots I wouldn't be against mentioning it in the article but so far I've not seen anything. Rekija (talk) 23:21, 16 March 2008 (UTC)
thread_title: Sarah Connor

message: Given the...colorful metaphors just used by a vandal in his edit summaries, it might be advisable to outright delete those versions (by deleting the article and restoring everything but those edits) so those aren't visible to the public-at-large in the article history.  Probably should wait until after the article is no longer the FA of the day though.  Postdlf (talk) 17:38, 16 March 2008 (UTC)
replies: text: I don't believe that profanity in edit summaries is considered a big problem.  We have profanity in the bodies and the names of many articles, in fact.  See Fuck (disambiguation).  The method you suggested is used when edit summaries contain serious WP:BLP violations, like accusing real people of crimes; I don't think anyone would think it was worth the time just to get profanity removed.  --Xyzzyplugh (talk) 18:05, 16 March 2008 (UTC)
replies: text: Yeah, it's no big deal. Lawrence § t/e 18:08, 16 March 2008 (UTC)
thread_title:  Partial deletion 

message: I can't make the bandwidth math in the DoS section work. It's uncited, so there's not much to go on. The units also need to be verified (see Kilobit per second) and corrected. --Zoombody (talk) 20:19, 16 March 2008 (UTC)
thread_title:  Methodology section 

message: I'm very surprised this page doesn't bring any information on how to clean an infected machine. Even how to know your computer is infected. Am I missing something here?  —Preceding unsigned comment added by 201.42.190.169 (talk) 22:58, 16 March 2008 (UTC)
replies: text: Wikipedia is not a guide, however some sources to guides couldn't hurt. Rekija (talk) 23:13, 16 March 2008 (UTC)

text: It would be redundant info, the sort of people who have been infected are the sorts of clowns who don't know it exists or alternaively can't follow simple instructions for safety e.g. "don't open email from anyone unless you are sure you know them" so won't be able to follow any simple removal instructions either provided directly or via a link..  —Preceding unsigned comment added by 219.90.176.8 (talk) 09:32, 17 March 2008 (UTC)
replies: text: Well, it's not that... it's just got to be reliably sourced information, not just a guide or manual. Lawrence § t/e 17:22, 17 March 2008 (UTC)

text: We'd need a reliable source, really on this. Anyone ever seen anything on Storm removal? Half the stuff is still so secret that I've never seen such a thing, let alone in an reliable source. Lawrence § t/e 17:22, 17 March 2008 (UTC)
replies: text: here basicaly install the latest microsoft security updates.Geni 00:55, 26 July 2008 (UTC)
thread_title:  Cleaning infected machines 

message: link --Sharkface217 23:25, 7 April 2008 (UTC)
replies: text: Yeah, saw it earlier. Someone mailed me today saying I should keep an eye on it for a new article section on both sides in case "they go to war". Crazy world... Lawrence § t/e 23:28, 7 April 2008 (UTC)

text: You mean Kraken botnet?  Please help improve that article.  Verifiable facts about how the thing works are greatly appreciated. davidwr/(talk)/(contribs)/(e-mail) 23:29, 7 April 2008 (UTC)
replies: text: For the facts on the guts of the thing, don't expect anything soon. It took months after Storm became public for that kind of info to come out. Lawrence § t/e 23:30, 7 April 2008 (UTC)
replies: text: Yeah, that kind of information is generally closely held by those in the know, on both sides of the equation, for a variety of reasons.  It'll be a while before there's anything significant publicly known about it (at which time the reports from now will almost certainly be proven erroneous, quite possibly by orders of magnitude - in which direction, I could only guess). —Krellis (Talk) 23:48, 7 April 2008 (UTC)
replies: text: Sort of like the early estimates (that first got me curious about Storm, actually) that this botnet was "7,000,000+ strong, can knock nations offline, destroy Western civilization, and sell your children into slavery!!" Lawrence § t/e 23:51, 7 April 2008 (UTC)
replies: text: Even the current estimates of Storm are highly controversial and widely disputed.  Only the controllers likely really know the extent of the network (and perhaps even they don't!) —Krellis (Talk) 23:53, 7 April 2008 (UTC)
replies: text: Latest word on Storm is that is has come back with a major redesign now called Waledec See link1, link2 and link3 for further information. Suggestion to add what good information is in those articles. --41.247.115.17 (talk) 13:45, 16 January 2009 (UTC)
thread_title: New botnet in town?

message: http://www.darkreading.com/document.asp?doc_id=151862&f_src=drdaily
Jehochman Talk 18:33, 24 April 2008 (UTC)
thread_title: Interesting new reference

message: Dear fellow contributors
MOSNUM no longer encourages date autoformatting, having evolved over the past year or so from the mandatory to the optional after much discussion there and elsewhere of the disadvantages of the system. Related to this, MOSNUM prescribes rules for the raw formatting, irrespective of whether or not dates are autoformatted. MOSLINK and CONTEXT are consistent with this. 
There are at least six disadvantages in using date-autoformatting, which I've capped here:
Removal has generally been met with positive responses by editors. Does anyone object if I remove it from the main text (using a script) in a few days’ time on a trial basis? The original input formatting would be seen by all WPians, not just the huge number of visitors; it would be plain, unobtrusive text, which would give greater prominence to the high-value links. Tony (talk) 06:54, 24 July 2008 (UTC)
thread_title:  Proposal to remove date-autoformatting 

message: Hello everyone - Unfortunately, this article does not meet the current standards for a featured article. The major issue is that it is significantly out-of-date, as has been pointed out by the cleanup banner that has been located at the top of the article for almost two years. The majority of the article's information ending at 2008, and absolutely nothing since 2010. What has happened with this system over the past 2-4 years? There are also several dead links, see here. If work is not completed on these issues in the next few weeks, this article will need to be taken to WP:Featured article review for a possible revocation of its featured status. Dana boomer (talk) 15:00, 24 September 2012 (UTC)
thread_title:  Work needed 

message: Hello fellow Wikipedians,
I have just added archive links to  on Storm botnet. Please take a moment to review my edit. If necessary, add  after the link to keep me from modifying it. Alternatively, you can add  to keep me off the page altogether. I made the following changes:
*Added archive https://web.archive.org/20091006100315/http://media.ccc.de:80/browse/congress/2008/25c3-3000-en-stormfucker_owning_the_storm_botnet.html to http://media.ccc.de/browse/congress/2008/25c3-3000-en-stormfucker_owning_the_storm_botnet.html
When you have finished reviewing my changes, please set the checked parameter below to true to let others know.
Cheers.—cyberbot IITalk to my owner:Online 16:28, 21 January 2016 (UTC)
thread_title:  External links modified