fyi: Storm Worm botnet numbers, via Microsoft

Brandon Enright bmenrigh at
Tue Oct 23 17:41:53 EDT 2007

On Mon, 22 Oct 2007 17:55:39 -0700 plus or minus some time ' =JeffH '
<Jeff.Hodges at> wrote:
> > I will be presenting /some/ of this work at Toorcon in San Diego this
> > Saturday:  
> >  
> excellent, how'd it go? Anyone else present on Storm?  

Things went pretty smooth.  Storm is a complicated and evolving beast so a
50 minute talk can't really go into the depth that is needed to really
understand how it works.  There weren't any other presentations at Toorcon
but it's a pretty hot topic so there should be more talks and papers coming
out from various researchers in the coming weeks and months.

It seems like whenever anyone says anything about Storm, the story gets
picked up by some news service and makes its way to Slashdot.

> > The presentation is not academic paper quality and takes more of a
> > code-monkey approach to the network.  Real (sane and substantiated)
> > numbers, stats, and graphs will be presented.  To the best of my
> > knowledge, it will be the first publicly released estimates of the size
> > of the network with actual supporting data and evidence.   
> are your slides now available?  

They are:

The link to the historical trends of the network is here:

It can be very hard to track the size of a botnet, even in the case of
Storm where I'm crawling the network.  Technologies like NAT can
significantly complicate things.

for a discussion on tracking the size of botnets.

> =JeffH

My slides should provide adequate detail for someone to understand how to
interpret the graphs and data.  For specific questions, feel free to email
me directly.


The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at

More information about the cryptography mailing list