Have a look at Cronto - it's an out-of-band authentication system, similar to ZTIC but doesn't use an electrical connection to the computer that could be impacted by a malware infection on the PC. Instead it transfers encrypted/signed transaction details via visual code to the Cronto device (or Cronto app running on a camera-enabled smartphone). There are a few other similar systems from other vendors, but Cronto is the only one I've seen with a mobile app so far.

Nope, I'm pretty sure it's a reference to guavas, considering the complete path was:

b:\myrtus\src\objfre_w2k_x86\i386\guava.pdb

It's not. There's no exploit code sent, just random bytes and the replies are discarded.

I think they're attempting to evade brain-dead automated protocol inspection, not trying to fool a human.

They're not. The connections are far too infrequent (15 connections, then sleep for 30 hours).

Yeah, that's why most banking fraud trojans that target U.S. banks are compiled on Russian-language PCs and connect back to Russian-developed webserver software. I'm afraid your "well-established" fact doesn't ring true with anyone that actually tracks banking trojans for a living.

Ah yes, as hilarious as the first hundred times I've seen that joke posted about me. Maybe I _should_ just change my name to !jonstewart...

-Joe

Your scenario of corporate chaos isn't accurate when it comes to Storm. Storm isn't self-replicating; it doesn't spread to other internal systems. It can however steal email addresses and possibly other external systems will begin to send Storm social-engineering emails to the rest of the company. However, if you have a sane firewall policy that doesn't allow arbitrary high-port UDP traffic outbound and inbound, the Storm node will never be able to link up to the rest of the botnet, rendering it more of a noisy annoyance than a threat to the company's data.