Attacks on the Intelligent Worm Communications expose worm nodes Attack the update distribution center Small number of websites P2P traffic between worm nodes "I am already infected" defense Abuse worm's double-infection detector Rogue worm node Inject false messages, disable worm network Break weak crypto (if any is used)