RSST-minus two days...Ready or not, here comes Conficker
By Angela Gunn | Published March 30, 2009, 3:17 PM
The computers -- over a million of them at last count, it is believed -- are in place. The Microsoft vulnerability making it all possible has been patched by, presumably, everyone who's going to do so. The poisonous code itself has been upgraded. We've seen the effect of the early tests, we've pondered the bounty on the developers' heads, and yet we've got to start asking ourselves: What's going to happen when Conficker lights up on Wednesday?
Wouldn't you like to know. Wouldn't a lot of people like to know.
While the rest of the world was filling out its brackets and wondering why Madonna needs to adopt another kid, the unknown perpetrators of Conficker have been busy polishing their botnet -- though "botnet" at this point feels like a rather inadequate word. After several code updates, Conficker's got at least 50,000 sites available for remotely controlling its activities, whatever they turn out to be.
Estimates of the number of affected machines vary. Fortinet's monthly threat analysis, released Friday, says that Conficker's the fourth most common infection this month -- though down a bit from its peak infection day on February 12. Microsoft hasn't released a new infection estimate since that day (coincidentally, the day on which the company announced that $250,000 reward for information leading to the capture of Conficker's keepers); they said that 3 million machines were infected at that time.
Not only is the number of infected machines quite high, the number of machines that can be used to control them has skyrocketed -- a crucial part of why Conficker (a.k.a., Downadup or, occasionally, Downandup) so nasty. An earlier victory by anti-Conficker researchers, in which 250 sites under the control of the malware were recaptured, was obliterated a week later when Conficker's keepers tweaked the code. Now it can tap 50,000 sites -- and there's virtually no chance of shutting those down.
(Microsoft, by the way, won't even discuss how many hosts are infected; as Christopher Budd, security response communication lead for Microsoft, puts it, "While Microsoft and ICANN are monitoring several data points, by revealing these numbers, the criminals' attack could be aided and so it is in the best interest of our customers to not release these figures at this time.")
That specific version, called Conficker C (or Downadup.C or, to one's everlasting confusion, Conficker.D), also has the ability to knock out various anti-malware programs as well as Microsoft's security update abilities. Fortinet analysts note that the C version deploys a new domain generation algorithm, and uses MD6 (an enhanced cryptographic hash function) to check that its code is valid. Overall, experts say, Conficker's writers are diligent, smart, and keeping a close eye on efforts to take their baby out of commission. (SRI International, which has engaged in close analysis of Conficker C for weeks, has a fascinating analysis posted, complete with flowcharts.)
Those efforts vary. Some keepers of top-level domains, such as Canada and its Canadian Internet Registration Authority, hopes to mitigate the attack's effects on its sites (and reputation) by registering and isolating domains it believes the Conficker software might try to generate. Doing so will block Conficker from setting up sites to host the command-and-control software that directs infected machines. Microsolved is offering a free honeypot that can spot and document Conficker probes or scans (Linux only, folks), and other groups are announcing tools and detection strategies as the day nears.
And the coalition of companies that came together a few weeks back is still racing the clock, updating their site over the weekend. The Conficker Working Group (formerly the Conficker Cabal) has also freshened its FAQ, noting therein that the only thing we definitely know about April 1 and Conficker is that the malware will switch to a new algorithm to determine which domains infected machines should contact for further instructions.
So what the heck is it? What does it want from us? Why are we in a situation not unlike the landing scene in The Day The Earth Stood Still? The currently dominant theory about Conficker is that it's the malware equivalent to cloud computing -- big space, big capacity, for hire, for bad guys. Most botnets are run for financial gain, so maybe we're on the cusp of some big theft or fraud effort; more darkly, a botnet this big and hard to eradicate could be used for cyber-attacks on nations or against the net at large. That doesn't necessarily happen on Wednesday; again, the only thing known to happen on Wednesday is the algorithm change... and a lot of jangly nerves while we wait and watch.
And a very happy April Fools' Day to you too!
[Pair of Iberian worm lizards (Blanus cinereus)) pictured courtesy of Richard Avery, via Wikimedia Commons.]
"Oh look, it's the inbred idiot who claims California is the "armpit" of the nation yet incidentally he goes by the user name of the most famous city in California!
Get a life loser."
You crack me up. The Apple cheerleader with self image problems is teaching geography. In case you didn't know, there are four cities named Hollywood in the US.
Lastly, I made a little over four grand this week without leaving my house, how about you? Is your dark cubicle a fun place to wither away until you die? How's that rush hour traffic? I drive extra slow if I have to go out during rush hour just to piss off the brain dead coffin stuffers like yourself.
Have fun at work next week my friend.
Score: 0
|internetworld7, get a life.
the only reason why Mac OSX is "secure" is that virus writers don't want to waste their time writing viruses for an operating system NO ONE USES!
I don't think that's a good enough reason to praise it.
And why do you have to keep trolling? Are you getting paid? Is that how low Apple has sunk?
Score: 0
|So far, I've had no problems running Symantec Antivirus Corporate Edition 10.1.8.8000. It's on about 1400 PC's at work and we have ZERO issues regarding Conficker (Conflicker). Funny thing is that SEP 11 (Symantec Endpoint Protection) seems to catch less than the older version 10.1 does. :-)
In fact, thankfully since the Anna Kournikova virus and the Melissa virus we have seen nothing.
We have a few issues here and there with AV2009 and AV360 but it's fixable.
Score: 0
|???
Corporate environment would imply those systems are actually up to date, right?
Conficker will not affect them in that case, regardless of your AV solution.
Score: -3
|This is one case where the O/S that nobody cares about is safe (OSX). All 300 Mac owners in this country are celebrating and cheerleading.
Did you notice how iPods and Macs are piling up at stores in this crappy economy. My Local Best Buys cases are packed full of brightly colored Nanos. The problem is you can buy an Acer notebook at $399 these days, or get a Mac at $2000.
With things the way they are, Mac is hurting big time. The average slob who wants to appear wealthier than they are (like the millions of suckers who bought adjustable rate mortgages for houses they couldn't afford, e.g. Internetworld7) are spending more wisely and Mac is taking a beating.
I can't wait for them to release a $400 POS notebook.
Score: -1
|Oh look, it's the inbred idiot who claims California is the "armpit" of the nation yet incidentally he goes by the user name of the most famous city in California!
Get a life loser.
Score: -2
|@iTard,
Dude, whatever you do, don't actually argue with him. You might lose. Just call him names and act like a three-year old.
Oh, wait.. I see you've got that covered. Do go on...
Score: -4
|I love the chicken little mentality of this country full or morons. My dumb a** brother-in-law says he's buying a Mac because of this virus.
I told him to go out and buy one. At least I will never have to mess with his computer again.
Score: 3
|At least you admit to the superiority of the Mac by stating you will never have to mess with his computer again as Macs are far more reliable and have far fewer issues than PCs and if on that rare occasion he does have a problem, Apple has got his back. :)
So I wonder who the real dumb a** is in the family?
Score: -2
|By now you should know that Mac OS X is the only true means of total security and a real since of world peace. Get a Mac and never look back...
Score: -6
|WOOOOOHOOOOO trolls (like internetworld7) came to advertise WOOOOHOO!!!
Score: 3
|Calling me a troll is insulting... Call me an Apple Troll... Thank you.
Score: -5
|No, you imbecile. You're an Apple Fanboy and a Microsoft Troll.
Get with the netspeak, genius. Sheesh... ;-)
Score: -3
|LOL. Got Mac?
Score: -3
|I have to say that this is a good case to show that people need to take responsibility for using a computer. When MS issues a patch to take care of this worm and when most security-oriented companies have scanners now to detect this bug and people don't use these tools then they deserve what they get. this also brings in the issue of such idiotic things as clicking on a flashing advertisement, going to sites that are questionable, and being overly free with the information you give out. this also brings in the issue of what people do and where they go at work. A good case in point is NBC where some idiot went to a site and the whole network got infected. Now this also raises questions about the IT department and the rules in place but if there are tools out there to deal with any situation and people don't use these tools then blame lies on the people.
As far as both Russia and China, I agree that both governments, which have turned a blind eye to these problems originating in their countries need to step up and pull out the fingernails of each person involve in this activity one by one and then offer them a job.
it seems to me that this problem is a perfect example of how much of a 'victim" mentality has crept into the American consciousness and that we, in general, don't want to take responsibility for our actions or inactions but blame someone or something else.
to those who didn't install the patch or run security software and want to whine, I say tough sh**. That is called tough love and our kids need more of it.
Score: 3
|One of my better tech tales is about a 97 year old man who couldn't reload his OS with the help of his manufacturer's telephone tech support. What the phone tech couldn't see was that the 97 year old man was trying to put the CD in the drive, jewel case and all. The jewel case was still in shrink-wrap which, because of his age, he could neither feel nor see.
If you asked me to launch the space shuttle, I would be able to push the button, but I wouldn't know anything about the inner workings. I would be like the 97 year-old man, not knowing what was safe to push, or how to fix it if it wasn't safe.
Many computer users are no less overwhelmed by the complexity of their computer, than I would be by being made responsible for the space shuttle. My mother, for instance, keeps threatening to give up her computer because she can't figure out how to check her email after my nephew has been playing games on it.
If you want real cyber-security, the industry has to allow for people whose computer skills extend no further than playing Solitaire. Is the government going to license computer users like vehicle drivers? Or do we need to make appliance-type, ROM based computers that can't be infected?
I agree something needs to be improved, but mistaking ignorance for idiocy does not move us toward a solution.
Score: 0
|Love the image on the main page.
"Wouldn't you prefer a nice game of chess?"
Score: 1
|maybe its a good idea not turn on my laptop in april 1
lol
Score: -1
|Or you could do the smart thing and get a Mac and never worry about viruses or security problems ever again in life...
Score: -4
|......Or worry about running your favorite software.........
Score: 2
|Wont do ya any good to keep your computers turned off whereas you could ALREADY be infected by it and not know it... alot of other users had this same idea in their heads and researchers say it wont do s***
Score: 0
|250k reward!!!
we all know it originated from russia and created by a group of kids, hackers touted as heros by their countrymen.
please let me know when my cashiers check will be ready.
Score: 0
|anyone who hadn't kept their systems up to date monthly and even admins who waited months to roll out updates after MS issued a patch for this exploit in particular deserve to be exploited
oblivious users? i've got my mum running ubuntu because i know shes beyond retarded when it comes to any PC and its OS, windows users are large targets and i wouldn't want her targeted, i on the other hand can take care of myself
if you know a bunch of nimrods always getting infected, sure, i'd direct them towards OS X or Linux, i'm all for it, even if Windows ends up with 50% of the market at least a quarter or more of MS problems go with it
Score: 1
|AD: I usually agree with you, but your first statement, I have to raise issue with...
"anyone who hadn't kept their systems up to date monthly and even admins who waited months to roll out updates after MS issued a patch for this exploit in particular deserve to be exploited"...
For the home user, yeah, absolutely correct. If they don't run Windows Update (or at least have automatic updates turned on), then yeah, I agree... But IT admins doesn't always have the option to install every MSFT update without testing and such. Case in point; At my last job we had about 25 production servers that could not be patched regularly. The reason? We had apps running that depended on very specific server configurations. Now, while we were sitting on some very well designed VLans and behind 4 firewalls (PIX based), these servers *could* be open for attack. My point is that it is not always up to the IT staff to update to each and every patch that MSFT publishes, even though we know that we should, it's just not always feasable. Plus, not all companies are setup with a good QA/testing environment (like my last company, we only had 6 QA servers compared to 25 prod servers). Trying to test a patch to something like say, http.sys, can be a monumental undertaking for some companies.
Score: 0
|Or you could have used these servers and been completely secure from day one with no need to worry about viruses or hackers: http://www.apple.com/server/macosx/
Score: -3
|Sorry, linux is prone to virus and botnet attacks like every other OS on the market. Anyone who tells you otherwise is lying...
Score: 1
|in that cause, it would prob be best to have many many restrictive network policies in place for the users, in corporate enviroments thats always best anyhow
Score: 1
|Except I wasn't referring to Linux I was referring to Mac OS X servers, rock solid and impervious to viruses and hackers... Something no other OS can boast.
Score: -2
|*laughing* What do you think Darwin, erm, sorry Mac OSX, is? It's a modified version of Linux...
You really have to love the mac fanbois and their lack of understanding what a kernel is. lol
Score: 0
|Mach is BSD, not linux.
Just an FYI....
Score: -3
|I was keeping it simple for stupid up there... lol
Trying to explain the difference between *nix distros is best left to the more intelligent people around here... ;-)
Score: 0
|Sounds like these microsoft users should get a mac, they don't get a virus.
Score: -4
|And it's that attitude that makes me WANT to write a virus for Darwin... (not will, lol) ;-)
Score: 0
|My sentiments exactly briguy2186. It's good to know another intelligent being has graced us with his presence. It gets a little vexing conversing with dimwits all the time.
Score: -2
|Sounds a lot like the dreaded Y2K bug. That was devasting too. lol
Score: -1
|Y2K bug was just that, a bug. This is a maliscious piece of code that someone(s) has gone to alot of effort to get on 3 million+ machines.
Score: 0
|It wasn't devastating -- but that's thanks to a lot of people who busted their humps to patch things up. I think a lot of civilians don't understand that, which is why some of the more hysterical coverage of the likes of Conficker is a huge disservice. Especially since, as the article points out, April 1 isn't a launch date but the date the botnet starts taking its orders in an important new way.
Score: 0
|"Some keepers of top-level domains, such as Canada and its Canadian Internet Registration Authority, hopes to mitigate the attack's effects on its sites (and reputation) by registering and isolating domains it believes the Conficker software might try to generate. "
Whats to keep them from using some form of DNS poisoning to get there worm to look where they need it to, no matter who has control of those domains. Hell, they have been quit crafty so far, that would be right up there alley.
I still think this thing is SKYNET. Judgement day is coming !
Score: 1
|Our preparation: shrug.
Score: 0
|You're not cheering me up, MJM. But check out the brief on CERT's super-quick "test" for infection, and stand by for good news for netadmins...
Score: 0
|@Angela - Now if you used a more relayable operating system such as Linux for your server, there wouldn't be any "fears" wouldn't they...
Score: 0
|Stop that talk or you'll raise up the Mac fanbois :-) . Seriously, businesses choose their clients and servers for all kinds of reasons; it'll be interesting to see if there's any movement to other platforms based on this infection. On the whole, though, and basing this on years of observation... nope, not gonna happen.
(And frankly, the more I see of Win7 the more hopeful I am concerning its security outlook. Certainly more hopeful than I am for the Mac, hailing as it does from a company that persistently ignores, denies and covers up its security problems; as a wise man once said, "I'd prefer a straight fight to all this sneaking around.")
Score: 2
|Why I'm not in the least bit concerned:
1. We disabled autorun/play 7 years ago.
2. All users run as user. 90% of malware doesn't do jack under user-level permission.
3. We patch everything religiously. 100% of workstations are patched within 3-4 days of release, or they don't even get on the LAN. Servers are between 1-2 weeks.
I guess one could be concerned if there is a zero-day or this impacts the internet as a whole, but I go on vacation tomorrow! Bye!
Score: 0
|MJM, didn't you tell me a couple of comments threads ago that you had a Sony machine or two that *couldn't* be patched?
Score: 0
|I don't think so. I haven't touched a Sony machine in many years. Thankfully.
Score: 0
|?! First comment on http://www.betanews.com/...y-other-name/1232565761 is not from you? Now I am officially confused. (Though not going to argue re the "thankfully" part -- I miss my old Vaio, but it was from a different era to be sure.)
Score: 0
|Right you are. I remember now. Work user brought in home machine. Consumer side.
Score: 0
|I would never have pegged Han Solo as particularly "wise"... but he certainly did have his moments. ;-)
Score: 0
|Yountmj, please award yourself one (1) cookie for recognizing the quote. Always makes me so happy when that one doesn't get a "huh?" -- and I'll raise you a WarGames, with a whiny aside that everyone's just got to pick on Seattle this week. (Could be worse; could be Japan wondering what North Korea's up to with their new toys. Not okay.)
MJM, that was a home machine someone hauled in? Ew, yikes! I hope that was a huge favor you got to collect on down the road and not some cranky C-level type. (Now, have a great vacation!)
Score: 0
|LiraNuna: Even if I can't figure out what was meant
I ignore tlypos but?
Uh, conficker is _supposed_ to make machines
more relayable. ;-P
Score: 0
|@Angela: Win7 is making some good strides into security, but there is still A LOT of work to be done there... Win7 has Guest Mode that wipes any traces of what a user has done during their session. The great thing about this will be if businesses will enforce it upon users. This would, in theory, disallow malware from being able to infiltrate the system. From what I have seen of it so far (I'm using it at home for my kids, lol), it is pretty effective at not allowing applications and rootkits to infiltrate the system. Anything they do (downloading music, games, and other kid crap) gets wiped out as soon as they log off and then log on again. Hopefully MSFT will allow for domain scripts to be written that will delete all traces of changes that the user made after they log off as opposed to waiting until they log in again.
This is a really good article about Guest Mode...
http://www.winsupersite....win7/ff_pcsafeguard.asp
Score: 0
|flibberyGiveIt, officially I have no comment re typos but... *giggle* Indeed.
DotNet_Coder, this looks interesting; thank you! I'm eager to see how Guest Mode (naming help desperately needed) logging plays out, now that I know about it; I can see why Microsoft might choose to retain the log until next login, but I'd agree that the option to reconfigure that choice ought to be available. Sounds like you're having a good experience with it overall, though; certainly kids make the best testers for this kind of thing ;-) .
Score: 0
|@Angela: I originally only wanted to run Win7 on my HP Mini 1033CL netbook (build 7068 runs amazingly on it, btw). Then I decided to put it on the HTPC downstairs in the living room. Now Win7 is running on a total of 7 machines in the house. I abducted, erm, forced, erm, asked my children to use and test it. LOL...
As for Guest Mode, I had some discussions last night and got a little bit of clarification on Guest Mode both in and out of the corporate environment. When a Win7 machine is joined to a Win2K8 domain, that user (not machine, for roaming profile reasons) can be put into a modified Guest Mode for domains. What this means is that any private data the user saves to ANY machine in the domain will be copied to a shadow volume location and then wiped from the machine at user log off (exactly how it should be for domain users). The domain administrator can restore documents and settings from the shadow copy at any time. In a personal environment, the only reason for the decision to clean at user login is so that the machine adminstrator can restore data between sessions if needed. However, part of the Win7 SDK that was released recently allows for automating this process and changing the behavior.
Score: 0
|