Forgot your password?
typodupeerror
Worms Security IT

Conficker Worm Asks For Instructions, Gets Update 285

Posted by CmdrTaco
from the wormed-its-way-into-my-heart dept.
KingofGnG writes "Conficker/Downup/Downadup/Kido malware, that according to Symantec 'is, to date, one of the most complex worms in the history of malicious code,' has been updated and this time for real. The new variant, dubbed W32.Downadup.C, adds new features to malware code and makes the threat even more dangerous and worrisome than before."
This discussion has been archived. No new comments can be posted.

Conficker Worm Asks For Instructions, Gets Update

Comments Filter:
  • coward (Score:4, Funny)

    by Anonymous Coward on Monday March 16, 2009 @11:49AM (#27211233)

    FIRST! now.. where do i get that update ?

  • Updates? (Score:3, Funny)

    by BrokenHalo (565198) on Monday March 16, 2009 @11:51AM (#27211265)
    Just so long as it doesn't insist on verification to check that nobody is using an unauthorised copy. After all, we wouldn't want to encourage piracy... ;-)
  • Who care? (Score:5, Funny)

    by Clarious (1177725) on Monday March 16, 2009 @11:52AM (#27211269)

    I run Linux! http://xkcd.com/272/ [xkcd.com]

    • I do (Score:5, Funny)

      by PinkyDead (862370) on Monday March 16, 2009 @12:03PM (#27211479) Journal

      I run VMWare on Linux! http://xkcd.com/350/ [xkcd.com]

    • Re: (Score:3, Funny)

      by AVryhof (142320)

      I run Conflicker.

  • Dumbasses (Score:4, Funny)

    by RoFLKOPTr (1294290) on Monday March 16, 2009 @11:52AM (#27211273)

    If people would stop downloading free_porn.jpg from 4chan, renaming it to free_porn.exe, and running it... we would not be having these problems.

    • Re: (Score:2, Insightful)

      by Spazztastic (814296)

      If people would stop downloading free_porn.jpg from 4chan, renaming it to free_porn.exe, and running it... we would not be having these problems.

      If people would stop jumping to conclusions and assuming the answer is that simple, we would not be having these problems.

      Who modded him insightful? This virus isn't spreading because of people doing something clearly shady, it's because Internet Explorer still has the JPG exploit unresolved. The user can simply view a webpage with a malicious image (which could just be a 1px whitespace) and it executes the malicious code. I've dealt with many computers in the past months since it surfaced.

      Solutions? Don't

      • Re: (Score:2, Insightful)

        by ColdWetDog (752185) *

        Solutions? Don't use IE. Use SpyBot Search & Destroy to harden the systems, use Firefox with Adblock+ and NoScript. Use an antivirus program that actually has a webguard, such as Avira.

        Sounds like an awful lot of work. Maybe move to a different OS?

        • Re:Dumbasses (Score:5, Insightful)

          by Spazztastic (814296) <spazztastic AT gmail DOT com> on Monday March 16, 2009 @12:11PM (#27211611)

          Solutions? Don't use IE. Use SpyBot Search & Destroy to harden the systems, use Firefox with Adblock+ and NoScript. Use an antivirus program that actually has a webguard, such as Avira.

          Sounds like an awful lot of work. Maybe move to a different OS?

          Ok, sure. It's a lot of work if you look at it in a simple fashion of throwing an Ubuntu CD at some user and saying "SUCK LESS THX"

          How about the hours that go into training one or many users in a company on using that new OS? Compatibility problems? Setting up specialized software?

          System hardening is more cost-effective decision versus switching OSes or having to clean up every computer that comes up with the problem. It takes about two hours at most to do it from scratch on one system image, then you can reimage as many computers that come up with the problem.

          • Re:Dumbasses (Score:5, Informative)

            by truthsearch (249536) on Monday March 16, 2009 @12:21PM (#27211759) Homepage Journal

            It takes about two hours at most to do it from scratch on one system image, then you can reimage as many computers that come up with the problem.

            Except new holes and malware will keep appearing and the process will need to be done over and over. Add it all up and it's a lot of hours. In the long run it might be cheaper to switch OSs and retrain if that new OS is generally more secure and easier to harden up front.

            • Except new holes and malware will keep appearing and the process will need to be done over and over. Add it all up and it's a lot of hours. In the long run it might be cheaper to switch OSs and retrain if that new OS is generally more secure and easier to harden up front.

              Group policy scripts can have new hosts files downloaded and put in place, antivirus updates can patch holes, etc.

              I'm 100% with trying to move Open Source, and I'm trying to push an Edubuntu lab in this district but it's a lot of work to apply it to the administrative systems.

          • Re:Dumbasses (Score:4, Insightful)

            by JonTurner (178845) on Monday March 16, 2009 @12:22PM (#27211777) Journal

            >>How about the hours that go into training one or many users in a company on using that new OS? Compatibility problems? Setting up specialized software?

            Still probably cheaper than having your entire network (and all corporate data, financial plans, product designs, confidential data, HR information, payroll, etc.) owned by a botnet and copied to who-knows-where.

          • by salesgeek (263995)

            System hardening is more cost-effective decision

            Says who? On what basis? Yes, changing OS is disruptive, but it solves the problem of malware in near finality. Personally, I made the jump this year, and have not lost a single day to malware or OS issues. I can still run Windows apps when needed (hello VirtualBox), but don't have to for the basics: email, web, word processing, etc... VirtualBox in many ways is a padded cell to Windows insanity.

            Reimaging is all fine and good until the guy in accounting ca

            • All of my posts are coming off as anti-linux, and I'm not. I've tried to push it but nobody moves on it.

              In the place I work for, we tell users ALWAYS put your files on your network shares. We don't back up your data before we reimage it because you went to a website that is not work relevant or got a virus for plugging in your brothers thumb drive with virus embedded in U3. It's proven to work well here, and if they do tell me that they need something backed up, I pop in my Knoppix thumbdrive, back it up, a

          • Personally, I'd balance those "retraining" costs against the potential cost of having some careless person infect your corporate network and then having to deal with the fallout.

            Sure, there are companies that have the need to run specific applications that (today) only work in a Windows environment. But the VAST majority of office drones out there are basically using Microsoft Office, a mail client, and a web browser. Migrating that typical user to Openoffice + some non-Outlook client + Firefox is not THA

          • Ah yeah, the ol' "retraining" argument. That one's always been hilarious to me. Like users "know" Windows either?

            They don't. The vast majority of people don't "know" Windows -- they know how to click a few icons, the locations of which they've memorized, so they can launch applications -- usually really generic ones. If you move their icons around suddenly it's "HEY MY OUTLOOK DISAPPEARED" and "I CAN'T FIND THE H DRIVE!" And if you ask them to do anything in Windows beyond opening and using those f
            • Heck, just configure it with one of the default Windows desktop backgrounds and you might not need to retrain at all... ;-)
            • Re: (Score:3, Insightful)

              by anagama (611277)

              I agree with you on the point that most people use computers in a rote and unimaginative fashion. However, I think in some respects people do care what program/OS they use, just not for the right reasons.

              For example, a couple weeks ago I saw my new receptionist sitting at her desk with a laptop wedged between herself and the monitor for her desktop. When I asked her what she was doing, she explained that she was entering some data into excel -- a simple two column "item,price" type thing. I told her I wa

        • Re: (Score:2, Funny)

          by elmedico27 (931070)

          Sounds like an awful lot of work. Maybe move to a different OS?

          How is migrating to a completely new OS more work than installing three programs?

          • by camcorder (759720)
            You might install them once, but you need to run them zillion times. At least migrating to another OS would save you from total time spent using an inferior one.
        • by Kokuyo (549451)

          Thanks, I'd like an OS that does what I want.

          And before someone mods me Troll, I'd like to state that I have tried getting used to several versions of Ubuntu and Mandriva. While Mandrive by far had the better experience for me, I still wasted hours and hours to get stuff to work that just works out of the box on XP.

          So while I appreciate Linux as a server OS and while I see many happy people running linux, it just isn't the OS for me.

          Therefore, compared to all the trouble I usually have with linux, this 'awf

          • by PitaBred (632671)
            It sounds like you're trying to treat Linux like it was Windows, but free. The people that have the most problems switching to Linux are those that are Windows power-users. Linux is not Windows [oneandoneis2.org].

            Remember, you're a newbie when you go to Linux, and there are a lot of people (like me) who use it as their only OS, where Windows is relegated to the "toy" system. It is possible. Just gotta change the way you think.
      • Re:Dumbasses (Score:5, Informative)

        by Urd.Yggdrasil (1127899) on Monday March 16, 2009 @12:15PM (#27211667)
        Uhh, what? I have no idea what this "JPG exploit" your talking about is. Conflicker spreads through the MS08-067 [microsoft.com] RPC vulnerability, removable media, and shared folders; nothing to do with IE or jpegs.
      • Re: (Score:2, Informative)

        Internet Explorer still has the JPG exploit unresolved.

        You would be right, except for this patch [microsoft.com] that was released in 2004 shows that you aren't.

      • On a random blog, which was rather legit, I ended up getting redirected to this page:

        Here's the link: hxxp://gowithscan.com/?uid=13100 (malware! warning!)

        It appeared to scan my Windows and find multiple vulnerabilities. Good thing I'm running Linux. Then it proceeded to obnoxiously pop up JS alerts and have me download an install.exe. Major antivirus couldn't find anything wrong with it. I have the file if anyone is interested (submitted it to clamav.org too).

      • Please don't mention "4chan" and "hardened systems" that closely.
  • by Colin Smith (2679) on Monday March 16, 2009 @12:08PM (#27211555)

    Is real evolution. And I don't mean Intelligent Design.

    Look, you're malware authors, you have millions of machines to play with, you could bring the next stage of artificial life to the fore. Think of the recognition, the glory, the girls.

     

    • by tpjunkie (911544)
      Think of the recognition, the glory, Skynet

      There, fixed that for you.
      • Re: (Score:3, Interesting)

        by fm6 (162816)

        You know, the movies never do explain why Skynet hates humanity so much. Any clue?

        • Re: (Score:3, Informative)

          by Tony Hoyle (11698) *

          Actually they do. The humans panicked and tried to switch it off. It retaliated in the only way it could.

          Basically it's pissed off because the humans tried to kill it.

          • by fm6 (162816)

            Is this in one of the movies? If so I missed it. T3 at a guess; the plot was so dumb I probably wasn't paying attention.

        • because it's smart?

  • if it's asking for instructions, why do they have to come from the blackhats? why couldn't someone write an update telling conficker to cease operation and uninstall itself?

    • by patro (104336) on Monday March 16, 2009 @12:16PM (#27211689) Journal

      The worm probably uses encyption, so it doesn't just accept any control message from unknown sources.

    • Re: (Score:3, Interesting)

      by gnick (1211984)

      Because unless you have something to gain (other than a warm feeling that you've done something nice and have helped the world), nobody wants the liability associated with writing an illegal but benevolent worm and releasing it.

      And, you know, having access to the original source code saves some time picking apart obfuscated machine code.

      • Because unless you have something to gain (other than a warm feeling that you've done something nice and have helped the world), nobody wants the liability associated with writing an illegal but benevolent worm and releasing it.

        Oh I'm not sure that there's nothing to gain from it. Does nobody remember the Morris Worm? If that's all I have to do to get a professorship position at MIT, hey, there's something to gain there!

        • by DrVomact (726065)

          Oh I'm not sure that there's nothing to gain from it. Does nobody remember the Morris Worm? If that's all I have to do to get a professorship position at MIT, hey, there's something to gain there!

          Oh, you mean they let Robert Morris out of jail? I kind of assumed he'd be out on parole by now...but I didn't know about the teaching post. Ah, I looked it up...Associate Professor at MIT, no less (http://en.wikipedia.org/wiki/Internet_Worm [wikipedia.org]). And looks like he never had to do any hard time.

          I feel a certain fondness for Morris, because I worked for the same company where he was a summer intern once. Sigh...my brush with fame. You have to give him points for originality: after all, his was the first worm.

    • by Thelasko (1196535) on Monday March 16, 2009 @12:19PM (#27211725) Journal

      why couldn't someone write an update telling conficker to cease operation and uninstall itself?

      Because that would be illegal. [usdoj.gov]

    • by krappie (172561) on Monday March 16, 2009 @01:19PM (#27212819)

      F-secure was one of the first people I'm aware of to register some of the domain names that infected machines try to contact. When people were asking this question, this was their response [f-secure.com].

      On a regular day, our sinkhole sees around 1.5M-2M unique IP addresses that are infected with a various catering of malware: viruses, trojans, bots, worms and so on. Downadup.B is responsible for about 1M-1.3M of those IP addresses. So let me explain what we do with the data first:
      We try to contact the ISP's where the infected IP addresses are coming from and try to get them to notify the customers to take down the infected systems. We also notify various CERT organisations in the countries where the infections are and work with them to get the infected machines offline. We also share some the data with Law Enforcement organizations in those cases where the author of the malware is known. This allows the police to get their hands on real, raw, data on the amount of infections. That data can later be used in court as evidence to get reasonable convictions.

      Now, why won't we automatically disinfect the machines? The reason is simple: we would be knowingly, and with intent, be accessing the infected computer and giving it commands without having a prior permission from the owner. In most countries that equals to unlawful access which gets you an appointment in court. Some laws do weigh things by judging "a greater good", but in this case it does not help. Imagine the world being a huge porcelain store, inside a black box with only two holes for your hands allowing access. You can put your hands in the box but can't see what you're doing. Now, try to remove all the dust without breaking anything...

      There are several things that might go wrong and the consequences could be severe. Imagine if we, while disinfecting, would knock out life support systems in hospitals. Or radar systems in major airfields. Or traffic lights in a major city. Or any other of imaginable and unimaginable scenarios that would be bound to happen taking into consideration the scale of this thing.

      And it doesn't matter where we offered the disinfection from. We are a corporation with presence in various countries. The disinfected victims would be in those countries, suing us there. The place where we caused the damage from does not matter, its the place where the damage happened.

      To make automatic, remote, unwilling disinfection ever possible there is a need for an international treaty. And an internation body of authority that will decide what to disinfect, who to disinfect and when to disinfect. And unfortunately I don't see that one coming in near future. I wouldn't bet foreign militaries or intelligence organizations being too happy about anyone tampering with their systems, regardless of the intent.

      We've had long talks about remotely disinfecting machines and everyone in here is in unanimous vote on not doing it for the above reasons. And don't think it's a happy moment seeing hundreds of thousands, or millions, of machines being infected. Still, we do our best to get them fixed.

      • Re: (Score:3, Funny)

        by Provocateur (133110)

        What's the proper voice to read this in? Comic Book Guy? Morgan (Freeman)? Alan Rickman? There should be a video montage somewhere...please don't leave out Dogs and cats living together!

    • why couldn't someone write an update telling conficker to cease operation and uninstall itself?

      How do you expect to make any money doing that?

  • by neokushan (932374) on Monday March 16, 2009 @12:09PM (#27211585)

    This may be the most complex worm/virus ever made, but is it any more prevalent or hard to remove?
    If I do basic things like keep my Virus definitions and system OS up to date and occasionally scan for spyware, am I still at risk?

    In other words, are the ones at risk the same kinds of people who'd be at risk from a lesser, simpler, worm that essentially spreads via a "click here for free porn!" banner?

    • by Tony Hoyle (11698) *

      Probably not. I suspect a fully patched machine behind a non-broken firewall is reasonably safe (which you would think would be almost everybody, but never understimate the power of human stupidity). I don't know anyone that's had any contact with this worm, only the press hype.. so no idea how prevalent is really is - but I suspect a lot less than the AV companies would like us to believe.

      • Re: (Score:3, Insightful)

        by TheCarp (96830) *

        Well... if you are a malware author....

        the VAST majority of users are not savy. Lets say the 80/20 rule applies, you can do 20% of the work to get 80% of the benefit. Its probably even bigger than that. The point is, you can do a LOT of extra work to get to the small percentage of people who take basic precautions.... then its even more work to get the small percentage of them who take more than basic precautions...

        But... your first cut hit a million nodes... is all that work worth it to bump it up to 1.1 m

  • by lbhuston (1492993) on Monday March 16, 2009 @12:20PM (#27211741) Homepage
    If the payload for all of these infected hosts affects traffic across the Internet, even Linux users may care about this issue. Don't be lulled into apathy, this is a powerful, dynamic and capable threat with some very advanced coding and routines. The developers know how to optimize their threat and squeeze a ton of trouble from its deployment. It now sits in a rather powerful position, depending on how they intend to use it. You can catch scanning hosts on your internal networks using listeners on port 445 from Linux boxes without samba. Tools like netcat or own HoneyPoint applications have proven great at finding active hosts. If you identify any on your environment, remove them immediately. The less zombie systems Conflicker has to utilize, the better!
    • Re: (Score:3, Insightful)

      by Tony Hoyle (11698) *

      Are you likely to? Pretty much any company is going to have a decent firewall and proper IT policies (eg. no USB dongles, no floppies, no anything from outside without prior permission). If a company gets hit the first action should be to fire the IT staff, then hire new ones to clear up the mess.

      Schools/Colleges are the ones that are most vulnerable, followed by home systems (assuming most people are behind a NAT and only numpties would forward every port blindly.. although it's scary how many times I've

    • by pembo13 (770295)

      No, I think I'll enjoy my apathy just fine. When the payload drops my desktops/servers will still work.

  • by davidwr (791652) on Monday March 16, 2009 @12:20PM (#27211753) Homepage Journal

    What are your favorite type of worms?

    *Tape
    *Round
    *Heart
    *Nightcrawlers/earthworms/anything uses for fishing
    *spy/mole/CIA/KGB, including corporate espionage
    *Software/malware
    *German city
    *Eisenia cowboynealia

  • it can cause five tankers in the Ellingson Fleet to capsize.

  • by alukin (184606) on Monday March 16, 2009 @01:41PM (#27213255) Homepage Journal

    Really cool stuff! I want this toy!!! Can't believe that authors support Windows platform only! :)

  • by wealthychef (584778) on Monday March 16, 2009 @01:42PM (#27213279)
    The link in the article does not seem to support the hysterical tone of the summary. It says:

    .
    W32.Downadup.C
    Risk Level 2: Low

  • by Chris Tucker (302549) on Monday March 16, 2009 @02:10PM (#27213883) Homepage

    ...Anthem!

    Botnets, worldwide botnets.
    What kind of boxes are on botnets?

    Compaq, HP, Dell and Sony, TRUE!
    Gateway, Packard Bell, maybe even Asus, too.

    Are boxes, found on botnets.
    All running Windows, FOO!

    -------

    Why, yes, I AM a smug bastard who's running Mac OS X. Thanks for asking!

You will be successful in your work.

Working...