Stories
Slash Boxes
Comments
typodupeerror delete not in
  • Preferences

Comments: 95 +-   After 1 Year, Conficker Infects 7M Computers on Friday October 30, @07:04PM

Posted by Soulskill on Friday October 30, @07:04PM
from the happy-anniversary-now-run-an-antivirus dept.
security
worms
windows
technology
alphadogg writes "The Conficker worm has passed a dubious milestone. It has now infected more than 7 million computers, security experts estimate. On Thursday, researchers at the volunteer-run Shadowserver Foundation logged computers from more than 7 million unique IP addresses, all infected by the known variants of Conficker. They have been able to keep track of Conficker infections by cracking the algorithm the worm uses to look for instructions on the Internet and placing their own 'sinkhole' servers on the Internet domains it is programmed to visit. Conficker has several ways of receiving instructions, so the bad guys have still been able to control PCs, but the sinkhole servers give researchers a good idea how many machines are infected."
story

Related Stories

Submission: After 1 year, Conficker infects 7M computers by alphadogg (971356)
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

After 1 Year, Conficker Infects 7M Computers 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Ding! (Score:5, Funny)

    by Mazda6s (904056) on Friday October 30, @07:07PM (#29930609)
    Gratz

  • Cleaning job (Score:2, Interesting)

    by Acapulco (1289274)
    Is there a way for the researchers to use the sinkhole to clean the worm?

    Maybe they can inject instructions to the worm so it shutsdown but not before it spreads the "fix" to other computers? So along counting the number of PC's infected they also help in cleaning the worm. Impossible?

    • Re:Cleaning job (Score:5, Informative)

      by Anonymous Coward on Friday October 30, @07:15PM (#29930671)

      Maybe they can inject instructions to the worm so it shutsdown but not before it spreads the "fix" to other computers?

      Conficker is notable because it isn't a total piece of script kiddie crap. It uses asymmetric crypto to only accept instructions from the creator. It also patches the hole on the way in, so you couldn't even reinfect Conficked boxes with a cleaner.

      • I wonder, how much resources it will take to crack the crypto, say if the govt or the NSA wants to do it?

        • Re:Cleaning job (Score:4, Informative)

          by migla (1099771) on Friday October 30, @07:40PM (#29930879)

          That would depend on whether the authors chose encryption that could be decrypted in a billion years with the combined computing power of today or if they chose some smaller number or a larger one.

          • Or a few seconds if you believe D-Wave [dwavesys.com]. (Don't believe D-wave, it's a well-funded scam.)

            • How exactly is it a scam? By not elaborating I think you're actually just doing them a favour, because 1) it is possible to crack encryption incredibly fast with quantum computers, and 2) they are developing quantum computers. So all you've made me think is "cool".

              • Re: (Score:3, Informative)

                by Interoperable (1651953)
                They have yet to demonstrate that their device is capable of quantum computation. Rather than address that they've made it compute with larger registers of bits but don't seem to have ever verified that an "answer" from it is correct; it could be spitting out classical random numbers for all anyone knows. Furthermore, the guys who developed the theory for an adiabatic quantum computer (the type of computer that D-Wave is making) say D-Wave doesn't seem to understand the theory and can't possibly be making t

      • Re: (Score:3, Insightful)

        by shentino (1139071)

        It's not just that.

        Being a good samaratin like that often fails because of the risk you'll mess up and get slammed with a lawsuit. Simply by participating in the affair you become jointly and severally liable if anything goes wrong.

        • Re: (Score:2)

          by xant (99438)

          From my easy chair, and sitting in front of my uninfectable Linux computer, I say go for it and clean those suckers up. (Once you figure out how, that is.) We're all rooting for you!

          Oh, but you might want to do it anonymously.

          • Just to preempt the trolls: "ZOMG, LINUX ALSO HAS A FEW BOTNETS"

            There, done, it was barely a a thousandth of a %. This is probably 2%.

        • Re: (Score:3, Interesting)

          by Runaway1956 (1322357) *

          I would cite the various "good samaritan" laws, as well as implied consent. The braindead gave implied consent to have viral infections cleaned from their computers by having an infection to start with.

          FFS - everyone worries about being sued, so they do nothing. You bet your arse, if I were smart enough to program the virus to self destruct, I would do so in an instant. No thoughts about being sued, period.

    • Re: (Score:3, Funny)

      by linguizic (806996)
      Wasn't that an episode of Stargate SG-1?

      • Re:Cleaning job (Score:4, Funny)

        by migla (1099771) on Friday October 30, @07:35PM (#29930837)

        I don't know if that was an episode of SG1, but you sig does remind me of Agatha Christie.

      • No, computer virii in SG-1 don't need a network connection.

        •     The one that infected all the stargates did. It was .. aw heck .. the last Goa'uld guy. The mediocre badguy. It used the stargates automatic update network to reprogram all the gates. They used that plot device twice. The others that they had in the show propagated what ever way was easy to show. Didn't one go through the power lines?

             

    • Re:Cleaning job (Score:5, Informative)

      by icebike (68054) on Friday October 30, @07:46PM (#29930921)

      Is there a way for the researchers to use the sinkhole to clean the worm?
       

      Probably not.

      But YOU CAN HELP:

      Just Click the the CornFlicker Eye Chart to test your machine:

      http://www.confickerworkinggroup.org/infection_test/cfeyechart.html [confickerw...ggroup.org]

      You can read about it in the link posted in TFA.

      • Re:Cleaning job (Score:5, Funny)

        by dangitman (862676) on Friday October 30, @10:32PM (#29931913)

        Probably not.
        But YOU CAN HELP:
        Just Click the the CornFlicker Eye Chart to test your machine:

        Do you think I'm some kind of patsy? I'm not getting suckered into your virus propagation scam!

        • Re: (Score:2)

          by icebike (68054)

          LOL...

          Wise move.

          That's why I referred you to the same link at
          the side of panel of the Linked page in TFA.

    • Re: (Score:3, Insightful)

      by buchner.johannes (1139593)

      Is there a way for the researchers to use the sinkhole to clean the worm?
      Maybe they can inject instructions to the worm so it shutsdown but not before it spreads the "fix" to other computers? So along counting the number of PC's infected they also help in cleaning the worm. Impossible?

      If you just sniff traffic, that doesn't mean you can inject instructions. And even if, how do you make sure *you* don't ruin the users computers? It is a ethical problem as soon as you mess with other peoples machines; These Botnet hijackers [youtube.com] explain that too.
      So, no, researchers are not going to do that. Also, too complex technically.

    • I think there is one way (Score:3, Interesting)

      by xant (99438)

      Figure out how to trace a significant percentage of those IPs to their IP blocks to their ISPs. Notify the ISPs. Start a coalition among them to shut off infected customers with a message explaining why and how to fix. Start an advertising campaign to get public support for this and help pressure ISPs to join even though it is not in their short-term self-interest; sell it to them as good PR at this point. Ask them to send a coupon to customers who disinfect, with prorated hours to reimburse the custom

    • It is likely a legal liability that would crush the researchers. Even if Conficker did the damage the researchers could be held liable because the courts have juries of non-technical people to render "justice". This is why many many technical lawsuits get settled at the last minute. The balance of evidence is continually weighed and after it reaches some presumed tipping point the parties settle. (Well the big guys, small fry are just outspent and they lose).

      I'd love to have a reverse DNS service that retu

  • Action not words! (Score:2, Insightful)

    by basketcase (114777)

    Are these researchers doing anything about it? Have they handed the IP lists with timestamps over to the appropriate ISPs or corporate network administrators so that the infected systems can be dealt with? Did they even put up a page where you can check yourself or your network?

    Merely counting the infected is nothing but mental masturbation. Even the lame government census has moved beyond simply counting.

  • I'm safe! (Score:5, Funny)

    by dword (735428) on Friday October 30, @07:22PM (#29930731)
    I've read that Antivirus 2009 removes conflicker, so I have installed it. Now I have to get rid of the other viruses I'm getting warnings about and for that I only need
    • Cyber Security
    • Alpha Antivirus
    • Braviax
    • Windows Police Pro
    • Antivirus Pro 2010
    • PC Antispyware 2010
    • FraudTool.MalwareProtector.d
    • Winshield2009.com
    • Green AV
    • Windows Protection Suite
    • Total Security 2009
    • Windows System Suite
    • Antivirus BEST
    • System Security
    • Personal Antivirus
    • System Security 2009
    • Malware Doctor
    • Antivirus System Pro
    • WinPC Defender
    • Anti-Virus-1
    • Spyware Guard 2008
    • System Guard 2009
    • Antivirus 2010
    • Antivirus Pro 2009
    • Antivirus 360
    • MS Antispyware 2009

    or

    • A Unix-based operating system (such as OS X or Ubuntu)
    • Or the abacus!

    • Please somebody mod parent as funny. I don't want anyone reading it to think that that spyware is ACTUALLY a virus remover.... :(

    • Re: (Score:2, Insightful)

      by icebike (68054)

      Half the things you listed are malware themselves.

      But your point is well taken regarding just about any flavor of Linux or OSX.

      When Windows 7, fresh out of the box from Redmond nags you go get an antivirus that says something right there.

      First it says Microsoft has no confidence in the ability of this version to stop any malware.

      Second it transfers blame to a sketchy industry that had grown up based on a dodgy OS, and actually lobbied Microsoft not to lock them out, demanding the same holes in the OS that a

      • Re:I'm safe! (Score:5, Informative)

        by dword (735428) on Friday October 30, @08:33PM (#29931207)
        <quote>Half the things you listed are malware themselves.</quote>
        Half? They're ALL malware (except for the last one, of course ;)

        Signed,
        Proud and happy user of Windows 7, OS X and Ubuntu

      • " ... Half the things you listed are malware themselves. ..."

        Actually, every one is malware. He was trying to make a point ... or a joke ... or both.

    • Re: (Score:2, Insightful)

      by CannonballHead (842625)
      So, you're saying users can't download malware and install on Unix based systems? Why not? The system protects users from installing software?

      • Re:I'm safe! (Score:4, Informative)

        by thePowerOfGrayskull (905905) on Friday October 30, @08:18PM (#29931133) Homepage Journal
        Argue all you want, but you can't deny that such malware is a whole lot less likely to download and install itself on a Unix-based system.

      • The system protects users from installing software?

        Linux does or at least makes it quite complicated to do so. Its one of the nice side-effects of having a package management system, that is incapable of handling non-root installations and doesn't have real support for third-party software, forcing the average user to pick all their software from the distributions repository instead of random webpages.

        If a user manually adds new repositories or goes onto manually ./configure && make'ing things, than he is of course no better of then in Windows.

  • Not really 7m at all (Score:5, Informative)

    by Yobgod Ababua (68687) on Friday October 30, @07:27PM (#29930775)

    Everyone should read the original page, particularly the Introduction and section explaining how to interpret their population numbers.
    Here's a relevant quote:

    "The daily numbers should represent the potential maximum level of the infection, but in previous test cases usually prove to be much less than that maximum. So, take the range of 25% to 75% of the values that we display as the possible infection population and you will be close to the real value."

    So the people actually providing these numbers are really saying that the current number of infections is likely to be between 1,750,000 and 5,250,000.

  • Conflicker? (Score:3, Funny)

    by gmuslera (3436) on Friday October 30, @08:03PM (#29931059) Homepage Journal
    Its name should be Legion by now.

  • Hmm (Score:5, Funny)

    by Anonymous Coward on Friday October 30, @08:13PM (#29931109)

    Conficker broke 7 Million Infections...
    Microsoft just released Windows 7...

    Has anyone ever seen Conficker and Windows 7 in the same room together?

      • Going out of support ... in 5 years ...

        • Re:Good point (Score:4, Insightful)

          by Anonymous Coward on Saturday October 31, @01:07AM (#29932493)

          Second time? Citation needed, seriously.

          Apart from self-contained data loss bugs that corrupt single files or bork their own data, the only difference between them is the identity of the data affected--deleting your user folder is no more or less "destructive" than deleting the Program Files folder or the System32 folder or any other combination of important data.

          More to the point, you have a short and selective memory. On the Windows side, the number of data loss bugs in the Microsoft KB is staggering--many of which far more easily triggered than the Snow Leopard bug (which PC World was unable to reproduce). There have been plenty of famous and significant data loss bugs in Windows' history, like the Windows 98SE shutdown bug, the Windows 2000 ATA bug, and even the Windows XP bug that ate the user data folders, quite similar to the Snow Leopard bug: http://www.v3.co.uk/vnunet/news/2116562/winxp-bug-ate [v3.co.uk].

          How about the similar data loss bug in the Linux kernel a few years ago: http://news.cnet.com/2100-1001-976427.html [cnet.com]. A simple Google search will reveal several more, before and since, in the kernel and in distribution packages.

          Then there's the infamous Mozilla bug that wiped out the entire Program Files directory on Windows: http://www.mozillazine.org/talkback.html?article=4264 [mozillazine.org]

          It's not just user-level software development, either. Just look at Intel's repeated data loss bugs in their SSDs.

          All the big names have let a bug like this slip at one time or another. It's unfortunate, but inevitable.

  • So disappointing (Score:5, Interesting)

    by ndogg (158021) <the.rhorn@[ ]il.com ['gma' in gap]> on Saturday October 31, @02:44AM (#29932769) Homepage Journal

    I know I'm a terrible person for thinking this, but I was really curious about the chaos that was to ensue once Conficker's creators brought the hammer down.

    *sigh*

    Alright, so hell is that way, right? --->

    • Re: (Score:3, Interesting)

      by Civil_Disobedient (261825)

      I was really curious about the chaos that was to ensue once Conficker's creators brought the hammer down.

      The most effective pathogens are the ones that keep their host alive as long as possible, because then they have best chances of re-infecting the healthy. BotNets are no different. If you "bring the hammer down," you lose everything.

      This is the reason why influenza is a far more dangerous killer than, say, Ebola.

  • A computer worm that spreads through low security networks, memory sticks, and PCs without the latest security updates is posing a growing threat to users blitheringly stupid enough [today.com] to still think Windows is not ridiculously and unfixably insecure by design.

    Despite many years’ warnings that Microsoft regards security as a marketing problem and has only ever done the absolute minimum it can get away with, millions of users who click on any rubbish they see in the hope of pictures of female tennis stars having wardrobe malfunctions still fail to believe that taking Windows out on the Internet is like standing bent over in the street in downtown Gomorrah, naked, arse greased up and carrying a flashing neon sign saying “COME AND GET IT.”

    Microsoft cannot believe people have not applied the patch for the problem, just because they keep trying to use Windows Genuine Advantage to break legally-bought systems. “Don’t they trust us?” asked marketing marketer Steve Ballmer.

    Millions of smug Mac users and the four hundred smug Linux users pointed and laughed, having long given up trying to convince their Windows-using friends to see sense. “There’s a reason the Unix system on Mac OS X is called Darwin,” said appallingly smug Mac user Arty Phagge.

    “It can’t be stupid if everyone else runs it,” said Windows user Joe Beleaguered, who had lost all his email, business files, MP3s and porn again. “Macs cost more than Windows PCs.”

    “Yes,” said Phagge. “Yes, they do.”

    Ubuntu Linux developer Hiram Nerdboy frantically tried to get our attention about something or other, but we can’t say we care.

Search
Executive ability is prominent in your make-up.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2010 Geeknet, Inc.