Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Security Worms

New, Stealthy Conficker B++ Worm Discovered 87

Posted by CmdrTaco from the god-i-love-that-name dept.
nandemoari writes "A new variant of the Conficker/Downadup worm has been detected. The worm opens a backdoor on an infected machine and allows hackers remote control of infected PCs. Dubbed Conficker B++ (and not to be confused with Conficker B), the new variant of the worm opens a backdoor with auto-update functionality, allowing a hacker to distribute malware to infected machines. It's difficult to know exactly how long Conficker B++ has been circulating, but researchers first noticed it on February 6 of this year." If this seems familiar to you, it probably is.
This discussion has been archived. No new comments can be posted.

New, Stealthy Conficker B++ Worm Discovered More

New, Stealthy Conficker B++ Worm Discovered

Comments Filter:
  • are they expecting another even better/worse one after this?
    • Whoever created this is still working on it. He's hoping to perfect it soon, and then we'll have Conficker A+.

      • Re:Why only B? (Score:4, Funny)

        by Neon Spiral Injector ( 21234 ) on Wednesday February 25, 2009 @11:09AM (#26982643)

        Then he can sell it on eBay as A++++++++++++++

      • I still think Microsoft should hire these guys to revamp Windows Update.
        • I'd have given a + mod but I have to make some points
          • Verification of update paths is difficult to secure if you're going to permit just anyone from doing it (i.e. a "torrent" style update).
          • A central authentication service, or a distributed-yet-centralised authentication service, is going to be necessary to deal with above step
          • Microsoft have to update an entire OS and package, "worm guy" only has to update a few programs, and if something breaks he doesn't care

          Just a few, but there are a number of issues wi

    • It's like with the USS Enterprise: there are a lot of letters left in the alphabet.

  • Detection (Score:3, Interesting)

    by jetsci ( 1470207 ) on Wednesday February 25, 2009 @11:05AM (#26982593) Homepage Journal
    Anyone know the procedure for detecting these? I imagine A/V companies setup 'honeypots' of sorts on high traffic networks and that but how do you detect something new like this? Do they track it through an old signature?
    • I run a Nepenthes [carnivore.it] box on my network and I get collected hits from a variety of worms every single day. No sign of a Conficker worm trying to blast my net, but if something connects and gets detained, you can take it apart and look at it. Either way, it's pretty useful for tracking different random infected boxes and you could probably create a sig that uniquely identifies it.

  • I'm assuming there's some sort of profit motive behind all this virus writing... is it to generate crappy run-of-network traffic for ad revenue? Identity theft? Extorting money from online businesses by threatening to turn your bot network on them? What?

    • Re:profit motive (Score:5, Funny)

      by Anonymous Coward on Wednesday February 25, 2009 @11:20AM (#26982787)

      Sell anti-virus software.

      • Re:profit motive (Score:5, Interesting)

        by Saint Aardvark ( 159009 ) on Wednesday February 25, 2009 @11:37AM (#26982973) Homepage Journal

        You laugh, but that situation is just what F-Secure describes [f-secure.com] for an unrelated bit of Facebook malware [f-secure.com]. FTFA:

        As we pointed out in yesterday's post, the timing of the Facebook "Error Check System" application and the subsequent Google search results pointing to rogue antivirus sites was almost too perfect to be a coincidence. It's entirely possible that the whole situation was designed to promote XP Antivirus variants such as "Antivirus 360" and "XP Police" (Rogue:W32/XPAntivirus). That's the formula, create something that spawns a search, then be ready to provide results that redirect to malicious sites. Either that or the bad guys are very quick on their feet and are ruthlessly opportunistic.... They're both.

    • Re: (Score:2)

      by Yvanhoe ( 564877 )
      Spam providers exist and will organize your "ad campaign" for a small fee. They need a bot to send millions of mail.
      Scamers and phishers need anonymate also, a botnet can provide this.
      There is also the very possible old-fashion extortion, mafia style.

    • Re:profit motive (Score:5, Insightful)

      by Lord Ender ( 156273 ) on Wednesday February 25, 2009 @11:30AM (#26982907) Homepage

      Botnets can be profitable, however, someone skilled enough to write the malware necessary for botnet creation could likely be making better money in the private sector with a real job and no jail risk (in the US, at least). Most of the stuff I see comes from Eastern Europe or Asia, where law enforcement is unlikely to prosecute and there aren't decent Software industries hiring people with programming talent.

      So they make money by

      • sending spam
      • click-fraud (scamming web advertisers)
      • stealing CC numbers
      • DDoS extortion (yes, european banks have paid botnet owners' extortion demands to avoid getting DoSd.)

      • DDoS extortion (yes, european banks have paid botnet owners' extortion demands to avoid getting DoSd.)

        You'd think large banks would be more able to "follow the money" better than most victims and swing the clout to do something about it once they have.

      • Re: (Score:3, Interesting)

        by stevey ( 64018 )

        That's not necessarily true - I mean the skills required to exploit a known security hole aren't terribly difficult.

        If you're familiar with a small amount of low-level coding you can easily follow cookbook-style tutorials to getting shellcode executed. At that point you're done.

        Sure you need to do some disguising, and you need to understand a bit of crypto to setup a key-verification for downloading updates.

        But I'd expect there are literally millions of coders still kicking around from the 80s/90s who did

        • I disagree with you.

          Point 1: Building and managing a botnet is not just "exploit[ing] a known security hole."

          Point 2: Your statement that computer programming is not "skilled work" is just bizarre.

          Point 3: Your statement that a "significant proportion" of "millions of coders" are unemployed isn't backed up by any evidence I've seen. Unemployment is high right now, but not among programmers.

          • Re: (Score:1)

            by stevey ( 64018 )

            A botnet starts off with one machine, scanning the world for more vulnerable hosts and exploiting them in turn. Sure you'd do better if you were to have a few hundred to start with - but building a botnet, assuming you can create an exploit is almost trivial.

            I wasn't suggesting that computer programming is unskilled, merely that there are no real special skills required to exploit a security hole - which is what you were trying to imply.

            (i.e. Botnet writers are not so amazingly skilled that they would be s

            • Have you actually studied botnets? Especially modern ones like conficker? To build one, you need to get an exploit working, you need to write the virus component so that it spreads, and you need to write the server (bot) component. You must also include some tricks to disable security software, and perhaps implement a code obfuscation process which can't be easily reverse-engineered. On top of all that, you MUST have a sophisticated method for controlling the botnet that is highly scalable, extremely diffic

              • Re: (Score:1)

                by stevey ( 64018 )

                Yes I've studied them, partly because i used to code exploits in the past, and partly out of curiosity.

                I did say initially there are parts to them that require knowledge. The authentication steps to ensure the owner keeps control, and the rootkit components to hide them once installed would probably be the most challenging aspects of the net.

                But none of the pieces are individually hard to code (I've written several of them myself) and while a junior/entry-level programmer might struggle I'm not convinced

                • There is a difference between writing "a few" botnets, and writing one that actually works. Yours didn't work. You didn't have a control channel sophisticated enough to scale and avoid standard security controls.

                  • Re: (Score:1)

                    by stevey ( 64018 )

                    You misunderstand me - I didn't mean to say I've created and released botnets into the wild.

                    I meant that with private networks I've created self-replicating code which actively scanned and infected new hosts and had a sophisticated control mechanism which allowed control, updates, and activities.

                    Still I've either convinced you that writing a bot, and by extension creating a botnet, is not exceptionally difficult - or I haven't.

        • Re: (Score:2)

          by dave562 ( 969951 )

          But I'd expect there are literally millions of coders still kicking around from the 80s/90s who did assembly programming under MS-DOS who would be able to write that kind of code - and because it isn't really really skilled work the chances are high that a significant proportion of those developers are unemployed.

          That's right. I cut my teeth on x86 ASM cracking warez and writing virii. Programming never really grabbed my attention though. All things considered it was much too dry and structured. I didn

  • This is just a passing virus (Score:5, Funny)

    by BadAnalogyGuy ( 945258 ) <BadAnalogyGuy@gmail.com> on Wednesday February 25, 2009 @11:10AM (#26982665)

    No need to worry. I'd be more worried about Conficker C. Lots of opportunities to shoot you in the foot.

    Then someone will undoubtedly create Conficker C++ and everyone will cry about how hard it is to understand and they will all flock to Conficker Java which promises a much cleaner object system.

    But eventually you know that some idiot is going to write Conficker C# which looks suspiciously like Conficker Java, but after a while grows into this gigantic mess of quickfix designs.

    So if you think Conficker B is bad, just wait a while.

  • *ahem* [taps microphone, clears throat again] *ahem*

    And a five, six, seven, eight:

    "Botnets, worldwide botnets.
    What kind of boxes are on botnets?

    Compaq, HP, Dell and Sony, TRUE!
    Gateway, Packard Bell, maybe even Asus, too.

    Are boxes, found on botnets.
    All running Windows, FOO [fu]!"

    =Smidge=

  • Is it just me or has /. been reading like yesterday's news lately?

  • But can it.... (Score:4, Funny)

    by SGDarkKnight ( 253157 ) on Wednesday February 25, 2009 @11:17AM (#26982743)

    cause five tankers in the Ellingson fleet to capsize?

    • "The little boat...flipped over." - Mr. The Plague
      • "A hacker planted the virus"
        -"Is that -?"
        "-That is mr. conflicker B++"
        -"Well then, put our servers under Linux control"
        "There's no such thing anymore, Duke. These computers are fully DRMised. It relies on satalite internet, which links our servers to Redmond"
  • I am feeling very left out, I can't seem to find Conficker B++ or even Conficker B in my yum repository. sigh... It is such a shame that linux is always behind the curve as far as new and exciting features are concerned.

    • I am feeling very left out, I can't seem to find Conficker B++ or even Conficker B in my yum repository. sigh... It is such a shame that linux is always behind the curve as far as new and exciting features are concerned.

      'Coz the distro maintainers refused to include non-opensource binary blob in their repo.

      Make yourself heard. Chances are the malware author is considering opensourcing it too but no one's asking for it so far.

    • Just install Wine and run it through that. /problem>

  • Conflicker B++ should not be confused with Objective Conflicker B. Fortunately, they can easily be distinguished from one another - Objective Conflicker B has many more square brackets.

  • Who is at risk? (Score:2, Informative)

    by Anonymous Coward

    Let's turn this blog positive.

    What current anti-virus solution detects and removes this new variant ?,
    Who is it risk?, people with updated anti virus solutions? or just people who don't use and update them?
    Are people with Linux and OS-X at risk also ? What is the scope of it?
    If Linux and OS-x are not threatened This might be another reason Not to use Windows ?
    The answers to these will help people determine just how big a threat or not this new variant might be, and help them

    • Re: (Score:3, Informative)

      by dave562 ( 969951 )
      The article spells it out. People who haven't applied the security patch that Microsoft released months ago are vulnerable. The rest of the world are just fine. So like usual, it comes down to the poor home users who get screwed while the corporate networks who actually have admins doing their job maintaining them are doing just fine. Luckily things are better and only the subset of home users who don't have automatic updates turned on are screwed.

      • The patch stops the SMB vulnerability, but I believe the USB auto-run is just an executable. There's no vulnerability needed if the OS is going to run the autorun a file as administrator.

        MS should just globally disable autorun. This is getting out of hand. Half of these infections is probably some low-paid tech inserting the same usb drive into his customers computers. That seriously would not surprise me.

  • so if I understand this correctly .... (Score:3, Interesting)

    by nblender ( 741424 ) on Wednesday February 25, 2009 @12:57PM (#26984077)
    We (the global 'we') had a chance to stop conflicker before this version came about; by working with the registrars and/or root nameservers; pre-emptively invalidating each of the algorithmically generated domain names on a day by day basis; preventing cornfucker from updating itself or receiving instructions on how to proceed. The authors noticed that we could do that and before we could think of it, modified it so that once we did think of it; it would be too late....

    I clearly must not understand the intricacies of this....

    My fantasy (because I won't be affected by this) is that once the owners of the botnet are sufficiently happy with their market-share, will instruct cornfucker to encrypt all files on everyone's PC and then wait for the moneh to start rolling in....

  • Proper naming convention, please (Score:3, Interesting)

    by LordSnooty ( 853791 ) on Wednesday February 25, 2009 @01:43PM (#26984669)
    Conficker/Downadup? B? B++? Is it time we had a proper naming scheme for these things? For this instance we've seen several companies getting together to coordinate a response - that's good. But even better, if everyone were to agree on the same name, WE could coordinate our response too.

    And what kind of scheme? Well, how about following the convention of the hurricane trackers? 26 names assigned to each major piece of malware that appears throughout the year. This is a double bonus, as ending the practice of using the authors' chosen names might take away some of that bragging aspect. "Oh, you wrote Malware Julie did you?? Bwahaha"

    • Conficker/Downadup? B? B++? Is it time we had a proper naming scheme for these things?

      You forgot Net-Worm.Win32.Kido.bt

      Well, how about following the convention of the hurricane trackers? 26 names assigned to each major piece of malware that appears throughout the year.

      Malware writers might get sloppy as they vie for the top names, trying to make sure that _their_ malware becomes a headline in just the right time to be named "Thor" or "Linus".

  • I'd like to see an incredibly stealthy virus - one that stays out of the way to the point that it isn't detected for some number of years.

    Have it patch key parts of the Windows kernel to degrade performance in subtle but believable ways...
    Lobotomize the scheduler so that context switches occur much less often than they should for responsiveness.
    Kick up the swappiness from Ridiculous (stock setting) to We've-gone-plaid
    Divide the given buffer length for each I/O operation so that CPU usage goes up and through

Slashdot Top Deals

"Nuclear war can ruin your whole compile." -- Karl Lehenbauer

Close