Conficker Worm Asks For Instructions, Gets Update 285
KingofGnG writes "Conficker/Downup/Downadup/Kido malware, that according to Symantec 'is, to date, one of the most complex worms in the history of malicious code,' has been updated and this time for real. The new variant, dubbed W32.Downadup.C, adds new features to malware code and makes the threat even more dangerous and worrisome than before."
coward (Score:4, Funny)
FIRST! now.. where do i get that update ?
Updates? (Score:3, Funny)
Who care? (Score:5, Funny)
I run Linux! http://xkcd.com/272/ [xkcd.com]
I do (Score:5, Funny)
I run VMWare on Linux! http://xkcd.com/350/ [xkcd.com]
Re: (Score:2)
Re:I do (Score:4, Funny)
http://xkcd.com/493/
isn't he great ? XD
Re: (Score:3, Funny)
I run Conflicker.
Re: (Score:2)
Last week? The year is currently 2009.
*chomp*
Re:Who care? (Score:4, Informative)
Apache while an important application is NOT Linux.
Re: (Score:2)
Re:Who care? (Score:4, Funny)
What do you blaim your inability to read the mandatory preview on?
Re:Who care? (Score:5, Funny)
What do you blaim your inability to read the mandatory preview on?
I'm American, I don't have time to make sure I'm correct before spouting off at the mouth.
Re:Who care? (Score:5, Funny)
What do you blaim your inability to read the mandatory preview on?
Whatever we can blame yours on, I suppose!
Re:Who care? (Score:5, Informative)
Apache while an important application is NOT Linux.
Very few Windows viruses attack the Windows kernel.
Linux, the kernel, is one thing, and immune to an Apache exploit. Linux, the OS, generally includes Apache.
ZOMFG!!! (Score:3, Insightful)
a linux virus infected 3500 machines 7 years ago!?
man, you put me to silence about win-vs-linux security!
I will instantly stop mocking windows for the dozens of botnets that spawn every day and have several hundred million PCs infected so far and infect tens of thousands of PCs every day...
Re: (Score:3, Insightful)
Re:UAC doesn't hold a candle to linux permissions (Score:5, Insightful)
Windows permissions are quite fine-grained. They're much more flexible than POSIX permissions--comparable to ACLs, in fact, which fewer people use on Linux.
The problem isn't the permission scheme at all, but a combination of legacy, a ruthless dedication to backwards compatibility, and lazy software developers who don't understand the guidelines that Microsoft (now) sets forth regarding secure development from their platform. Maybe throw in a dash of OEMs setting people to administrator by default, but until the other stuff is fixed, that's the only way that they're going to sell any computers.
That said, UAC is a lot like requiring sudo without a password, except that in theory, a user process can't automatically click "ok" for you.
Re: (Score:3, Informative)
I once used Windows XP in that mode. Where everything and its dog was locked down by the ACLs. It was pretty nice to know that a virus could really only frag my (backuped) user account. But it was a pain in the ass for configuration and installation. Mostly because the programs were not made for it. They did not expect something to be locked down at all. Even internal Microsoft programs. So you very often got crashing programs and the like, because they hiccuped on a non-accessible resource.
But then I reali
Re: (Score:3, Funny)
I once used Windows XP in that mode. Where everything and its dog was locked down by the ACLs. It was pretty nice to know that a virus could really only frag my (backuped) user account.
I know you meant "backed-up," but now I'm picturing a creature that walks with its back.
Re: (Score:3, Interesting)
The last time I tried to lock down windows boxes and user accounts, it all came to a screeching halt because the accounting people had to have Quickbooks and Quickbooks absolutely would not run any time it decided (seemingly randomly) that it just had to modify it's own .exe with an update before it could even conceive of doing anything else ever again.
Net result, either make the most security sensitive app in the organization vulnerable full time, make everything vulnerable part time by giving the office p
Re: (Score:2, Insightful)
UAC is a lot like requiring sudo without a password
Thank you. That explains just about everything right there.
Re: (Score:3, Insightful)
Re: (Score:2, Insightful)
This is not an OEM issue -- MS does this also. If you get an MS XP installation disk, install it and add users, the users will be Administrators. In fact, MS has made things more difficult since WIn2k -- under XP, the only options under the Contol Panel "Users" dialog are "Limited User" or "Administrator". Finding the option to exercise a more fine-grained control over user permissions is difficult -- most users won't find it at all.
Re: (Score:2, Informative)
That said, UAC is a lot like requiring sudo without a password, except that in theory, a user process can't automatically click "ok" for you.
Actually, according to what I've read (though I've never tried it), you can set UAC to require a password input.
Re: (Score:3, Interesting)
Yes, someone else pointed out that UAC requests a password if you aren't an administrator--which is, of course, correct. I fell into the same trap of assuming that users will be administrators, since that's how things tend to be in the real world (when not in a locked down environment, of course.) Of course, if you're not running as an administrator, the original complaint is moot. UAC is a compromise between making day-to-day users "Limited Accounts" and software which makes bad assumptions.
As a side no
Re: (Score:3)
That's pretty spiffy, actually! I think it might even beat out gksudo, since ctrl-alt-del generates a non-maskable interrupt.
Re: (Score:2)
Unix permissions rule.
They are quite enough for almost all use and easy enough to understand at a glance. It's easy to write "chmod -R a+r-x dir", but I'd hesitate to do this with cacls.exe.
Dumbasses (Score:4, Funny)
If people would stop downloading free_porn.jpg from 4chan, renaming it to free_porn.exe, and running it... we would not be having these problems.
Re: (Score:2, Insightful)
If people would stop downloading free_porn.jpg from 4chan, renaming it to free_porn.exe, and running it... we would not be having these problems.
If people would stop jumping to conclusions and assuming the answer is that simple, we would not be having these problems.
Who modded him insightful? This virus isn't spreading because of people doing something clearly shady, it's because Internet Explorer still has the JPG exploit unresolved. The user can simply view a webpage with a malicious image (which could just be a 1px whitespace) and it executes the malicious code. I've dealt with many computers in the past months since it surfaced.
Solutions? Don't
Re: (Score:2, Insightful)
Sounds like an awful lot of work. Maybe move to a different OS?
Re:Dumbasses (Score:5, Insightful)
Sounds like an awful lot of work. Maybe move to a different OS?
Ok, sure. It's a lot of work if you look at it in a simple fashion of throwing an Ubuntu CD at some user and saying "SUCK LESS THX"
How about the hours that go into training one or many users in a company on using that new OS? Compatibility problems? Setting up specialized software?
System hardening is more cost-effective decision versus switching OSes or having to clean up every computer that comes up with the problem. It takes about two hours at most to do it from scratch on one system image, then you can reimage as many computers that come up with the problem.
Re:Dumbasses (Score:5, Informative)
It takes about two hours at most to do it from scratch on one system image, then you can reimage as many computers that come up with the problem.
Except new holes and malware will keep appearing and the process will need to be done over and over. Add it all up and it's a lot of hours. In the long run it might be cheaper to switch OSs and retrain if that new OS is generally more secure and easier to harden up front.
Re: (Score:2)
Except new holes and malware will keep appearing and the process will need to be done over and over. Add it all up and it's a lot of hours. In the long run it might be cheaper to switch OSs and retrain if that new OS is generally more secure and easier to harden up front.
Group policy scripts can have new hosts files downloaded and put in place, antivirus updates can patch holes, etc.
I'm 100% with trying to move Open Source, and I'm trying to push an Edubuntu lab in this district but it's a lot of work to apply it to the administrative systems.
Re:Dumbasses (Score:4, Insightful)
>>How about the hours that go into training one or many users in a company on using that new OS? Compatibility problems? Setting up specialized software?
Still probably cheaper than having your entire network (and all corporate data, financial plans, product designs, confidential data, HR information, payroll, etc.) owned by a botnet and copied to who-knows-where.
Re: (Score:2)
System hardening is more cost-effective decision
Says who? On what basis? Yes, changing OS is disruptive, but it solves the problem of malware in near finality. Personally, I made the jump this year, and have not lost a single day to malware or OS issues. I can still run Windows apps when needed (hello VirtualBox), but don't have to for the basics: email, web, word processing, etc... VirtualBox in many ways is a padded cell to Windows insanity.
Reimaging is all fine and good until the guy in accounting ca
Re: (Score:2)
All of my posts are coming off as anti-linux, and I'm not. I've tried to push it but nobody moves on it.
In the place I work for, we tell users ALWAYS put your files on your network shares. We don't back up your data before we reimage it because you went to a website that is not work relevant or got a virus for plugging in your brothers thumb drive with virus embedded in U3. It's proven to work well here, and if they do tell me that they need something backed up, I pop in my Knoppix thumbdrive, back it up, a
Re: (Score:2)
Personally, I'd balance those "retraining" costs against the potential cost of having some careless person infect your corporate network and then having to deal with the fallout.
Sure, there are companies that have the need to run specific applications that (today) only work in a Windows environment. But the VAST majority of office drones out there are basically using Microsoft Office, a mail client, and a web browser. Migrating that typical user to Openoffice + some non-Outlook client + Firefox is not THA
Re: (Score:2)
They don't. The vast majority of people don't "know" Windows -- they know how to click a few icons, the locations of which they've memorized, so they can launch applications -- usually really generic ones. If you move their icons around suddenly it's "HEY MY OUTLOOK DISAPPEARED" and "I CAN'T FIND THE H DRIVE!" And if you ask them to do anything in Windows beyond opening and using those f
Re: (Score:2)
Re: (Score:3, Insightful)
I agree with you on the point that most people use computers in a rote and unimaginative fashion. However, I think in some respects people do care what program/OS they use, just not for the right reasons.
For example, a couple weeks ago I saw my new receptionist sitting at her desk with a laptop wedged between herself and the monitor for her desktop. When I asked her what she was doing, she explained that she was entering some data into excel -- a simple two column "item,price" type thing. I told her I wa
Re: (Score:2, Funny)
Re: (Score:2)
Re: (Score:2)
Thanks, I'd like an OS that does what I want.
And before someone mods me Troll, I'd like to state that I have tried getting used to several versions of Ubuntu and Mandriva. While Mandrive by far had the better experience for me, I still wasted hours and hours to get stuff to work that just works out of the box on XP.
So while I appreciate Linux as a server OS and while I see many happy people running linux, it just isn't the OS for me.
Therefore, compared to all the trouble I usually have with linux, this 'awf
Re: (Score:2)
Remember, you're a newbie when you go to Linux, and there are a lot of people (like me) who use it as their only OS, where Windows is relegated to the "toy" system. It is possible. Just gotta change the way you think.
Re:Dumbasses (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
I really wish you would upload a sample someplace because I have never heard of anything like this. The last widely exploited image file based exploits that I know of was the ANI and WMF vulnerabilities, and those have been patched a while ago.
When I get home this evening I'll reply to this with it, I can't get onto the message board I found it in.
Re: (Score:2)
I got a sneaking suspicion this guy has windows update completely disabled, and it still using XP with no service packs because he "can't trust" Microsoft updates.
Sounds like you've been reading too much of TheDailyWTF. I sound like a lying jackass right now because I can't provide an example, but once I get home I'll reply with one.
Re: (Score:2)
It exists, but I'm not sure of the details - I do know there have been a few jpegs on the wow forums in the last few months with a payload on them, and some have been caught out before the image was deleted.
Re: (Score:2)
Re: (Score:2)
You mean like the cornflicker people???
Re: (Score:2)
Re: (Score:2)
the JPG exploit is actually an old one (I thought even ms got this exploit in sp2 or something like that) and is really easy. Basically you take a jpg image , open it with a file compression app and then drop your payload in. When the Image is loaded, the payload is executed, effectively infecting systems. ...
Now, granted there is a little more to it than that, however that is the basics of the jpg exploit and how it works.
I'm sure there must be "a little more to it than that", because what you've said so far doesn't make sense. What does it mean to "open a JPG image with a file compression app"? I open WinZip and put the file in a new archive? Then I add some malicious program to the zip file? I don't see how this would work. If I execute the zip file, WinZip opens up and shows me that the archive file contains a jpg and some mysterious program. Why would I run the program? Why would loading the jpg image run the program? Or
Re: (Score:2, Informative)
Internet Explorer still has the JPG exploit unresolved.
You would be right, except for this patch [microsoft.com] that was released in 2004 shows that you aren't.
Re: (Score:3, Informative)
Hahaha then too,
but my guess is that spazztastic is referring to ms09-002
http://milw0rm.com/video/watch.php?id=96 [milw0rm.com]
Re:Dumbasses (Score:5, Funny)
milw0rm.com Mothers I'd Like to Worm?
Just got hit by a .exe with adblock+ on (Score:3, Interesting)
On a random blog, which was rather legit, I ended up getting redirected to this page:
Here's the link: hxxp://gowithscan.com/?uid=13100 (malware! warning!)
It appeared to scan my Windows and find multiple vulnerabilities. Good thing I'm running Linux. Then it proceeded to obnoxiously pop up JS alerts and have me download an install.exe. Major antivirus couldn't find anything wrong with it. I have the file if anyone is interested (submitted it to clamav.org too).
Re: (Score:2)
What I want to see in worm development (Score:4, Funny)
Is real evolution. And I don't mean Intelligent Design.
Look, you're malware authors, you have millions of machines to play with, you could bring the next stage of artificial life to the fore. Think of the recognition, the glory, the girls.
Re: (Score:2)
There, fixed that for you.
Re: (Score:3, Interesting)
You know, the movies never do explain why Skynet hates humanity so much. Any clue?
Re: (Score:3, Informative)
Actually they do. The humans panicked and tried to switch it off. It retaliated in the only way it could.
Basically it's pissed off because the humans tried to kill it.
Re: (Score:2)
Is this in one of the movies? If so I missed it. T3 at a guess; the plot was so dumb I probably wasn't paying attention.
Re: (Score:3, Informative)
It was explained in T2.
Re: (Score:2)
why couldn't the instructions come from whitehats? (Score:2, Interesting)
if it's asking for instructions, why do they have to come from the blackhats? why couldn't someone write an update telling conficker to cease operation and uninstall itself?
Re:why couldn't the instructions come from whiteha (Score:5, Informative)
The worm probably uses encyption, so it doesn't just accept any control message from unknown sources.
Re: (Score:3, Interesting)
Because unless you have something to gain (other than a warm feeling that you've done something nice and have helped the world), nobody wants the liability associated with writing an illegal but benevolent worm and releasing it.
And, you know, having access to the original source code saves some time picking apart obfuscated machine code.
Re: (Score:2)
Because unless you have something to gain (other than a warm feeling that you've done something nice and have helped the world), nobody wants the liability associated with writing an illegal but benevolent worm and releasing it.
Oh I'm not sure that there's nothing to gain from it. Does nobody remember the Morris Worm? If that's all I have to do to get a professorship position at MIT, hey, there's something to gain there!
Re: (Score:2)
Oh I'm not sure that there's nothing to gain from it. Does nobody remember the Morris Worm? If that's all I have to do to get a professorship position at MIT, hey, there's something to gain there!
Oh, you mean they let Robert Morris out of jail? I kind of assumed he'd be out on parole by now...but I didn't know about the teaching post. Ah, I looked it up...Associate Professor at MIT, no less (http://en.wikipedia.org/wiki/Internet_Worm [wikipedia.org]). And looks like he never had to do any hard time.
I feel a certain fondness for Morris, because I worked for the same company where he was a summer intern once. Sigh...my brush with fame. You have to give him points for originality: after all, his was the first worm.
Re:why couldn't the instructions come from whiteha (Score:5, Informative)
why couldn't someone write an update telling conficker to cease operation and uninstall itself?
Because that would be illegal. [usdoj.gov]
Re:why couldn't the instructions come from whiteha (Score:4, Funny)
Now that is something BBC should take care of.
Re:why couldn't the instructions come from whiteha (Score:5, Informative)
F-secure was one of the first people I'm aware of to register some of the domain names that infected machines try to contact. When people were asking this question, this was their response [f-secure.com].
Re: (Score:3, Funny)
What's the proper voice to read this in? Comic Book Guy? Morgan (Freeman)? Alan Rickman? There should be a video montage somewhere...please don't leave out Dogs and cats living together!
Re:why couldn't the instructions come from whiteha (Score:2)
why couldn't someone write an update telling conficker to cease operation and uninstall itself?
How do you expect to make any money doing that?
Ok, so for the uninformed.... (Score:4, Interesting)
This may be the most complex worm/virus ever made, but is it any more prevalent or hard to remove?
If I do basic things like keep my Virus definitions and system OS up to date and occasionally scan for spyware, am I still at risk?
In other words, are the ones at risk the same kinds of people who'd be at risk from a lesser, simpler, worm that essentially spreads via a "click here for free porn!" banner?
Re: (Score:2)
Probably not. I suspect a fully patched machine behind a non-broken firewall is reasonably safe (which you would think would be almost everybody, but never understimate the power of human stupidity). I don't know anyone that's had any contact with this worm, only the press hype.. so no idea how prevalent is really is - but I suspect a lot less than the AV companies would like us to believe.
Re: (Score:3, Insightful)
Well... if you are a malware author....
the VAST majority of users are not savy. Lets say the 80/20 rule applies, you can do 20% of the work to get 80% of the benefit. Its probably even bigger than that. The point is, you can do a LOT of extra work to get to the small percentage of people who take basic precautions.... then its even more work to get the small percentage of them who take more than basic precautions...
But... your first cut hit a million nodes... is all that work worth it to bump it up to 1.1 m
When the payload drops, even Linux users care! (Score:5, Insightful)
Re: (Score:3, Insightful)
Are you likely to? Pretty much any company is going to have a decent firewall and proper IT policies (eg. no USB dongles, no floppies, no anything from outside without prior permission). If a company gets hit the first action should be to fire the IT staff, then hire new ones to clear up the mess.
Schools/Colleges are the ones that are most vulnerable, followed by home systems (assuming most people are behind a NAT and only numpties would forward every port blindly.. although it's scary how many times I've
Re: (Score:2)
No, I think I'll enjoy my apathy just fine. When the payload drops my desktops/servers will still work.
Favorite worm poll (Score:4, Funny)
What are your favorite type of worms?
*Tape
*Round
*Heart
*Nightcrawlers/earthworms/anything uses for fishing
*spy/mole/CIA/KGB, including corporate espionage
*Software/malware
*German city
*Eisenia cowboynealia
Maybe now.... (Score:2)
it can cause five tankers in the Ellingson Fleet to capsize.
Google Cache Link (Score:3, Informative)
Does it work under Linux? I want this toy! :) (Score:4, Funny)
Really cool stuff! I want this toy!!! Can't believe that authors support Windows platform only! :)
dangerous and worrisome? threat level 2 (Score:4, Interesting)
.
W32.Downadup.C
Risk Level 2: Low
Time for another chorus of the Botnet National... (Score:3, Funny)
...Anthem!
Botnets, worldwide botnets.
What kind of boxes are on botnets?
Compaq, HP, Dell and Sony, TRUE!
Gateway, Packard Bell, maybe even Asus, too.
Are boxes, found on botnets.
All running Windows, FOO!
-------
Why, yes, I AM a smug bastard who's running Mac OS X. Thanks for asking!
Re:Nitpick... (Score:4, Informative)
Maybe I'm being picky here, but why does Slashdot's icon for this story depict a caterpillar? Don't the editors know the difference between a caterpillar and a worm?
It's an inchworm [wikipedia.org].
Re: (Score:2, Interesting)
It's an inchworm.
Which is a caterpillar.
But that's ok. Pictures of worms are so damn hard to find.
Re: (Score:2)
But the caterpillar is called an inchworm. Look - the category isn't about earthworms (or any other long, soft-bodied critters). It's about computer code. Picking an inchworm as a graphical representation of that code is just as valid as any other "worm" imagery.
I understand the curiosity factor if you didn't know the image was an inchworm and instead you wondered what catapillers have to do with computer worms. But now that the correlation has been demonstrated, any further complaint is just being inte
Re:Nitpick... (Score:5, Funny)
It's an inchworm [wikipedia.org].
That's what SHE said!
Re:Nitpick... (Score:5, Funny)
Maybe I'm being picky here, but why does Slashdot's icon for this story depict a caterpillar? Don't the editors know the difference between a caterpillar and a worm?
That's why it's so dangerous. It mutated
Re: (Score:2, Funny)
You're worried about the worm/caterpillar when there's a *stapler* underneath?
Re: (Score:2)
So that's why the second icon showed up as a broken image, viewing the page from here in Vancouver. We've had a serious crack-down on those dangerous weapons [google.com] around here recently.
Re: (Score:2)
Re: (Score:2)
Ok fine... Conficker/Downup/Downadup/Kido/something else malware, that according to Symantec...
Re: (Score:2)
Aww, give it a few more years and it will probably name itself!
Re: (Score:3, Interesting)
I am with you on that one, Linux would not be so susceptible as windows, although they have their own rootkits, but you get alot of programs (such as tripwire) that let you know when something is wrong,
and then just recompile that particular program.
As for windows, once your win32.dll has been rooted, then you cant turn around and do the same without reinstalling a whole slew of other things, thereby changing the installation, sometimes breaking patches or updates...
I say lets all move to linux for the desk
Re:Damn (Score:5, Insightful)
It continually amuses me how the mainstream media managed to censor the name of this worm. It was originally conficker, which is slang/shorthand for 'configuration file fucker', but using the German fick instead. It was also known as 'downandup' as in the hip motion; both clearly sexual references. Since any kind of indirect reference to sex gets you scrutiny and/or shunning from the Moral Majority, suddenly we have 'downadup'.... So much better?
Re: (Score:3, Informative)