Using Conficker's Tricks To Root Out Infections 117
iago-vL writes "Despite having their domain blacklisted by Conficker, the folks at Nmap have released version 4.85BETA8, which promises better detection of the Conficker worm. How? By talking to it on its own peer-to-peer network! By sending encrypted messages to a suspect host, the tools will get Conficker.C and higher to reveal itself. This curious case of using Conficker's own tricks to find it is similar to the last method that we discussed. More information from the author is available, as well as a download for the new release (or, if you're a Conficker refugee, try a mirror instead)."
Am I the only one... (Score:5, Interesting)
Re:Am I the only one... (Score:5, Funny)
Re:Am I the only one... (Score:5, Funny)
Sharks are pretty cool too, right up to the point where they start chewing on your leg.
I'd wager that if you're a shark, the "chewing on your leg" part would still be cool.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Guess it would have been a pretty lousy movie if all the shark did was eat seals though......
I think I saw that movie on Discovery Channel once.
Re:Am I the only one... (Score:5, Funny)
Undoubtedly. Everyone knows seals are terrible shots with rifles.
"Guess it would have been a pretty lousy movie if all the shark did was eat seals though......"
I would watch that movie over anything starring Kevin Costner or Ben Affleck any day!!
Comment removed (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
"What if we could feed them to sharks?"
That is a movie I would buy! But do they get fed to the sharks before or after the seals shoot them with handguns? Or maybe they could get shot while being eaten by sharks. Hey Hollywood, we actually have an original idea here for a movie. Pay attention!
Re: (Score:2)
Yeah but they are pretty deadly with handguns ;)
But they're no match for kittens with sniper rifles.
Re: (Score:3, Funny)
Sure, haven't you ever heard of "conseal-carry"?
Re: (Score:1)
Re: (Score:2)
Only if they had sex with each other.
Re: (Score:2)
Re: (Score:1, Insightful)
Is this where the saying "Good from far, far from good" comes into play?
Re: (Score:3, Insightful)
Re:Am I the only one... (Score:5, Insightful)
Seems like you should have spent a small amount of time patching the machines when the security updates were released instead of spending a good amount of time rebuilding them.
Re: (Score:1, Insightful)
Yeah because "IT Professional" means he has (and has always had) full control over all the machines he touches. He couldn't, i don't know, fix customers broken computers as (part of) his job.
Re: (Score:2)
If he's in the Geeksquad, I can see it not being his fault. It also keeps him in a job, and I can definately see a love/hate relation his there. But then, he claimed to be an "IT Professional" and I know that most people who claim to be an "IT Professional" mean they install/admin/maintain computers for a business. If said "IT Professional" doesn't have the pull to make sure a sane security policy is in place, then they get what they deserve and should use this instance to push through a sane security po
Re: (Score:2)
Re:Am I the only one... (Score:5, Informative)
Ok so it doesn't apply to the current round of updates, but I used to admin a server that couldn't be upgraded to 2000 SP4 - trying to do so would cause irreparable damage (Full restore from backup, every single time). It's one thing to abuse an admin for not applying a patch, it's another to be that admin and making sure that adding it will work ok. The only sane security policy in a situation like that is protecting the internal network, but you can't protect a file server from an SMB attack if you need it to be a file server - and if you can't patch it for whatever reason......
If you can't patch it for some reason you fix the reason the patch fails. If that involves a server upgrade to 2003, then so be it. Hell, you mentioned it's an SMB attack and you can't protect against that if you're a file server. While true in a sense, you *can* protect against it by making sure all the non-file servers on the network aren't vulnerable. Make sure you don't use that machine for anything other than the applications you need (certainly don't use it as a terminal server as well). Have a security policy in place that makes it so you can't add vulnerable computers to the network, have a firewall between the company and the internet, etc.
This is something people don't understand until it happens to them, but security is serious business, if you have a server that has a must have application on it and you don't keep that thing #1: Backed up, #2: Up to date with security, you are just waiting for either data loss or time loss on the server.
If you can't afford to replace a server in that condition, then you likely can't afford the IT professional you hired to run it.
Hardware is inexpensive, especially considering you're running on Windows 2000 pre-SP4, you can get a low end server as a replacement and it'll be a very good upgrade. That's not even considering if you can replace with something other than windows or not!
Re: (Score:1, Insightful)
Re: (Score:2)
No, they buy personal jets with TARP funds.
Re: (Score:1)
Re: (Score:2)
Sometimes there are cases where you're using a no-longer-maintained software tool that itself does not work on newer Windows version.
At work we have a Windows NT machine that performs one specific function, the software that performs this function fails on Win2k/XP/Vista - it's THAT old and it's unmaintained.
As a result that machine is firewalled off from the rest of the network.
Re: (Score:2)
Re: (Score:3, Insightful)
Some security updates can break poorly written "Enterprise" software. The kind that PHBs love.
If they hadn't been fully tested with all the "Enterprise" software then he'd be utterly screwed if there were any problems.
Re: (Score:2)
You do realize that Star Trek was fictional, right?
Re: (Score:2)
You do realize that Star Trek was fictional, right?
... but now it's true?
Re: (Score:2)
You do realize that Star Trek was fictional, right?
... but now it's true?
Every second alien ship would take over the computer just by looking at it... yep, an eerily accurate prediction.
Re: (Score:2)
Every second alien ship would take over the computer just by looking at it... yep, an eerily accurate prediction.
Now, is it because Open Source won, or because Microsoft won?
Re: (Score:2, Informative)
Re: (Score:2)
Evil likely pays better. Though the retirement plan sucks.
Evil pays if and only if... (Score:1)
Re: (Score:1)
Re: (Score:2)
Ever wonder how will people act when they see a real mafia guy/boss in their real life and have to deal with him? I mean the people buying "The Godfather Collection" or "The Sopranos"?
Just imagine what can a guy like Tony Soprano can achieve in legit business as he can manage thousands of psychopaths for his own good, on the street.
And, why doesn't Hollywood make a trilogy like "Mother Theresa"? Because nobody would watch it :) People like the evil, watching the evil I mean.
Re: (Score:2)
Lawyers are pretty cool too, right up to the point where they start suing on your ass. I guess it takes distance to gain perspective.
Fixed it for you
Re: (Score:1)
Lucky the conficker authors aren't more like the RIAA.
Re: (Score:2)
That's not the conficker source, that's merely source that perform the same actions as a subset of conficker. You do bring up the interesting point that as its difficult for a virus maker to copyright code, does that make most viruses are public domain?
Re: (Score:1)
I'd love to see the court case whereby a virus writer tried to assert his copyright, or DMCA on methods of disabling his code.
Re: (Score:1)
Re: (Score:1)
Know thy enemy...
Re: (Score:2)
Distance or some simple precautions.
Re: (Score:2)
Re:Am I the only one... (Score:5, Funny)
Re: (Score:2)
I can, GeekSquad usually means drooling moron. I regularly fix GeekSquad screwups for customers. Hell 9 times out of 10 the customers computer is screwed up more after coming back from the IneptSquad.
Re: (Score:2)
Re:Am I the only one... (Score:4, Insightful)
Then you'd procede to nad-kicking.
Comment removed (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
I prefer kicking in the NAD's the executive at that bank that decided to NOT issue all users SecureID keyfobs for their logins. conflicker can capture your login details all day long, if they dont have the secureID information they cant get logged in.
Actually considering today's economy, I think just kicking any bank executive in the Nuts is a perfectly good thing to do.
Re: (Score:2)
That's the wrong way to do it. That's a built-in DoS vulnerability. You should NEVER auto-lockout accounts. The frequency between authentication attempts should be increased with every failed attempt, and multiple failed attempts should alert security personnel (who may decide to block the IP address causing trouble).
Auto-lockout is BAD BAD BAD. I don't care that it's the default config for Windows. You use it, you fail.
Re: (Score:2)
If my bank failed to prevent a brute force attack, I would find their head of security and kick him in the nads.
Somewhere around 25 failed attempts (but probably far less than that), security really becomes more of a concern than convenience.
Happy middle? (Score:2, Funny)
Re:Happy middle? (Score:5, Funny)
Re: (Score:2)
just use netcat like the rest of us, that way you can always 'grep -v funny', when your bladder is full
Re: (Score:3, Interesting)
Yup, damned impressive worm, if you read some of the detailed writeups it really highlights just how professional these things are now.
It's doing us the world of good here - we've got pretty good security already, and getting budget for the next set of steps I want to take should be a whole lot easier now. All I'm having to do is point out just how widely Conficker spread, show some of the big names it hit, and then point out just how long it took them to clean their networks after the fact.
All of a sudden
Re: (Score:1)
You are not alone. I, too, am quite impressed by the efforts of the programmers.
Re: (Score:1)
Re: (Score:1)
No, you're not :)
It's astounding how the group that produces and supports Conficker can do so many things correctly, from cryptographically signed updates distributed P2P to blocking cleaning software and DNS access to antivirus vendors, it's pretty spectacular.
They definitely get the easy way out though, with such a narrowly defined scope. Without having to mess with users' input, GUIs, and all sorts of other peculiarities, it's a lot easier to get your code well-secured with malware than if you were writ
Re: (Score:1, Informative)
Re: (Score:2)
[citation needed]
anyway, imho, if it did happen, the kids fault for:
1) being a dick
2) running an unsecured computer while pretending to know about computers
Protocol (Score:2, Interesting)
What if Conficker D changes its 'protocol' and marks every computer that sends an 'old message' as either a host that needs updating or a nmapping attacker/next victim?
Or... (Score:2, Interesting)
Easiest way to detect if you're infected: see if you can reach nmap.org
Re: (Score:3, Informative)
nmap can scan an entire network though, this is good news, especially if your pen testing and you find the network is full to the brim with bots.
Re:This sounds like a temporary measure... (Score:5, Insightful)
Doesn't this sound like a temporary measure
You say that like you think there's an alternative. There isn't.
The viral ecology is an real ecology, where like all ecologies nothing is stable and everything is temporary.
What this demonstrates, though, is that there are inherent limits to viral capabilities, because with added capability there is added vulnerability. This is true for OS's but it is equally true for viruses (yes, that is a correct English plural, ok?)
So as virus programs get more complex and capable, they will generally also become more open to detection via exploitation of exactly those additional capabilities.
Re: (Score:2)
Viruses which only accept RSA-signed commands can be made more and more capable while being far less vulnerable.
Your reductionism is overdone.
Re: (Score:1)
This just made me think: what if the conficker authors came forward to press charges under the DMCA for reverse engineering their code? Would they have a legal case against the white hats?
Re: (Score:1)
Did you ever stop to think that maybe the original poster isn't from an English speaking country (e.g. America).
Re: (Score:2)
Re: (Score:1)
Offtopic: Due to the rather poor showing many Americans make posting with poor spelling and grammar, its somewhat understandable that one might assume a posting with poor spelling and/or grammer comes from a native English-like language speaker...
Ontopic: Malware sucks. People who write malware and release it into the real world suck. I don't admire them any more than I would admire the perpetrators of a successful act of terrorism resulting in mass murder. A brilliant individual who chooses to use his
Re: (Score:2)
To scan you network quickly for Conficker infections before the next variant breaks this new techinque[sic], we recommend this command:
nmap -p139,445 --script p2p-conficker,smb-os-discovery,smb-check-vulns --script-args checkconficker=1,safe=1 -T4 [target networks]
If you have time for a slower but more comprehensive scan, use this instead:
nmap --script p2p-conficker,smb-os-discovery,smb-check-vulns -p- --script-args checkall=1,safe=1 -T4 [target networks]
Clever but... (Score:5, Insightful)
From TFA:
To scan you network quickly for Conficker infections before the next variant breaks this new techinque, we recommend this command: nmap -p139,445 --script p2p-conficker,smb-os-discovery,smb-check-vulns --script-args checkconficker=1,safe=1 -T4 [target networks]
Now forgive me but people like my parents (running Windows 98 until last year, now on XP) with no idea about security, no anti-virus scanner (despite my lectures over the phone) and no idea what the symptoms of a virus, worm or other malware, are not going to find this information, nor know what to do with it if they did.
Computing professionals might have little trouble detecting and removing Conficker, or are safe in the knowledge that they were protected before its release, but we'll still have to deal with the consequences of a botnet comprised of infected computers belonging to people with little or no technical computer knowledge.
Re:Clever but... (Score:4, Insightful)
Re: (Score:2)
Clearly, your parents don't have a problem. They have a child that can fix things for them.
Sadly for them they raised a lazy and selfish child, and I can't be bothered to manage their computer's security for them, even remotely. At some point my Dad's love of naked chicks will land him in trouble, as there's only so many "Free p0rn" e-mails you can open before something nasty gets you.
Re: (Score:1)
Isn't the biggest problem with worms like Conficker the fact that most of the affected users are totally unaware that they have it.
How can you post a question without a question mark. Does this confuse your brain.
Re: (Score:1)
No?
Re:Clever but... (Score:5, Funny)
1) I started writing a question, got distracted half way through and then finished the sentence as a statement
2) I accidentally put a full stop instead of a question mark
3) Conficker performed a man-in-the-middle attack and messed with my punctuation
You can pick the answer you like best.
Re: (Score:1)
*puts on tinfoil robe and wizard hat*
Musta been conficker!
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
You're talking about a user education problem, this is an article about a tool for IT professionals.
Re: (Score:2)
And I think we're all aware of how likely to happen that is...
Re: (Score:3, Informative)
Re: (Score:1)
A couple of weeks ago, that site took the entertaining step of being down for some reason other than Conficker.
Re: (Score:2)
but google wont let you down! the cache [209.85.229.132] (link will change, but you can just Google the url for a new one), because the top 6 images are remotely hosted it will still work while the actual server is being ddosd and i doubt that the conficker guys are going to take down google.
Re: (Score:2)
Re: (Score:3, Insightful)
I don't think the story is targeted at parents. It's targeted at sysadmins trying to clean Conficker off their network. Your parents won't run it, but perhaps Comcast will run it and get your parents fixed up. Or your parents' sysadmin at work will run it and fix their work computer.
It's kind of silly to expect TFA is targeted at "your parents" when it's using nmap to scan a network...
Re: (Score:2)
It's kind of silly to expect TFA is targeted at "your parents" when it's using nmap to scan a network...
Indeed, I should have been clearer in my post. What I meant to say was along the lines of "people like my parents, if their PC gets infected, are unlikely to ever remove the worm, and it'll be on their machine until the day they throw it out and buy a new one".
Bottom line: a pretty big botnet exists, and despite numerous clever solutions that can help clean it off large networks quickly there will still be a lot of PCs infected for the foreseeable future.
Re: (Score:2)
Isn't the biggest problem with worms like Conficker the fact that most of the affected users are totally unaware that they have it.
Maybe yes, maybe nooo. I have a legit copy of windows XP at home (OEM, came with my computer). But i refuse to install WGA. So I am not sure if i get those patches (the windows update website doesn't work for me, however, eventually I get updates somehow). Also, i am not going to find all these hotfixes an appling them manually (my time is too valueable for this kind of shit).
Because this is my gaming computer, i do not care much since i hardly ever boot into windows anymore and its the only windows install
Re: (Score:2)
Can you at least send them to http://housecall.antivirus.com/ [antivirus.com] ? It may find it and clean it. If they can't reach there, they could be infected, old time tricks like using hex url etc. may help.
Now what we need is, ActiveX like installing antivirus (not joking) which will install with minimum user interaction. Housecall from Trend is a great favour to newbie users, especially after they got rid of "pay us to clean it" scheme but... It is still not a real antivirus to watch the system. It seems Kaspersky guys
Re: (Score:2)
Like I've said to the many people before you who pointed out my confusing (and badly written) paragraph, I should have said something less about this particular solution, and more about how no solution that requires significant user intervention is going to "solve" the Conficker problem.
Nmap? (Score:2, Interesting)
Isn't the guy who created nmap active on slashdot? (fyodor or something like that?)
We need Fonkicker... (Score:1)
Curious Yellow? (Score:2)
Super Secret Conficker Identifier (Score:1)
I have discovered that almost all of the computers infected with Conficker apparently come with a sticker on the front for ready identification. It has a flag shape divided into red, green, blue and yellow quarters. If you have this flag sticker you might be at risk!