Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
Security The Internet

The Birth and Battle of Conficker 239

NewScientist has an interesting look back at the birth of the Conficker worm and how this sophisticated monster quickly grew to such power and infamy. "Since that flurry of activity in early April, all has been uneasily quiet on the Conficker front. In some senses, that marks a victory for the criminals. The zombie network is now established and being used for its intended purpose: to make money. Through its peer-to-peer capabilities, the worm can be updated on the infected network at any time. It is not an unprecedented situation. There are several other large networks of machines infected with malicious software. Conficker has simply joined the list. The security community will continue to fight them, but as long as the worm remains embedded in any computer there can be no quick fixes."
This discussion has been archived. No new comments can be posted.

The Birth and Battle of Conficker

Comments Filter:
  • Hate to say it... (Score:3, Insightful)

    by Tyrun ( 944761 ) on Friday June 12, 2009 @08:14PM (#28316323)
    But I think we all saw that one coming.
  • Correction (Score:3, Informative)

    by HangingChad ( 677530 ) on Friday June 12, 2009 @08:18PM (#28316343) Homepage

    The security community will continue to fight them, but as long as the worm remains embedded in any Windows computer there can be no quick fixes.

    Fixed that for ya.

    • by Anonymous Coward on Friday June 12, 2009 @08:39PM (#28316483)
      I think what you are trying to say is this

      The security community will continue to fight them, but as long as Windows remains embedded in computers there can be no quick fixes.

      But its hard to tell... care to elaborate?

    • hasn't there been multiple worms for openssl and apache?

      i'm suprised i have to make this point yet again, but there are more machines infected than the whole linux marketshare. until linux is really in the hands of the common newb you won't have an apples and apples comparison.

      • Re:Correction (Score:5, Interesting)

        by CAIMLAS ( 41445 ) on Friday June 12, 2009 @09:24PM (#28316769) Homepage

        There are more than you think. Old home computers are quickly becoming Linux computers.

        There are a lot of independent techs out there who service the lion's share of home computers. Yes, Best Buy and the like get a lot, too. But they can't compete on quality service with the little guy (due to overhead), so they have to keep themselves going through quantity.

        I know a handful "home computer techs" - people who work out of their house or have a small one-room office somewhere. They're making ends meet and keeping their families going by doing this while at the same time putting linux on computers that are only mildly useful for anything beyond XP (and sometimes even XP, eg. 256Mb RAM).

        More often than not, the system is in need of a reinstall anyway due to some combination of users messing them up and malware. It's like scoring a 3-pointer at the buzzer, in terms of removing an infection vector.

        I'm one such person, while I'm unemployed. I'd say maybe one out of 5 of the computers that come to me leave with Linux installed. Those satisfied customers then refer their friends and family. Not much repeat service, but quite a few referrals. It would also appear that people are oddly appreciative for preventing them from installing all that crap as well - "it just works nice and fast and there are no pop-ups".

        Not only that, but when someone upgrades their computer (and they've got the proclivity to tinker) they'll do something with the old one. Linux has picked up a lot of mindshare, and I know many of the so called "tech savvy" types (who still need someone who knows what they're doing on occasion when they can't recover or get stuck) are doing this.

        • Re:Correction (Score:5, Interesting)

          by timmarhy ( 659436 ) on Friday June 12, 2009 @09:53PM (#28316927)
          i understand there are lots of pc's out there with linux on them, but that is just a drop in the ocean compared to what's sold with windows on it, and most of the linux systems out there are maintained by professionals and don't get uncle joe on them installing that bit of software to get his free porn.

          sure linux has mindshare, but that hasn't translated into market share. The year of the linux desktop will also be the year of the linux virus.

          • Re:Correction (Score:5, Insightful)

            by cenc ( 1310167 ) on Friday June 12, 2009 @11:33PM (#28317381) Homepage

            Really?

            All the linux systems floating around for years and years and years, and no one has gotten a proper linux virus to propagate. You know why that is? Uncle joe can install his porno software (not really aware of what that would be, but for the argument), and still have relatively secure computing because of the WAY LINUX IS DESIGNED, USED, AND MAINTAINED!!!!

             

            • Re:Correction (Score:5, Insightful)

              by mrmeval ( 662166 ) <.moc.liamg. .ta. .lavemrm.> on Saturday June 13, 2009 @12:53AM (#28317699) Journal

              If a Linux based distribution was the dominant desktop OS the morons who run a PC would be infected within minutes. They'll click on, suck up, snort or fk anything presented to them. I've had intelligent people click on, install or follow complex instructions that disable all security on a PC so they could install 'that cool looking game' and then lie about it even when I had logging software logging to a remote server.

              • They're not morons (Score:5, Insightful)

                by TheLink ( 130905 ) on Saturday June 13, 2009 @02:09AM (#28317959) Journal
                In theory they're not actually morons ;).

                Because in theory it's impossible to solve the halting problem.

                In theory users have to figure out whether a program is safe (analogous to "halt") even though
                1) They don't have the actual true description of the program
                2) They don't know the full inputs of the program

                And that's a harder problem than the halting problem ;).

                While you could say - nobody should install anything that's "Not Expert or Vendor Approved", to me that's a rather dismal state of things.

                Things could be so much better. Really.

                For instance if you had an O/S that will require applications/applets to list out the type of access they require.

                Then the O/S can provide a meaningful and TRUE description to the user of what the application might do.
                And the O/S can also enforce the limits of the access.

                So if something says it's a screensaver, it's only going to get screensaver access. It's not going to be able to make recordings from your microphone and webcam, and send them to Elbonia behind your back. It's not going to be able to write to anywhere other than it's own designated scratchpad area, not even your USB drives.

                And that would be a secure modern O/S.

                Then you can tell your "morons" - "You can install whatever stuff you like, unless the O/S gives you that red warning dialog box about the program requiring full user or system privileges".

                In terms of security, most current O/Ses aren't even better than what was available 40 years ago. Heck, Unix is a watered down Multics.

                They're just decorated with fancy graphics and animations so most people think they're advanced.

                Yes, Vista does have some sandboxing, but the way MS has implemented stuff makes many people turn off many of the protections. So they'll become the next hosts for the next Conficker.

                As for Linux, Apparmor and SELinux don't appear "Desktop Ready" yet.
                • Re: (Score:3, Insightful)

                  by jsveiga ( 465473 )

                  For instance if you had an O/S that will require applications/applets to list out the type of access they require.

                  Then the O/S can provide a meaningful and TRUE description to the user of what the application might do.
                  And the O/S can also enforce the limits of the access.

                  When I read this part, I thought you would mention Symbian. At least it looks like it does what you suggest. I am not a Symbian specialist, but when you write something that needs access to more than simple GUI stuff, you need to sign the app (tied to a specific phone IMEI, at least with the free online signing process), and in the process request what you want to allow the app to access (GPS data, user data, comms etc). Then when installing the app, Symbian will warn you that the app requires access to spe

                  • by TheLink ( 130905 )
                    Thanks. Wasn't aware that Symbian did that (or I forgot).

                    Yes it would be something like that, but more oriented to a desktop/server environment e.g. https://bugs.launchpad.net/ubuntu/+bug/156693

                    I was thinking more of there being a hopefully manageable number of "predefined sandbox templates" that an application could request to be run within e.g. "guest applet", "screensaver".

                    Specifying one of those predefined templates, would imply a list of access items (network, user data etc). These do not necessarily h
              • Re:Correction (Score:5, Insightful)

                by RyuuzakiTetsuya ( 195424 ) <<ten.xoc> <ta> <ikiat>> on Saturday June 13, 2009 @02:18AM (#28318001)

                I'm tired of this meme.

                The thing about worms like Conficker is that they absolutely do not rely on user interactivity with some sort of trojan interface. No, "CLICK HERE FOR FREE PORN!" or, "DOWNLOAD THIS APP AND GET GREAT WAREZ!" apps.

                Conficker spreads site to site silently through vulnerabilities in Windows.

                Yes, it's possible to own *NIX boxen via trojan horse deployments, but for home users who aren't running apache, mysql, openssl, ssh, ftp, gopher, BIND, etc. the non-user infection vectors dry up. This is because Windows *sucks* for system security. While it's possible to pull privilege escalation on *NIX machines, and other OSes, often, they're a pain in the ass and usually require specialized setups(certain version of MySQL running with certain version of Apache, with... etc). Home users really don't have to worry about Samba file/print sharing owning their machine like NetBIOS on Windows users have to worry about their machines being similarly owned.

                Sure, disabling autorun, running firewalls, virus scanners, etc. is great computing practice, I think it's more to expect from a typical home user who just wants the damned thing to work regardless. Lots of people use a computer thinking it's, well, a computer. Not a car, or a fax machine or a rifle that every so often needs to be broken down and maintained. Nor should it be. Modern file systems are virtually self-optimizing and aside from system updates and making sure there's room on your disk, which NO OS can really claim to do for you, unless you count Apple's MobileMe/.Mac service, even then it's only 20 gigs, most modern OSes can just be used on end with out much worry. Except most machines aren't running with components designed in this decade, they're often running Windows.

              • Re: (Score:2, Interesting)

                by Anonymous Coward

                I have a friend who installed Ubuntu on his machine and was actually quite happy with it. He searched google for basic information and was able to get xine up and running to watch dvd movies on his 32 inch monitor connected to the pc. He was extremely happy that he no longer had to worry about viruses.

                One day he called me frantically complaining about the inability to login because the system refused to accept his password. After calming him down, I found out that he had a second account called .... test. T

                • Just curious, but what did he need he need ssh for?

                  I know what I use it for, but I really can't see my mom using ssh. And it's pretty easy to lock down if only you are using it to help update his system (or some other legitimate excuse.)

                  There is not much you can do in regards to weak passwords other than forcing users to create strong passwords. But you can not install applications that allow others to remotely log into your system.

          • i understand there are lots of pc's out there with linux on them, but that is just a drop in the ocean compared to what's sold with windows on it, and most of the linux systems out there are maintained by professionals and don't get uncle joe on them installing that bit of software to get his free porn.

            sure linux has mindshare, but that hasn't translated into market share. The year of the linux desktop will also be the year of the linux virus.

            market share isn't the only thing that contributes to the security of an os. If software gets patched quickly, that can stop a lot of infections, which is an F/OSS strong point, not to mention the fact that unix and unix-like operating systems were designed to be secure.

            • Re:Correction (Score:5, Insightful)

              by TheLink ( 130905 ) on Saturday June 13, 2009 @01:45AM (#28317873) Journal
              > If software gets patched quickly, that can stop a lot of infections,

              Uh, if those windows machines actually ran "windows update" there would be no conficker.

              So if Desktop Linux had the same users, they may not run "ubuntu update". Why? Because the last time they updated their machine stopped working properly

              Think that will never happen? See: https://answers.launchpad.net/ubuntu/+question/24523

              Notice that user actually understands "grub" and "kernels" and knows where to find help. Other users might just never update. If the O/S ever has millions of users, these users start to add up.

              > the fact that unix and unix-like operating systems were designed to be secure.

              Incorrect. Unix is a watered down Multics.

              Linux and most Unix OSes don't provide much security by default.

              By default, any program the user runs, can do everything that user can do. There is no sandboxing.

              And whatever a unix/linux normal user can do is more than enough for the conficker worm to make money for its masters.

              So all the bad guys need to do is get the user to run their program.

              If Ubuntu ever has "windows class" users I doubt it'll be hard to get them to download a file and type:

              perl conficker

              Then it's pwnage time.

              If desktop linux ever has the market share that windows has, it'll start to have lots more "dancing pigs" applets that people want to run.

              Some will actually be OK. And some will be malware.

              An O/S whose security depends on people being able to tell whether something is safe or not, without the people actually being able to see and understand the source code, or know the entire inputs, is an O/S that expects people to solve something harder than the halting problem.

              Thus in my opinion Windows and most Unixlike OS have poor security.

              There are ways to give users better info on whether something is safe or not before they run it.

              For instance say an O/S requires a program to list out what sort of access it requires ("guest applet access", or "full system privileges").

              Then the O/S can provide the user more meaningful AND true information, and the O/S can also enforce those limits if the user decides to actually run the program.

              So if a "dancing pig" applet claims to not want network access, it will NOT get network access, even if it tries to later.

              That's far more secure than what the current O/Ses do.
              • ...the fact that unix and unix-like operating systems were designed to be secure.

                Incorrect. Unix is a watered down Multics.

                Total bollocks. You've never used Multics, have you?

                Linux and most Unix OSes don't provide much security by default.

                Do you have even the faintest idea what you're talking about? Didn't think so.

                By default, any program the user runs, can do everything that user can do. There is no sandboxing.

                ...except that the standard user can't do much to damage the system. By design. The worst they can do is to nuke their own files.

                • by TheLink ( 130905 ) on Saturday June 13, 2009 @11:26AM (#28320497) Journal
                  > Do you have even the faintest idea what you're talking about? Didn't think so.

                  That's not a nice thing to say. Why did you say that? Did I hurt you somehow before?

                  > The worst they can do is to nuke their own files.

                  Nah. As I've been saying - they could run the wrong program and then the bad bad things could happen.

                  While having their own data destroyed is typically far worse than losing their entire operating system, that's NOT the worst that could happen when a user runs the wrong program.

                  1) Their data could get silently corrupted. Silent corruption is often far far worse than complete data loss. When you have complete data loss, it's obvious. So you restore from backups, or deal with it in other ways. When something tampers with the data, you could be screwed so badly and not know why. By the time you realize something is wrong, all your backups could be of the corrupted data.

                  2) Their secrets could get exposed and abused.

                  3) Their computer could get taken over and used for illegal stuff. While they might eventually be exonerated, the pain and damage involved is likely to be more than mere data loss.

                  Plus it's probably easier to live if people think you're some incompetent loser who went out of business because of massive data loss, than if people think you really downloaded, stored and shared all those illegal and _disgusting_ porn.

                  I'm sure others can think of many other things worse than "nuking their own files".

                  e.g. they could unknowingly help Skynet survive and grow in strength ;).
              • Re: (Score:3, Informative)

                Uh, if those windows machines actually ran "windows update" there would be no conficker. So if Desktop Linux had the same users, they may not run "ubuntu update". Why? Because the last time they updated their machine stopped working properly Think that will never happen? See: https://answers.launchpad.net/ubuntu/+question/24523 [launchpad.net] Notice that user actually understands "grub" and "kernels" and knows where to find help. Other users might just never update. If the O/S ever has millions of users, these users start to add up.

                This is why I run a stable distro that doesn't break everything all the time. Debian stable for example, I think it would be highly unlikely for anything to break during an update.

        • Re: (Score:2, Interesting)

          by Anonymous Coward

          I'm one such person, while I'm unemployed. I'd say maybe one out of 5 of the computers that come to me leave with Linux installed. Those satisfied customers then refer their friends and family. Not much repeat service, but quite a few referrals.

          What percentage of those users are still using Linux in 1 month? In 6 months? After 1 year? Per usual, something about your allegedly genuine pro-Linux story just begs more questions. How many users later dump the machine and end up just getting a new Windows machine instead? How many gain a new found appreciation for Windows after having used Linux for any length of time? How many users ever come back complaining that their X server is crashing or sound latency problems make watching YouTube unbearab

          • Re:Correction (Score:5, Interesting)

            by cenc ( 1310167 ) on Friday June 12, 2009 @11:29PM (#28317369) Homepage

            In my experience 100% of the people I have volunteered to install Linux on their systems not only continue to use linux for years afterwords, bring me their new computers they buy with windows installed and ask me to remove it.

            Among others:

            dozens of first time to almost completely computer illiterate people.
            Lots of people that have been using windows for years and are fed up with the crap, especially after most linux distros had more in common with windows xp than vista had in common with windows xp.
            At least half dozen people over 60.
            Lots and lots of teenagers.
            Not to mention everyone that works in my office never seen a linux computer before they walked through the door, and now have them at home.

            So, these arguments are for the ignorant that have not used a major distro in the last couple years.

            • your convenently side stepping the fact there is no motivation for virus writers to target desktop linux users, after all why waste time on ~1% of users. do you really think i can't trick a novice user into installing a trojan on linux? unless you have set them up with a highly restrictive environment where they can't install software on their own computer you will catch just as many as you do with windows, if not more because no one in the linux world seems to believe in antivirus

              my arguement isn't that l

              • by cenc ( 1310167 )

                have you ever used linux?

              • Re: (Score:2, Interesting)

                by zkiwi34 ( 974563 )
                Considering the number of high value Linux targets out there, you'd be very very wrong that people are not trying to generate systemic Linux hacks so they can make their filthy lucre.
                • Re:Correction (Score:5, Insightful)

                  by hairyfeet ( 841228 ) <bassbeast1968&gmail,com> on Saturday June 13, 2009 @02:46AM (#28318119) Journal

                  You are talking about servers which have these things called Linux administrators, or Guru if you will, that actually read security bulletins, patch on time, have IT experience, etc. This makes them a lot harder target than Velma.

                  Everybody, meet Velma. Say hi Velma-(Hi Y'all!)

                  Working in PC repair and sales since the days of Win3.xx, when dinosaurs roamed the earth as my oldest puts it, I have found Velma to be a VERY typical Windows user. She rarely if ever patches because it scares her that it might "break" something, if it wasn't for me should would be running the Norton that expired in 2004 for an AV, and worst of all, like WAY too many of my customers, she has a serious weakness. In Velma's case it is her BFF Kim. You see, her BFF Kim is what some of us in the biz call a "click whore", in that she will click on ANYTHING. Spam attachments, chain letters, you name it. And Velma will ALWAYS trust her BFF Kim no matter what to tell her. Now please enjoy an ACTUAL account of my working with Velma-

                  /Me/Velma, that is a password protected zip file. It is even telling you to turn off the AV before opening! It is a Virus, do NOT open that!
                  (Velma) Ohh...You worry too much. It is from my BFF Kim! She wouldn't send me anything bad! See, it says "happy puppy pics!" Isn't that nice?

                  /Me/ Velma, it isn't pics. Pics end with .jpg. That is Happ_Pup.exe! That is a virus! Do NOT run that! (Velma) Oohhh...drink decaf, it'll be fine! See it has Kim's name on it and everything! /Velma turns off and ignores AV warnings, runs .exe, popups start sprouting everywhere and the network crashes from all the activity/

                  (Velma) Whoops. But it MUST be a trick, because my BFF Kim wouldn't do that! /Me/..... [roflposters.com]

                  NOW do you see why Linux "security" wouldn't be worth a bucket of warm spit if Linux got all the Velmas of this world? If you ever do manage to get Velma and Kim and all their little buddies onto Linux your good friends at the Russian Business Network and their friends in China and Nigeria would be sending "Happ_Pup.sh" along with easy to follow instructions on how to run it. And Velma and Kim WOULD run it, no matter how many times you told them not to. It is simply the dancing bunnies problem [codinghorror.com] and short of forcing Velma and all her kind to run locked down thin clients with no rights at all to their own machines Linux will NEVER fix it. Sorry.

              • The trojan will of course have to work on several subtly different distros that are running one of several windowing environments and the users will be browsing the web with one of half a dozen web browsers. Windows is a monoculture and is therefore very easy to attack. Desktop Linux is not.

        • There are more than you think. Old home computers are quickly becoming Linux computers.

          More likely they are going to the dumpster.

          The most conspicuous thing about Slashdot conversion stories is that you never see the numbers.

          You never see the competition.

          Repairing or rebuilding an aging system is going to take a little time.

          That sets an upper limit to how much product will be moving out of the geek's one man shop.

          There are other curiosities.

          Such as the customer who wants to see a four, five - six or eigh

        • Re:Correction (Score:5, Insightful)

          by mshurpik ( 198339 ) * on Saturday June 13, 2009 @02:37AM (#28318077)

          >Linux has picked up a lot of mindshare

          The problem with Linux on the desktop is that it's not very compelling.

          Linux shines when the people around you are using it. That is, on your LAN or within telnet's reach. X is amazing, when used remotely. Why download and install a program when you can just telnet over to where its installed? Assuming the bandwidth is there (and it's a hell of a lot more there each year), the program will run. And it will be a lot faster than doing it the newfangled way, which is to make it a web service.

          Linux makes a great desktop, if by "desktop" you mean network terminal. But we don't have a network. We have the web, which is a single graphical application (the "browser") that runs best on Windows. Just like a video game.

          Linux won't, and probably can't, catch on until the network is there to support it. That includes small and large businesses, which have networks that would benefit from it, and are still using Windows. Businesses can use Linux the way it is intended, right now. But the "home desktop" is designed to deliver applications, not services.

          Let's put it this way: The day some 14-year-old kid installs IIS for XP and hosts a webpage from his bedroom will be the first day of Linux's life. To my knowledge, nobody is hosting squat. Except on bittorrent, which doesn't quite count, because although BT is a protocol, people use it like just another Windows app.

      • Re:Correction (Score:5, Insightful)

        by grcumb ( 781340 ) on Friday June 12, 2009 @11:25PM (#28317353) Homepage Journal

        hasn't there been multiple worms for openssl and apache?

        i'm suprised i have to make this point yet again, but there are more machines infected than the whole linux marketshare. until linux is really in the hands of the common newb you won't have an apples and apples comparison.

        Silence, in this context, really is golden.

        The absence of data actually does signify, as far as this argument is concerned. In effective terms, users can find a secure haven in non-Windows systems. There is, admittedly, some truth to the assertion that there's a myth of invulnerability surrounding FOSS systems. Amusingly, black hats seem to buy into it [imagicity.com] as much as anyone else.

        Want effective protection from malware right now? Don't run Windows.

        Will that protection exist tomorrow? Will it exist even after everyone and their dog has flocked to FOSS? These are, for the moment, academic questions. Developers, however, deal with such academic questions all the time. My personal feeling is that FOSS developers are up to the task of securing their systems even in the face of concerted attacks.

        So what about that famously touted malware vector, 'stupid user tricks'? Ignorance and naivete are vulnerabilities in any system, technical or human. One doesn't have to look far for proof of that. But there's a fundamental logical flaw in this argument when applied to FOSS systems: The argument essentially says, "Once FOSS is just like Windows, it will be just as insecure as Windows."

        This assumes that a mass movement to FOSS won't be accompanied by a cultural change, and I can't see how that's possible. The culture of the incurious, uninvolved and too-trusting Windows user is exactly what keeps Linux (and much of FOSS) off the desktop. FOSS punishes each of those tendencies. In effect, it pushes back against the very behaviour that remains Windows' last, greatest vulnerability.

        I'm not trying to make the case for cultural change. Frankly, I'm getting jaded enough that I'm not so sure there will ever be a year of Linux on the desktop. But here's the thing: I don't care. Linux (and FOSS systems generally) work for me and my customers now. That's enough for today. I'll continue looking ahead with caution, but today, at least, I'm safe, and most of the rest of the world is not.

      • by InfiniteLoopCounter ( 1355173 ) on Saturday June 13, 2009 @12:15AM (#28317557)

        i'm suprised i have to make this point yet again, but there are more machines infected than the whole linux marketshare. until linux is really in the hands of the common newb you won't have an apples and apples comparison.

        I know. It's typical isn't it? I've been waiting for a Linux version of Conficker for some months now. That's why I still have to dual boot: I just can't get the same experience using Linux as with Windows.

        And before you suggest it, I'm not about to take the trouble to manually downoad and install some other academically written virus as a substitute. Also, typically, deficiencies in WINE stop me from running the Windows virus.

        I know there is the whole marketshare thing, but I think there's just more the developers could be doing on a variety of fronts to address what is really a critical problem with Linux.

        • > I know there is the whole marketshare thing, but I think there's just more the
          > developers could be doing on a variety of fronts to address what is really a critical
          > problem with Linux.

          The guys at Freedesktop.org are hard at work on the problem and making considerable progress.

    • Re:Correction (Score:5, Insightful)

      by Opportunist ( 166417 ) on Saturday June 13, 2009 @02:45AM (#28318117)

      It may not be popular on /., but Windows isn't the main problem here. The core of the problem is people not giving a shit about the security of their system. Whether that system is Windows, Linux or Mac is irrelevant.

      Windows has reached a point where it can be considered "fairly secure". There are few known security holes, and none that can't be fixed with a little system tweaking and putting a router in front of the machine. But what can the system do if the user is the main point of failure, when he grants everyone any kind of privileges?

      Take a look at the Dancing pig problem [wikipedia.org]. In a nutshell: "Given a choice between dancing pigs and security, users will pick dancing pigs every time."

      A webpage promises the user what he wants to see or do. Firewalls and security systems ring alarms because what the page actually will do is install malware. But the user clicks it away and allows it in. Because he wants to see the dancing pigs (or install a crack, or see some pron, or ...).

      What system could avert that? Only one that does not allow its owner to do what he pleases. Do we want machines that we don't own but that only install what's "good for us"? I wouldn't want to go there...

      As long as people don't give a shit about their security, this problem will not end. Be it with Windows, Mac, Linux or FantasyOS. And people will not give a shit about their system's security and whether their system is a threat to the rest of the internet as long as they are not held responsible for their system's actions.

    • Re: (Score:2, Interesting)

      by symbolset ( 646467 )

      My God! It's full of anti-worms [distrowatch.com].

    • by g-san ( 93038 )

      Go for it. See if you can reverse engineer conficker's encrypted and digitally signed binaries. It's only RC4 and MD-6. MD-6 was only released a few weeks prior to the first wild sightings of version C. Still wanna mess with these guys? Then all you have to do is figure out which of the 50,000 domains spread across ~120 .tlds to register so you can put your binary on it for when conficker does it's daily payload check.

      Or if you want, you can try to infiltrate it via its own P2P network. You better be quick,

  • "Watch me" service (Score:5, Interesting)

    by davidwr ( 791652 ) on Friday June 12, 2009 @08:32PM (#28316429) Homepage Journal

    If your ISP provided a free service where it would text or phone you and offer to help clean up your systems if it detected malware-ish behavior coming from your computer or network, would you sign up?

    The only gotcha is that you would be inviting the ISP to watch your traffic.

    OK, this is slashdot, so most people would say "no," but how many regular people would say "yes" and would that make much of a difference?

    • by Agent ME ( 1411269 ) <agentme49&gmail,com> on Friday June 12, 2009 @08:42PM (#28316497)

      Regular people just care that whatever is on their computer isn't directly costing them money or causing it to visibly malfunction. From experience, I know most would ignore any offers to help, sadly. Guess the trick is to find a way to make them want to disinfect their computers.

      • by Darkness404 ( 1287218 ) on Friday June 12, 2009 @08:44PM (#28316519)
        Exactly, other than adware or software that directly and immediately causes identity theft, most people don't care, after all computers are supposed to be slow after about a year because all the hardware goes obsolete right?
        • after all computers are supposed to be slow after about a year because all the hardware goes obsolete right?

          that; or they're running SSD's.

          • I never really got what made SSDs less reliable than HDs, I mean having bought cheap flash drives, used them extensively and the only ones that I have had break were broken from physically breaking them in some way. On the other hand, I've had several "name-brand" drives either fail for no reason or give me the "click of death", along with an EEE with moderate use with an early SSD that hasn't failed yet.
      • Re: (Score:3, Funny)

        by RoFLKOPTr ( 1294290 )

        Guess the trick is to find a way to make them want to disinfect their computers.

        "Every time you don't update your antivirus, a kitten is struck by lightning."

      • by Tubal-Cain ( 1289912 ) on Friday June 12, 2009 @09:56PM (#28316943) Journal

        Guess the trick is to find a way to make them want to disinfect their computers.

        Or make them want something that Linux has but Windows doesn't. Unfortunately, users tend to have weird priorities. They won't budge over the seemingly intangible factor known as 'security', but they might switch in a heartbeat for Gnometris.

      • Re: (Score:3, Insightful)

        by nametaken ( 610866 )

        Regular people just care that whatever is on their computer isn't directly costing them money or causing it to visibly malfunction. From experience, I know most would ignore any offers to help, sadly. Guess the trick is to find a way to make them want to disinfect their computers.

        Easy, do what the government does... fearmonger.

        "ZOMG Identity theft!!#!"

        They'll be begging for free help.

        • Re: (Score:3, Informative)

          by Opportunist ( 166417 )

          "So? Ffffft.

          How likely is that to happen? Almost zero? Fffft. And when it happens? My bank will cover the loss so I shut up and don't make a stink about it, so does Visa, so? Ffffft."

          That's how this is perceived. It's no biggie. The money that may be lost will be covered by the financial institutions that don't want people to lose faith in online transactions. And that's about all people care about when it comes to identity theft.

      • "Regular people" don't care at all. That's the whole point here.

        They don't care as long as it "works". And "works" means, as long as they can surf their web, read their email, write their letters and maybe play a game or two. As long as the system does that, they don't care about anything going on inside. They don't care whether they spew out spam as long as their connection remains fast enough to read pages and mail at normal speed. They don't care whether they are a botnet hub as long as it doesn't slow t

      • Somewhat related to this "not directly costing money" when a machine is infected, I recently got high-speed Internet service in the US via a cable modem. Using two different brands (Ambit and Motorola), there is constant flashing on the modem's LAN light and my router's WAN light the moment it connects. I've searched for explanations and the two are that the modem/router are constantly talking to each other for no reason, and that it's the random traffic that all the malware-infested machines in the world a
    • by Anonymous Coward on Friday June 12, 2009 @08:47PM (#28316545)

      OpenDNS already have a system set up where, if you use their DNS servers, it will tell you if it detects any Confiker-type activity on your network. Non-intrusive, transparent to the end-user, and quite effective.

      • Then most, if not all, ISP's could use this strategy too. Seeing as to how a very high percentage of users (my guess) would use the automatically obtained dns servers (from their ISP). And it would be just as "non-intrusive, transparent to the end-user, and quite effective."

        The ISP where I live - Shaw - offers free Anti-Virus based upon F-Secure. Based upon this link it does protect against Cornficker and tools are provided to remove it.
        http://www.f-secure.com/v-descs/worm_w32_downadup_gen.shtml (non c
        • You know, that WOULD actually be a quite well working solution.

          Whatever the worm wants to do, it must eventually do a DNS lookup. How many people go "normally" to masjwefkangagjagawrh.uprekj.cn?

          • Whatever the worm wants to do, it must eventually do a DNS lookup.

            Not necessarily. At would have to do is have a list of the static IP addresses of its control servers, and if that list changes it could be remotely updated anyway. DNS is not a requirement: as you note it is actually a point of failure.

            • Usually malware updates using DNS. Simply for convenience. If the server fails for some reason (detection, put offline by the ISP or law enforcement, etc), all it takes is to change the DNS entry and wait for the propagation, without the need to actually change the malware and risk another detection.

              But the system would work for IP addresses as well. You try to connect with xxx.xxx.xxx.xxx and it's a known malware host, you get a warning from your ISP that you're probably infected because, again, why should

    • by symbolset ( 646467 ) on Friday June 12, 2009 @09:35PM (#28316847) Journal

      If only we consider more thoroughly what single thing they all have in common, we might be able to find a cure.

    • Just make it opt-out and the 10% of us (or whatever) that might not be comfortable can continue to use the service happily.

      The problem with bot-nets is not that people don't care (exactly) but that they are ignorant, literally, they don't know. Everyone wouldn't fix it or know how or who to turn to but the net result would still be X percentage less infected computers. Probably even an X percent increase in awareness/interest (personal information accessible/business information-secrets accessible/illici
      • by msimm ( 580077 )
        Another point, would we prefer the ISP implement this in a subpoenable fashion or wait for the government to implement a national security system that would need essentially the same level of access to your information? Personally I like an audible paper trail from a non-governmental organization.
    • Re: (Score:2, Informative)

      by Anonymous Coward

      I ran an ISP only a few years ago. The number one source of identifying hacked PC's was abuse messages coming to our admin accounts. It didn't take our support staff long to lock out and call the customer. Many would say, "yes, the computer has been running slow lately", and thanked us for fixing their virus.

      We also monitored our MRTG graphs. If we noticed strange spikes in traffic, our network people would investigate. One time we had to shut down a chess server at a high school. I will say this was in a r

    • If your ISP provided a free service where it would text or phone you and offer to help clean up your systems if it detected malware-ish behavior coming from your computer or network, would you sign up?

      I'll take the odds that your cable ISP has a free Internet security bundle for Windows.

      Security Center [rr.com]

      OK, this is slashdot, so most people would say "no," but how many regular people would say "yes" and would that make much of a difference?

      The uncomfortable truth about privacy is that is you are most likel

    • Sure! I'm in the EU, they're watching my traffic already anyway, mandated by law. They could at least use that privacy invasion for some good, too, for a change.

  • We now have Windows Defender. MS should know every nook and cranny in MS Window. What is so special about Conficker that the best software company in the world can't protect it's user against a well known and defined threat. I realize that dumb users will often just go back and reinfect the computer, but then we would expect defender to block the reinstall.
    • by ShadowRangerRIT ( 1301549 ) on Friday June 12, 2009 @10:33PM (#28317107)
      If you read the article, the problem isn't Microsoft failing to offer patches and fixes, it's the failure of users to install them. Conficker was detected in the wild *after* the patch to remove the vulnerability became available, but people didn't install it. I suspect a few of the monthly malware removal updates deal with it as well (though I don't know for certain). What do you want MS to do, deploy goon squads to forcibly patch people's computers?
      • by smoker2 ( 750216 )
        No, I expect microsoft to disable the network stack if it detects conficker type activity. Simple really. Contain the infection. Those who don't maintain their computers adequately should not be allowed to have free rein. They've proved themselves inadequate by not applying patches.
        • So should linux kernels do the same thing? Surely it'd be good if your server shut down because you didn't apply an openssh patch.

        • Windows should ship with a built-in, suspicious network activity detecting component that disables the network if it flags a problem? And people complain when they get erroneous WGA warnings! Imagine the response when anyone running a P2P program, or a UPnP-type software, or security scanning software gets shut down. All of these are legitimate examples of software that is supposed to look for other computers in ways similar to Conficker's searches. Of course, the first action of a smart worm would be t

        • MS already did this sort of thing with insta-revokable video drivers that didn't play ball with Protected Video Path.

          Forcing users to apply patches opens the door to slavery to whatever special interests get in bed with Microsoft.

        • Consider this for a moment: You are the writer of a worm that has full control over the system. What is the first thing you disable? I mean, before you start any kind of "suspicious network activity"...

        • If microsoft didn't make it a pain in the ass to keep a system updated without Microsoft Genuine Advantage, there might just be more people keeping their systems up to date.
    • by g-san ( 93038 )

      > We now have Windows Defender... What is so special about Conficker..

      For one, conficker kills Windows Defender and keeps it from starting up on reboot.

  • by Chris Tucker ( 302549 ) on Friday June 12, 2009 @10:21PM (#28317059) Homepage

    Botnets, worldwide botnets.
    What kind of boxes are on botnets?

    Compaq, H.P., Dell and Sony, true!
    Gateway, Packard Bell, maybe even Asus, too!

    Are boxes, found on botnets,
    All running Windows! Foo!

  • What I thought was interesting was the internet telescope [caida.org] mentioned in the article. No wonder we're running out of IPv4 addresses, someone's wasting millions of them!
  • User education! (Score:5, Insightful)

    by oljanx ( 1318801 ) on Saturday June 13, 2009 @12:32AM (#28317605)
    I routinely encounter people who have disabled windows update because they believe Microsoft is out to get them. They worry that the updates their computer nags them about are filled with unnecessary crap. Crap that will spy on them, display advertisements, install toolbars and hijack their machine. I think this is largely due to some weird cultural concept that Windows is both evil and necessary. In truth, it's neither.
    • Re:User education! (Score:4, Insightful)

      by Opportunist ( 166417 ) on Saturday June 13, 2009 @03:00AM (#28318179)

      That's just because they learned that everytime they installed something that announced itself as "critical update" and "warning, machine infection possible if you don't do this" they got bombarded with advertisments and had strange new toolbars in their browsers...

    • by Chemisor ( 97276 )

      So let's give the users an education. Instead of trying to block all these botnets, hack them! They are designed to distribute malicious software, so use that capability! Write a payload that would erase the hard drive on every infected machine and send it out there. I guarantee you that in a few weeks the users will be educated.

  • A computer worm that spreads through low security networks, memory sticks, and PCs without the latest security updates is posing a growing threat to users blitheringly stupid [today.com] enough to still think Windows is not ridiculously and unfixably insecure by design.

    Despite many years' warnings that Microsoft regards security as a marketing problem and has only ever done the absolute minimum it can get away with, millions of users who click on any rubbish they see in the hope of pictures of female tennis stars hav

  • or on some other non-Windows OS? This is a serious question ... what is the amount of exploits and similar with regard to non Windows computers. Is it known?

  • 'The dry, technical language of Microsoft's October update did not indicate anything particularly untoward. A security flaw in a port that Windows-based PCs use to send and receive network signals, it said, might be used to create a "wormable exploit"'

    Don't they mean a BUG in the Operating System and defects in the Memory Management unit lead to the worst virus/worm [sri.com] infestation in years.

    'One major implication from the Conficker B and C variants, as well as other now recently emerging malware families,

"What is wanted is not the will to believe, but the will to find out, which is the exact opposite." -- Bertrand Russell, _Sceptical_Essays_, 1928

Working...