Feeds

Superworm seizes 9m PCs, 'stunned' researchers say

Downadup goes up and up

  • alert
  • submit to reddit

SANS - Survey on application security programs

Downadup, the superworm that attacks a patched vulnerability in Microsoft Windows, is making exponential gains if estimates from researchers at F-Secure are accurate. They show 6.5 million new infections in the past four days, bringing the total number of machines it has compromised to almost 9 million.

The astronomical growth stunned some researchers, although others cautioned the numbers could be inflated since the counting of infected computers is by no means an exact science. Most agreed F-Secure's estimate was certainly plausible and if it proved to be correct, represented a major development in the world of cyberthreats.

"This thing has gotten way out of hand," said Paul Ferguson, a security researcher for anti-virus provider Trend Micro who has spent the past several weeks tracking the worm's progress. "It seems pretty spectacular to me that there could be that much growth."

A confluence of factors are responsible for the growth of Downadup, which also goes by the name Conficker.

For one, the underlying vulnerability allows for self-replicating attacks in the 2000, XP, and Server 2003 versions of Windows. And for another, the malware authors have cleverly designed exploits that spread via flash and network drives, online trojans, and social engineering features that allow it to spread like wildfire within a local network once a single machine is compromised.

Another important contribution to the outbreak seems to be the legions of administrators and users of Windows machines who have failed to heed repeated admonitions to update. Despite Microsoft releasing an emergency patch for the vulnerability almost three months ago, nearly one in three Windows machines have yet to apply it, according to research from security provider Qualys.

Some Skepticism

Not all security watchers are convinced there really are 9 million machines infected by Downadup. Paul Royal, chief scientist with anti-botnet company Damballa, said his researchers have counted only about 500,000 unique IP addresses connecting to Downadup's master control server. That would imply an average of 18 infected machines behind each address, a number he says is unlikely.

The skepticism prompted F-Secure researchers to explain its methodology for the mind-boggling number. By infiltrating Downadup's control channel and analyzing logs of machines that connected, researchers discovered a counter believed to show the number of other PCs the compromised machine has infected.

After creating a script that totaled all those numbers together, F-Secure deduced 8.97 million machines have been compromised, up from 2.4 million on Tuesday.

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.