Feeds

Countdown to Conficker activation begins

A superbotnet will rise

Choosing a cloud hosting partner with confidence

Security watchers are bracing themselves to respond to the activitation of the huge botnet created by the Conficker superworm.

The malware has created a network of infected PCs under its control estimated at 9m or even more, according to the latest estimates — dwarfing the zombie army created by the infamous Storm worm, which reached a comparatively paltry 1m at its peak in September 2007.

Variants of Conficker (aka Downadup), which began circulating in late November, exploit the MS08-067 vulnerability in the Microsoft Windows server service addressed by Redmond with an out-of-sequence patch last October.

The malware also infects removable devices and network shares using a special autorun file. The worm uses social engineering trickery so that users on Windows machines looking to simply browse the contents of a memory stick may be tricked into selecting an option that actually runs a malware payload and infects their PC.

Some variants are programmed to spread across machines in the same local area network. Weak passwords in corporates have therefore aided the distribution of the worm.

The multiple infections techniques - none of which, incidentally, feature email — has fuelled the prolific spread of the worm. It’s been years since any worm has spread so widely. In many ways the Conficker worm epidemic represents a return to the bad old days of worms such as Nimda, Blaster and Sasser.

It only takes one rotten apple

In the case of Conficker, security watchers reckon the fact that the worm only needs to hit one infected machine in a network to spread goes a long way towards explaining its success. Slow patching, particularly in corporates, has also contributed to the epidemic.

“We haven’t seen this type of advanced worm in many years,” Eric Schultze, CTO of patching firm Shavlik Technologies told El Reg. “It’s successful because once a single machine is infected in a corporate environment, it can spread itself to all of the other corporate machines, whether they’ve been patched or not.

“In terms of damage it can do, some reports say the worm is a dud but I believe that it’s simply ‘sleeping’ and may be woken up at a future date to execute some set of evil instructions. Even if never executed, the worm turns off the windows update service and blocks access to many security vendor websites [blocking uptake of new antivirus signatures].

“To many, these actions alone may be considered malicious.”

Net security firm Sophos reckons that business users have been harder hit than consumers by the spread of the worm. The malware has caught some firms on the hop because they haven’t rolled out patches, it figures.

Superworms return

Theories on why we haven’t seen a worm of this type for three or four years are thin on the ground. It may be that writing such a worm (even if it pinches parts of its code from Metasploit, the open-source penetration testing tool) is simply too much like hard work.

“It’s more effort to write malware that exploits a new vulnerability than, say, regular executable malware that is emailed or shoved on web,” said Graham Cluley, senior technology consultant at anti-virus firm Sophos. “If email or web attacks work just fine, then why go to extra effort?”

“These guys aren’t doing it for intellectual challenge or showing-off. Money is the motive.”

Despite the noteable lack of network worms over recent years the approach — much like spreading computer viruses using infected email attachments — has always been an option for miscreants.

“Hackers never completely abandon old tricks,” Cluley continued. “They can always dust them off and use them again. For example, there was a huge increase is infected email attachments last year year. It’s a danger to think we have any particular attack strategy licked.”

Cluley, like other security researchers, credited Microsoft for releasing a clean-up tool in January after publishing a patch in October, while noting the software giant bears significant responsibility for creating the security vulnerability that allowed the worm to spread in the first place.

Beginner's guide to SSL certificates

Next page: Defcon

More from The Register

next story
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.