Feeds

Conficker botnet remains dormant - for now

All quiet on the malware front

SANS - Survey on application security programs

Conficker changed the way parts of the botnet communicated overnight, but little else of note has happened so far.

The malware is far from an April Fool's joke, but it's obviously a long way from the Skynet botnet, as depicted in Terminator 3, that some of the more fevered imaginings of the media hinted at. The main activity that accompanied the run-up to the activation date was the registration of dozens of new domain names designed to advertise rogue security packages in the guise of Conficker clean-up tools.

As widely predicted by security vendors beforehand, Conficker and its 1 April activation was more about hype rather than havoc. As F-Secure notes, worms with triggers have consistently failed to do anything on that date. Previous damp squibs include the Michelangelo virus (1992), CIH (1999), SoBig (2003), and MyDoom (2004).

Nonetheless, Conficker remains implanted on many computers, anywhere between 1-4 million, according to the latest estimates.

Conficker first began spreading in November, using a variety of techniques including the exploitation of a well-known Windows vulnerability. Once it secured a foothold on infected networks the worm is capable of spreading across network shares by exploiting weak password security. The malware is also capable of spreading using infected USB drives.

Early versions of Conficker called home to 250 different domain names every day to see if updates were available. From Wednesday, machines infected by the latest version of Conficker began to poll a sample of 500 out of 50,000 domains a day, making attempts to interfere with the update process more difficult. Most compromised machines are thought to be infected by the earlier B variant, whose behaviour has not changed.

Still earlier versions of the worm include peer-to-peer functionality, so that infected computers can communicate between themselves without the need for a server. This functionality might be used to pass around software updates or initiates malicious activity without the need for update servers. And the new call home routine of the latest variant of the worm is due to take place from now on, so that "sleeper" botnet could be unleashed at any future date.

The botnet is yet to be used for sending spam or running denial of service attacks but even the simple act of spreading has caused major disruption. Confirmed victims include the UK's Ministry of Defence, which reported that that the worm had spread across some of its offices, as well as desktops aboard various Royal Navy warships, the UK's parliament, a Sheffield hospital, the judicial systems in the city of Houston and the Bundeswehr (German Army).

F-Secure informative FAQ on Conficker can be found here, and SRI International's detailed technical analysis is here. A full list of resources, drawn up by the SANS Institute can be found here. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.