Feeds

Conficker botnet remains dormant - for now

All quiet on the malware front

The Essential Guide to IT Transformation

Conficker changed the way parts of the botnet communicated overnight, but little else of note has happened so far.

The malware is far from an April Fool's joke, but it's obviously a long way from the Skynet botnet, as depicted in Terminator 3, that some of the more fevered imaginings of the media hinted at. The main activity that accompanied the run-up to the activation date was the registration of dozens of new domain names designed to advertise rogue security packages in the guise of Conficker clean-up tools.

As widely predicted by security vendors beforehand, Conficker and its 1 April activation was more about hype rather than havoc. As F-Secure notes, worms with triggers have consistently failed to do anything on that date. Previous damp squibs include the Michelangelo virus (1992), CIH (1999), SoBig (2003), and MyDoom (2004).

Nonetheless, Conficker remains implanted on many computers, anywhere between 1-4 million, according to the latest estimates.

Conficker first began spreading in November, using a variety of techniques including the exploitation of a well-known Windows vulnerability. Once it secured a foothold on infected networks the worm is capable of spreading across network shares by exploiting weak password security. The malware is also capable of spreading using infected USB drives.

Early versions of Conficker called home to 250 different domain names every day to see if updates were available. From Wednesday, machines infected by the latest version of Conficker began to poll a sample of 500 out of 50,000 domains a day, making attempts to interfere with the update process more difficult. Most compromised machines are thought to be infected by the earlier B variant, whose behaviour has not changed.

Still earlier versions of the worm include peer-to-peer functionality, so that infected computers can communicate between themselves without the need for a server. This functionality might be used to pass around software updates or initiates malicious activity without the need for update servers. And the new call home routine of the latest variant of the worm is due to take place from now on, so that "sleeper" botnet could be unleashed at any future date.

The botnet is yet to be used for sending spam or running denial of service attacks but even the simple act of spreading has caused major disruption. Confirmed victims include the UK's Ministry of Defence, which reported that that the worm had spread across some of its offices, as well as desktops aboard various Royal Navy warships, the UK's parliament, a Sheffield hospital, the judicial systems in the city of Houston and the Bundeswehr (German Army).

F-Secure informative FAQ on Conficker can be found here, and SRI International's detailed technical analysis is here. A full list of resources, drawn up by the SANS Institute can be found here. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.