Original URL: http://www.theregister.co.uk/2009/01/16/9m_downadup_infections/

Superworm seizes 9m PCs, 'stunned' researchers say

Downadup goes up and up

By Dan Goodin

Posted in Security, 16th January 2009 22:23 GMT

Downadup, the superworm that attacks a patched vulnerability in Microsoft Windows, is making exponential gains if estimates from researchers at F-Secure are accurate. They show 6.5 million new infections in the past four days, bringing the total number of machines it has compromised to almost 9 million.

The astronomical growth stunned some researchers, although others cautioned the numbers could be inflated since the counting of infected computers is by no means an exact science. Most agreed F-Secure's estimate was certainly plausible and if it proved to be correct, represented a major development in the world of cyberthreats.

"This thing has gotten way out of hand," said Paul Ferguson, a security researcher for anti-virus provider Trend Micro who has spent the past several weeks tracking the worm's progress. "It seems pretty spectacular to me that there could be that much growth."

A confluence of factors are responsible for the growth of Downadup, which also goes by the name Conficker.

For one, the underlying vulnerability allows for self-replicating attacks in the 2000, XP, and Server 2003 versions of Windows. And for another, the malware authors have cleverly designed exploits that spread via flash and network drives, online trojans, and social engineering features that allow it to spread like wildfire within a local network once a single machine is compromised.

Another important contribution to the outbreak seems to be the legions of administrators and users of Windows machines who have failed to heed repeated admonitions to update. Despite Microsoft releasing an emergency patch for the vulnerability almost three months ago, nearly one in three Windows machines have yet to apply it, according to research from security provider Qualys.

Some Skepticism

Not all security watchers are convinced there really are 9 million machines infected by Downadup. Paul Royal, chief scientist with anti-botnet company Damballa, said his researchers have counted only about 500,000 unique IP addresses connecting to Downadup's master control server. That would imply an average of 18 infected machines behind each address, a number he says is unlikely.

The skepticism prompted F-Secure researchers to explain its methodology for the mind-boggling number. By infiltrating Downadup's control channel and analyzing logs of machines that connected, researchers discovered a counter believed to show the number of other PCs the compromised machine has infected.

After creating a script that totaled all those numbers together, F-Secure deduced 8.97 million machines have been compromised, up from 2.4 million on Tuesday.

Realm of Possibility

The number is "certainly within the realm of possibility," said Joe Stewart, a researcher with security provider SecureWorks, but he says it's still not clear whether the tally is counting some infected machines more than once, something that would cause the final count to be inflated. F-Secure representatives weren't immediately available to clarify.

The other mystery surrounding Downadup is the intentions of the people building the botnet. In early December, Royal's team at Damballa observed it interacting with a domain name that has strong ties to rogue anti-virus programs, which rake in big money installing malware that's disguised as legitimate security software.

But after security professionals managed to close down the domain name, Downadup has mainly laid low. A pseudo-random generator embedded into the malware causes infected machines to report to a different domain name each day. White hats have been able to sporadically track the botnet's moves by registering domain names ahead of the botmasters, but so far, they haven't observed the infected drones receiving instructions to spam, steal banking passwords, or carry out other nefarious actions typical of such networks.

"Given that there are new domain names generated everyday, the botmasters have an infinite number of chances to actually claim control of the botnet and direct it to do whatever they want whenever they want," said Royal. "Based on what we saw in the past, it seems likely they may try and push rogue anti-virus software on people's systems in the future, but of course, there's nothing that precludes them from doing something completely different."

For now, there's little the white hat world can do to turn the tide of infections. This month's malicious software removal tool from Microsoft included definitions designed to disinfect machines hit by the worm, but some researchers believe compromised PCs are unable to receive Microsoft updates, a measure that could largely neutralize the measure. Redmond has yet to share data on the its effectiveness.

That leaves law-abiding security researchers with few options other than to watch as more and more infected machines connect to a different server each day, patiently waiting for instructions from overlords who are believed to be located in eastern Europe.

"If somebody were more ambitious and willing to break the law, I'm sure they could host their own server and then push out disinfection code," said SecureWorks's Stewart. "There's a certain point where we have to stand back and we really can't cross the line. Sure, you could fix it to some extent, but at the risk of getting yourself in legal hot water." ®