Internet worm exploits Windows vulnerability
A worm dubbed Win32/Conficker.A is making the rounds on Windows machines, exploiting a security hole that Microsoft released a patch for in October, Microsoft said on Wednesday.
The number of attacks have increased over the past couple of days, exploiting a critical vulnerability that was addressed by security update MS08-067.
The malware mostly was spreading inside corporations, but also hit several hundred home PCs, Microsoft said in a posting on the Microsoft Malware Protection Center Blog.
"It opens a random port between port 1024 and 10000 and acts like a Web server. It propagates to random computers on the network by exploiting MS08-067. Once the remote computer is exploited, that computer will download a copy of the worm via HTTP using the random port opened by the worm. The worm often uses a .JPG extension when copied over and then it is saved to the local system folder as a random named dll," the posting said.
"It is also interesting to note that the worm patches the vulnerable API in memory so the machine will not be vulnerable anymore. It is not that the malware authors care so much about the computer as they want to make sure that other malware will not take it over too," Microsoft said.
Most of the infections are in U.S. PCs, but there have been reports from Germany, Spain, France, Italy, Taiwan, Japan, Brazil, Turkey, China, Mexico, Canada, Argentina, and Chile. The worm avoids infecting Ukrainian computers, for some reason, Microsoft said.
Several bots, under the generic name Backdoor:Win32/IRCbot.BH, also are exploiting the security hole. They drop a backdoor Trojan that connects to an IRC server to receive commands.
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
The TCP/IP implementation is part of the OS. It was written by MS.
/P
It's simple. Keep your system up to date and there is no issue.
"The discussion centered on who owns the code, not how old/new it is. Do try to keep up - 'k? :) "
The discussions here appear to be about admins taking proper measures to protect their network by rolling out patches in a timely manner. There are dozens of comments about this in the discussion already - even YOU commented as such.
Here's the difference, Penguinisto- I *read* both the article and the discussion here before commenting. You may want to follow your own advice and... "do try to keep up."
Happy Thanksgiving.
I reiterate what I wrote before in this thread. ;)
A headline like "Windows Invulnerable to New Internet Worm" would really be newsworthy.
Consumers everywhere are sick and tired of using a stone-age computer.
Some things will change, some things will never change.
Will you change by switching to the Mac?
Sysadmins who delay are doing so mostly out of ignorance these days. And that sort of behavior will bite them.
...of course, sometimes you have to wait for a custom/in-house software vendor to write a patch, so that the custom app/service will survive the OS patch. In the meanwhile you do workarounds on the affected systems as best you can.
Man - you help-desk folks really don't think things through much, do you?
dwinks, I also assume that you've never have had corporate applications break after applying MS patches without testing.
"...of course, sometimes you have to wait for a custom/in-house software vendor to write a patch, so that the custom app/service will survive the OS patch. In the meanwhile you do workarounds on the affected systems as best you can."
How long will you wait for? How incompetent are your in house developers? That becomes the question. Since the development process for the patches is one thaat those same vendors are involved in from the start, it becomes a question of how quick they are. If they aren't able to keep up, then you may need to find better people.
Are you familiar with how patches are created? The testing that goes on? The compatibility process? Your comments demonstrate a great deal of ignorance of the subject. I can't blame you for that however. If you don't know, then you don't know.
I do think things through. And if you did that too, you wouldn't have made such an ignorant post in the first place.
It has nothing to do with competence on the part of the development teams or vendors - it has to do with their patch/test cycle, which is more often than not far longer than merely a month. I also suspect that he has no clue as to how patches are created, tested, then distributed, else he wouldn't have stood up and shouted about how vendors magically can patch complex products in far less time than it likely took Microsoft to write their own patch for the flaw.
Such is life, I guess...
/P
Mr. Hugmup is trying to do some of the Apple's dirty work... go and recruit somewhere else man, let the people chose what ever they want to run...it is free country!!! Just because you pretend to be Microsoft Employee...you think people will NOT see through your BS. If you are frustrated that many companies will not write software for Mac because of the small market share...you can always emulate Windows haha. Darn French...they write the best design software on the planet ( CAD -CATIA) and yet it doesn't run on Mac ...how sad is that???? I own both Mac and Windows and...I can care less what others will run!!! It is free society....stop turning nice blogs like this into recruiting tools!!!
Come on...the stupid program is doing exactly what was designed to do!!! If hits everyone else but computers with IP addresses linked to Ukraine... there is peace of code that is making sure of that!!!
I would bet my last dollar that the writer of this worm is sitting somewhere in Ukraine and counting money right now!!! I am impressed with level of sophistication that this worm has...I hate to say it but this guy is good!!!!!
Mr. Hugmup is trying to do some of the Apple's dirty work... go and recruit somewhere else man, let the people chose what ever they want to run...it is free country!!! Just because you pretend to be Microsoft Employee...you think people will NOT see through your BS. If you are frustrated that many companies will not write software for Mac because of the small market share...you can always emulate Windows haha. Darn French...they write the best design software on the planet ( CAD -CATIA) and yet it doesn't run on Mac ...how sad is that???? I own both Mac and Windows and...I can care less what others will run!!! It is free society....stop turning nice blogs like this into recruiting tools!!!
This is why Windows is so crappy. It gets raped and the user doesn't even know about it.
Microsoft can do its customers a favor and help them migrate over to either Ubuntu or OS X.
Goodbye Windows, R.I.P.
<br />
<br />Mark my words: By the year 2015 protecting your pc will be a law, like having car insurence. Idiots that know nothing about computers, that don't update their os, or even have secruity software installed should have their pc's revoked. They do billions of dollars in damage to our economy every year and drive up prices in general for the rest of us. Either require these morons to fix their pc and learn to use it right. (make them get a license) or just take it away.
</p><p>
[Content edited to remove personal attack.]
R I P, brian.
Apple has much more market share now (I will not speculate percentage numbers here, it would not be accurate to do so).
Since many Apple customers dual boot into Windows on their Macs (including universities and many other businesses including small enterprise) means that while Apple is gaining ground, the dual boot means that Microsoft will continue to do well in the Operating System business, but has lost allot of ground in certain demographic markets.
Ubuntu may be gaining market share as some PC manufacturers are selling PC systems running Ubuntu as opposed to Windows.
While no operating system is perfect (Windows, OS X and Ubuntu), you take certain risks, hence why the dual boot option on the Apple platform is not just a trend here, but more importantly a strategy.
My prediction for 2009 is for Google to release an operating system for desktop and notebook computers.
- by pctec100 December 2, 2008 7:33 AM PST
- I hope my PII isn't held by any of these companies that are not patching their systems, running A/V and firewalling their client systems to prevent this sort of thing. Really, it's been over a month and a half since that patch was released. There is no excuse for such irresponsible business practices on the part of the companies impacted by this.
- Like this Reply to this comment
-
(40 Comments)