Conficker wakes up, updates via P2P, drops payload
This story has been updated. See below for details.
The Conficker worm is finally doing something--updating via peer-to-peer between infected computers and dropping a mystery payload on infected computers, Trend Micro said on Wednesday.
Researchers were analyzing the code of the software that is being dropped onto infected computers but suspect that it is a keystroke logger or some other program designed to steal sensitive data off the machine, said David Perry, global director of security education at Trend Micro.
The software appeared to be a .sys component hiding behind a rootkit, which is software that is designed to hide the fact that a computer has been compromised, according to Trend Micro. The software is heavily encrypted, which makes code analysis difficult, the researchers said.
The worm also tries to connect to MySpace.com, MSN.com, eBay.com, CNN.com and AOL.com as a way to test that the computer has Internet connectivity, deletes all traces of itself in the host machine, and is set to shut down on May 3, according to the TrendLabs Malware Blog.
Because infected computers are receiving the new component in a staggered manner rather than all at once there should be no disruption to the Web sites the computers visit, said Paul Ferguson, advanced threats researcher for Trend Micro.
"After May 3, it shuts down and won't do any replication," Perry said. However, infected computers could still be remotely controlled to do something else, he added.
Last night Trend Micro researchers noticed a new file in the Windows Temp folder and a huge encrypted TCP response from a known Conficker P2P IP node hosted in Korea.
"As expected, the P2P communications of the Downad/Conficker botnet may have just been used to serve an update, and not via HTTP," the blog post says. "The Conficker/Downad P2P communications is now running in full swing!"
In addition to adding the new propagation functionality, Conficker communicates with servers that are associated with the Waledac family of malware and its Storm botnet, according to a separate blog post by Trend Micro security researcher Rik Ferguson.
The worm tries to access a known Waledac domain and download another encrypted file, the researchers said.
Conficker.C failed to make a splash a week ago despite the fact that it was programmed to activate on April 1. It has infected between 3 million and 12 million computers, according to Perry.
Initially, researchers thought they were seeing a new variant of the Conficker worm, but now they believe it is merely a new component of the worm.
The worm spreads via a hole in Windows that Microsoft patched in October, as well as through removable storage devices and network shares with weak passwords.
The worm disabled security software and blocks access to security Web sites. To check if your computer is infected you can use this Conficker Eye Chart or this site at the University of Bonn.
For more information, listen to Larry Magid's audio interview with Perry.
Updated 7:50 p.m. PDT: Added that the software that's dropped onto computers is hiding behind a rootkit.
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
" But enterprise users have been forgotten in that comment, as they can be fired for patching without testing - especially if the patch disrupts the production environment (not an unheard of scenario)!"
A company that waits six months before rolling out a critical security patch also would be looking for an IT director to fire for incompetence. Six months is more than enough time to patch. If you haven't done so by then, then it is highly unlikely it would ever be patched and that person needs to be relieved of their position.
LOL.
"...something is happening here
But you don't know what it is
Do you, Mister Jones?"
Of course, there's always the .1% left who know about updated antivirus software that doesn't cost money. That's the same group of people who updates dutifully with every patch, right?
Unfortunately, wrong. There are two types of Windows users who update every single time; those who are too dumb to know how to turn auto-updates off and those who realize that updates are a good thing and are really just a single item among many that is necessary in order to have a healthy OS. Unfortunate that so many IT professionals don't fall into either category. It's a field in which there's a lot of dead weight.
"Too many people that use computers daily are still too naive about good security protocol on the internet."
Sorry, but so are you as you are running Windows. The problem is not people having anti-virus software or not. It is not whether they are safe surfers or not. The problem is that Windows is utterly trivial to root once the malware is onto the system. The only way to be truly "safe" is not to use Windows, full stop. It is the worst OS out there in terms of design for security by a long, long, long chalk. There is no other OS that is such a brain-dead, truly idiotic design as Windows. It is impossible for MS to secure it properly because their underlying design ethos was and still is fundamentally flawed. The overhaul of their system design that they should have done for Vista never happened and it is never going to happen. MS continue to put sticking plasters and bandages where they need to do full blown amputations and as a result they are always going to lose - patch up one or two holes, but the other thousands are still there to be exploited and more are always discovered each day than are or can be fixed. You will never be safe if you continue to use Windows on the internet. Never.
Given the quality of the alternatives and the fact that they are all inherently secure *by design* there is simply no excuse to continue using Windows.
Uh Uh.. I'm fixin' ta rain all over your parade there. I update religiously, everything. But I don't want automatic updates on Windows. I want to look at the updates first to see what they do. Lots of people had probelms with AMD machines and the service pack updates because of automatic updates. I have NEVER run automatic updates. And I probably never will. I have a brain. I;m not too lazy to take a few minutes to check out an updates page.
If you don't have enough sense to check the Windows updates site, then I feel for you. I also read the security bulletins and the release notes. So be careful with your generalizations.
Just because you may not be using a Windows computer (hit by this particular worm) does NOT mean that you cannot help to spread malware. Please think about that fact carefully, Mac and other OS users. Downadup/conficker is just one of many threats.
Also, consider that the vast majority of PC's infected initially worldwide were those PC's using PIRATED software which cannot be patched from Microsoft because of piracy!
Reflecting on Conficker's creators, whoever they may be: they are NOT amateurs.
This isn't a hoax, a media scheme, or a pitch to make money by reputable security software vendors. To allege that (see snide comment above) is insulting to security professionals and the companies who help to protect you and the infrastructure that some people may take for granted.
I think that Conficker's creators are very patient, in this attack for the "long haul," and are likely profit-motivated. Their design appears to be long-term ownage, not just short-term. Expect more evolution from this one, IMHO. Pros are watching them.
@CheriSigmon
http://www.twitter.com/SecurityQ
2. Get a hardware firewall.
3. Run GWSCAN and write 0's to all hard drives on your computer.
4. Reinstall Windows.
5. Run patches.
6. Install the best AV software you can get (Kaspersky recommended for Windows users).
7. If you backed up data off of your computer and you know all patches are in place and your new AV software is in place and updated, you can try to restore your backup data.
This is very true and its why linux/unix systems are frequently targeted and why breeches are not uncommon.
Many hackers are committing identity thefts.
Sean R Kursawe
(http://blog.wired.com/27bstroke6/2009/03/will-conficker.html)
Send out an instruction payload over the Botnet containing the following programs: 1) Vulnerability scanning utility to identify security vulnerabilities on the PC 2) Software distributed binaries (peer to peer) containing patches 3) patching utilities to apply security related patches and OS updates to the PC 4) Utilities to restore the system, E.g. scripts to remove the utilities, remove the bot net installed control services, and attempt to remove any deep residual Botnet installed controllers/patches (in BIOS or EPROM, device firmware...)
RWL
could this RWL be the creator?
TrendLabs researcher Ivan Macalintal has this evening discovered a new variant of Downad/Conficker called WORM_DOWNAD.E spreading over the peer-to-peer functionality of the previous version of this now infamous worm.
Stay OFF FACEBOOK peeps! Stay AWAY from MySpace. We live in South Carolina, and when the National Weather Service tells us a Hurricane is heading our way and to get the 'ell outta Dodge, WE DO. Listen to the warnings, save your Data, but more imporatatnly, save your identities!!
GodSpeed
- by homey4u April 9, 2009 11:07 AM PDT
- They should put these cockroaches who run nasty programs like this on the Internet to be put on an plane
- Like this Reply to this comment
-
Showing 1 of 2 pages (57 Comments)then tossed over the sea to feed the sharks! Them low life skanks!