Wikipedia

Conficker

This is an old revision of this page, as edited by 91.199.104.3 (talk) at 14:28, 25 March 2009 (→Patching and removal). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Conficker, also known as Downup, Downadup and Kido, is a computer worm that surfaced in October 2008 and targets the Microsoft Windows operating system.[1] The worm exploits a known vulnerability in the Windows Server service used by Windows 2000, Windows XP, Windows Vista, Windows Server 2003, Windows Server 2008, and the Windows 7 Beta.[2][3][4]

Conficker
Alias
TypeComputer Worm
SubtypeComputer Virus
ClassificationHighly Dangerous
Authors<Unknown>

Operation

The Conficker worm spreads itself primarily through a buffer overflow vulnerability in the Server Service on Windows computers. The worm uses a specially crafted RPC request to execute code on the target computer.[5]

When executed on a computer, Conficker disables a number of system services such as Windows Automatic Update, Windows Security Center, Windows Defender and Windows Error Reporting.

It receives further instructions by connecting to a server. The instructions it receives may include to propagate, gather personal information and to download and install additional malware onto the victim's computer.[6] The worm also attaches itself to certain Windows processes such as svchost.exe, explorer.exe and services.exe.[7]

The worm seems to implement some of the ideas presented by Fucs, Paes de Barros e Pereira at the Blackhat Briefings Europe 2007, specifically: digitally signed additional payload, use of PRNG for communication and P2P communication.[8]

Payload

The "A" variant of Conficker will create an HTTP server and open a random port between 1024 and 10000. If the remote machine is exploited successfully, the victim will connect back to the HTTP server and download a worm copy. It will also reset System Restore points, and download files to the target computer.[9]

Symptoms of infection

  • Account lockout policies being reset automatically.
  • Certain Microsoft Windows services such as Automatic Updates, Background Intelligent Transfer Service (BITS), Windows Defender and Error Reporting Services are automatically disabled.
  • Domain controllers respond slowly to client requests.
  • System network gets unusually congested. This can be checked with network traffic chart on Windows Task Manager.
  • On websites related to antivirus software, Windows system updates cannot be accessed.[10]
  • Launches a brute force dictionary attack against administrator passwords to help it spread through ADMIN$ shares, making choice of sensible passwords advisable.[11]

Impact

Experts say it is the worst infection since the SQL Slammer.[12] Estimates of the number of computers infected range from almost 9 million PCs[13][14] to 15 million computers.[15]

Another antivirus software vendor, Panda Security, reported that of the 2 million computers analyzed through ActiveScan, around 115,000 (6%) were infected with this malware.[16]

The potential scale of infection is large because 30 percent of Windows computers do not have the Microsoft Windows patch released in October 2008 to block this vulnerability.[17]

The U.K. Ministry of Defence reported that some of its major systems and desktops were infected. The worm has spread across administrative offices, NavyStar/N* desktops aboard various Royal Navy warships and Royal Navy submarines, and Hospitals across the city of Sheffield reported infection of over 800 computers.[18][19]

On February 6, 2009, the computers used by the Houston Municipal Courts were infected with Conficker. How the virus got into the system is unknown.[20]

On February 13 the Bundeswehr reported that some hundred of their computers were infected.[21]

Response

On February 12, 2009, Microsoft announced the formation of a technology industry collaboration to combat the effects of Conficker. Organizations involved in this collaborative effort include Microsoft, Afilias, ICANN, Neustar, Verisign, CNNIC, Public Internet Registry, Global Domains International, Inc., M1D Global, AOL, Symantec, F-Secure, ISC, researchers from Georgia Tech, The Shadowserver Foundation, Arbor Networks and Support Intelligence.

As of February 13, 2009, Microsoft is offering a $250,000 USD reward for information leading to the arrest and conviction of the criminals behind the creation and/or distribution of Conficker.[22][23][24][25][26][27]

Patching and removal

On 15 October 2008 Microsoft released a patch (MS08-067) to fix the vulnerability.[28] Removal tools are available from Microsoft,[29] BitDefender,[30] ESET, Symantec,[31] Sophos,[32] and Kaspersky Lab,[33] while McAfee and AVG can remove it with an on-demand scan.[34][35] While Microsoft has released patches for the later Windows XP Service Packs 2 and 3 and Windows 2000 SP4 and Vista, it has not released any patch for Windows XP Service Pack 1 or earlier versions (excluding Windows 2000 SP4), as the support period for these service packs has expired. Since the virus can spread via USB drives that trigger AutoRun, disabling the AutoRun feature for external media (through modifying the Windows Registry) is recommended.[36] However the United States Computer Emergency Readiness Team describe Microsoft's guidelines on disabling Autorun as being "not fully effective," and they provide their own guides.[37] Microsoft has released a removal guide for the worm via the Microsoft website.

Also, on March 16, 2009, BitDefender released an updated tool to remove the already famous Downadup/Conficker worm on a new domain that has not been blocked by the malicious computer code at a website called "bdtools.net".

Apart from the fact that the BitDefender tool removes the latest and most resilient to disinfection release of the virus, it also comes as a separate installer dedicated to network administrators. In this way, the scanner can be dispatched throughout networks in order to remotely scan and disinfect workstations.

See also

References

  1. ^ "Three million hit by Windows worm". BBC News Online. BBC. 2009-01-16. Retrieved 2009-01-16.
  2. ^ Conficker worm still wreaking havoc on Windows systems. Government Computer News. January 15, 2009.
  3. ^ Windows 7 Beta is not immune conficker. Digital world. January 29, 2009.
  4. ^ $250,000 Reward for the Author of Nasty Worm Affecting Windows 7, Vista, and XP. Softpedia. February 13,2009.
  5. ^ http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4250
  6. ^ "Conficker Worm Attack Getting Worse: Here's How to Protect Yourself". PC World. 2009-01-17. Retrieved 2009-01-18. {{cite web}}: |first= missing |last= (help)
  7. ^ "F-Secure Malware Information Pages". F-secure. Retrieved 2009-01-18.
  8. ^ "New botnets trends and threats" (PDF). BlackHat. Retrieved 2009-03-10.
  9. ^ http://www.microsoft.com/security/portal/Entry.aspx?Name=Worm%3aWin32%2fConficker.A
  10. ^ "Virus alert about the Win32/Conficker.B worm". Microsoft. 2009-01-15. Retrieved 2009-01-22.
  11. ^ "Passwords used by the Conficker worm". Sophos. Retrieved 2009-01-16.
  12. ^ Markoff, John (2009-01-22). "Worm Infects Millions of Computers Worldwide". New York Times.{{cite news}}: CS1 maint: date and year (link)
  13. ^ Sean (2009-01-16). "Preemptive Blocklist and More Downadup Numbers". F-Secure. Retrieved 2009-01-16.
  14. ^ Neild, Barry (16 January 2009). "Downadup virus exposes millions of PCs to hijack". CNN. Retrieved 2009-01-18.
  15. ^ "Virus strikes 15 million PCs". UPI.com. 2009-01-26. Retrieved 2009-03-25.
  16. ^ Panda Security (2009-01-21). "Six percent of computers scanned by Panda Security are infected by the Conficker worm". Panda Security. Retrieved 2009-01-21.
  17. ^ "Three in 10 Windows PCs still vulnerable to Conficker exploit". The Register. 19 January 2009. Retrieved 2009-01-20. {{cite news}}: |first= missing |last= (help)
  18. ^ "MoD networks still malware-plagued after two weeks". The Register. 20 January 2009. Retrieved 2009-01-20.
  19. ^ "Conficker seizes city's hospital network". The Register. 2009-01-20. Retrieved 2009-01-20. {{cite news}}: |first= missing |last= (help)
  20. ^ http://www.chron.com/disp/story.mpl/front/6250411.html[dead link]
  21. ^ Conficker Worm infect hundreds of bundeswher computers. Date accessed: March 15, 2009.
  22. ^ http://www.cnn.com/2009/TECH/ptech/02/13/virus.downadup/index.html
  23. ^ Microsoft announces industry alliance, $250k reward to combat Conflicker. Zero Day. February 12, 2009.
  24. ^ Microsoft offers $250,000 reward for Comficker arrest. CNET News. February 12, 2009.
  25. ^ Microsoft announces $250,000 Conficker worm bounty. Network World. February 12, 2009
  26. ^ Microsoft offers $250,000 bounty for capture of Conficker worm creator. Guardian.co.uk. Februaury 13, 2009
  27. ^ "Microsoft bounty for worm creator". BBC. 2009-02-13. Retrieved 2009-02-13. {{cite news}}: |first= missing |last= (help)
  28. ^ "Microsoft Security Bulletin MS08-067". 2008-10-23. Retrieved 2009-01-19.
  29. ^ http://www.microsoft.com/security/malwareremove/default.mspx,
  30. ^ http://www.bitdefender.com/VIRUS-1000462-en--Win32.Worm.Downadup.Gen.html
  31. ^ http://www.symantec.com/security_response/writeup.jsp?docid=2008-112203-2408-99&tabid=3
  32. ^ http://www.sophos.com/support/knowledgebase/article/51416.html
  33. ^ http://support.kaspersky.com/faq/?qid=208279973 How to fight network worm Net-Worm.Win32.Kido
  34. ^ http://vil.nai.com/vil/content/v_153464.htm
  35. ^ http://www.viruslist.com/en/alerts?alertid=203996089
  36. ^ "MS08-067 Worm, Downadup/Conflicker". Retrieved 2009-01-08.
  37. ^ "Microsoft Windows Does Not Disable AutoRun Properly". US-CERT. January 29, 2009. Retrieved 2009-02-16.
 
Wikinews has related news:
Retrieved from "https://en.wikipedia.org/w/index.php?title=Conficker&oldid=279587029"