Print 16 comment(s) - last by mindless1.. on Feb 24 at 5:57 PM

Infamous botnet evolves

Controllers of the infamous Conficker worm released another update recently, shifting its update strategy towards a completely different direction. It no longer needs to check a web page to receive updates, as it can now receive them directly from other infected computers.

Additions to a lengthy, in-depth analysis of the worm by research institute SRI’s Malware Threat Center indicate that a new variant of Conficker was spotted on February 16, which it dubbed “Conficker B++” pending a further review of its capabilities.

Previously, computers infected with Conficker A and B – also known under the names Downadup or Kido – frequently check for updates from a randomly-generated list of 250 internet domains, which is synchronized and updated regularly between the entire Conficker botnet. Efforts from the Microsoft-led Conficker Cabal appear to have foiled this technique: the randomization algorithm was successfully reverse-engineered, prompting Microsoft and the Cabal to secure every domain the group expects the botnet to hit.

In response, Conficker B++ completely removes the need to check for updates, moving instead towards a structure that resembles a peer-to-peer filesharing network. A URL pointing to updated Conficker code – or a patched version of the Conficker binary – can be sent directly to infected machines through a pair of new backdoors that B++ opens.

SRI notes that while older versions of Conficker also had the ability to accept updates in this fashion, its implementation behaved in such a way that made recognizing the process a trivial affair for anti-malware software.

Conficker’s controllers, in an effort to prevent competing hackers from delivering patches of their own, digitally sign the entire update process.

Compared to the upgrade from Conficker A to Conficker B, writes SRI, the changes that Conficker B++ introduces appear to be a relatively “minor”. In-house metrics indicate that Conficker B++ had an “86.4% similarity” to Conficker B, with the update only modifying three of the original version’s 297 subroutines and adding an additional 39.

Conficker has become such a problem for businesses that Microsoft recently placed a $250,000 bounty on its creators, offering a share of the reward to anyone who can help track them down. In January, the worm spread so fast it infected 8 million business computers within a week.

Comments     Threshold

This article is over a month old, voting and posting comments is disabled

Why not sue / arrest their supporters?
By Belard on 2/24/2009 10:26:20 AM , Rating: 2
Many of the malware programs - which advertise or prompt you to pay for their "services" such as with their fake-anti-virus software - have a business name and a credit-card / bank account. Some of these pests are advertising with a product/service to buy.

Sue those companies/people who have their payloads added to these worms/malware/whatever programs.

Some of these jerks are really stupid. Like how we all have pop-up stoppers built-into our browsers now. But those tools had to be improved as these jerks would find ways around them. Gee.. guess what, if I have a POP-UP stopper, what makes YOU think I'm going to buy something from you because your circumvent my program that is supposed to keep you out of my face?

So rather than trying to locate these ad-groups, the govts and citizents should file suit against companies that support them.

By mindless1 on 2/24/2009 5:57:39 PM , Rating: 2
I'd imagine the money gets transferred around a lot, plus with the international borders and numbered accounts you might find the criminals aren't so easily brought to court nor funds seized.

"What would I do? I'd shut it down and give the money back to the shareholders." -- Michael Dell, after being asked what to do with Apple Computer in 1997
Related Articles

Copyright 2016 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki