Ads by TechWords

See your link here
Receive the latest technology news and information.
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

Microsoft, Symantec, VeriSign join forces to fight Downadup worm

Microsoft offers $250,000 for info on hackers; ICANN involved in effort, too

February 12, 2009 12:00 PM ET

Active Comments
ken says: At this rate of growth there could very soon be 1.5 billion computers waiting to do something that could be...
EdSf says: Pre-empting it by pre-registering domain names? At which point the Registrar obviously makes money? Call me stupid but that just...


Computerworld - Nearly 20 technology companies and organizations are combining forces to disrupt the command-and-control infrastructure of the rapidly spreading Downadup worm, prompted by infection rates of nearly 2.2 million machines each day.

Firms, including Microsoft Corp., Symantec Corp. and VeriSign Inc., have joined ICANN, the nonprofit group that manages the Internet Domain Name System, to preemptively register and remove from circulation the Internet addresses that the worm's controllers use to maintain their hold on infected machines, said Gerry Egan, director of product management in Symantec's security response group.

Separately, Microsoft has offered a $250,000 reward for information that results in the arrest and conviction of the hackers who created and launched the worm.

Although Microsoft launched its hacker bounty program in 2003, it has rarely used the $5 million it set aside at the time. The last time it offered a reward was in 2004, when it posted a quarter-million-dollar bounty on the maker of the Sasser worm. A German teenager was arrested in May 2004 and charged with creating Sasser. The following year, Microsoft paid out the reward to two people who helped identify the hacker.

Perhaps not coincidentally, security researchers -- including those at Symantec -- have recently drawn comparisons between Sasser and Downadup, which also goes by the name "Conficker." Much of those comparisons relate to the size of the current attack, as well as the fact that the worm targets a wide-scale Microsoft vulnerability.

To stymie Downadup, the coalition plans to either pre-register or remove from circulation as many of the 250 different domains that the worm uses as possible, said Egan. "We're working with the domain registrars to take them out," he said. "It's a combination of registering the domains and removing them from circulation."

Once it has infected a PC, Downadup generates a list of 250 possible domains -- the list changes daily -- selects one, then uses that URL to reach a malicious server from which it downloads additional malware to install on the hijacked computer. Symantec and other security vendors, including Helsinki, Finland-based F-Secure Corp., have been preemptively registering some of those domains for weeks. They have then monitored the domains to get an idea of the worm's back-end processes and to track its spread.



Jump to comments

Microsoft

Additional Resources

Xerox
By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!
Microsoft
Save time and mitigate security risk. Deploy it now.
Sybase
In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

What People Are Saying

White Papers & Webcasts

Share our Strength
Download Now  

Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...

Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.

Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...