Microsoft, Symantec, VeriSign join forces to fight Downadup worm
Microsoft offers $250,000 for info on hackers; ICANN involved in effort, too
Computerworld - Nearly 20 technology companies and organizations are combining forces to disrupt the command-and-control infrastructure of the rapidly spreading Downadup worm, prompted by infection rates of nearly 2.2 million machines each day.
Firms, including Microsoft Corp., Symantec Corp. and VeriSign Inc., have joined ICANN, the nonprofit group that manages the Internet Domain Name System, to preemptively register and remove from circulation the Internet addresses that the worm's controllers use to maintain their hold on infected machines, said Gerry Egan, director of product management in Symantec's security response group.
Separately, Microsoft has offered a $250,000 reward for information that results in the arrest and conviction of the hackers who created and launched the worm.
Although Microsoft launched its hacker bounty program in 2003, it has rarely used the $5 million it set aside at the time. The last time it offered a reward was in 2004, when it posted a quarter-million-dollar bounty on the maker of the Sasser worm. A German teenager was arrested in May 2004 and charged with creating Sasser. The following year, Microsoft paid out the reward to two people who helped identify the hacker.
Perhaps not coincidentally, security researchers -- including those at Symantec -- have recently drawn comparisons between Sasser and Downadup, which also goes by the name "Conficker." Much of those comparisons relate to the size of the current attack, as well as the fact that the worm targets a wide-scale Microsoft vulnerability.
To stymie Downadup, the coalition plans to either pre-register or remove from circulation as many of the 250 different domains that the worm uses as possible, said Egan. "We're working with the domain registrars to take them out," he said. "It's a combination of registering the domains and removing them from circulation."
Once it has infected a PC, Downadup generates a list of 250 possible domains -- the list changes daily -- selects one, then uses that URL to reach a malicious server from which it downloads additional malware to install on the hijacked computer. Symantec and other security vendors, including Helsinki, Finland-based F-Secure Corp., have been preemptively registering some of those domains for weeks. They have then monitored the domains to get an idea of the worm's back-end processes and to track its spread.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts