Conficker, the Internet's No. 1 threat, gets an update
Worm uses P2P file, seeks to control more machines, researchers say
IDG News Service - Security researchers say a worm that has infected millions of computers worldwide has been reprogrammed to strengthen its defenses while also trying to attack more machines.
Conficker, which takes advantage of a vulnerability in Microsoft's software, has infected at least 3 million PCs and possibly as many as 12 million, making it into a huge botnet and one of the most severe computer security problems in recent years.
Botnets can be used to send spam and attack other Web sites, but they need to be able to receive new instructions. Conficker can do this two ways: It can either try to visit a Web site and pick up instructions or it can receive a file over its custom-built encrypted peer-to-peer (P2P) network.
Over the past day or so, researchers at Websense and Trend Micro said some PCs infected with Conficker received a binary file over P2P. Conficker's controllers have been hampered by efforts of the security community to get directions via a Web site, so they are now using the P2P function, said Rik Ferguson, senior security adviser for Trend Micro.
The new binary tells Conficker to start scanning for other computers that haven't patched the Microsoft vulnerability, Ferguson said. A previous update turned that capability off, which hinted that Conficker's controllers maybe thought the botnet had grown too large.
But now, "it certainly indicates [Conficker's authors] are seeking to control more machines," Ferguson said.
The new update also tells Conficker to contact MySpace.com, MSN.com, eBay.com, CNN.com and AOL.com apparently to confirm that the infected machine is connected to the Internet, Ferguson said. It also blocks infected PCs from visiting some Web sites. Previous Conficker versions wouldn't let people browse to the Web sites of security companies.
In another twist, the binary appears to be programmed to stop running on May 3, which will shut off the new functions, he said.
It's not the first time Conficker has been coded with time-based instructions. Computer security experts were bracing for catastrophe on April 1, when Conficker was scheduled to try to visit 500 of some 50,000 random Web sites generated by an internal algorithm in order to get new instructions, but the day passed without incident.
Also worrying is that the new update tells Conficker to contact a domain that is known to be affiliated with another botnet, called Waledec, Ferguson said. The Waledec botnet grew in a fashion that was similar to the Storm worm, another large botnet that has now faded but was used to send spam. It means that perhaps the same group could be linked to all three botnets, Ferguson said.
- Researchers turn Conficker's own P2P protocol against itself
- Conficker botnet could flood Web with spam
- IT was ready for April 1 Conficker attack
- Conficker, the Internet's No. 1 threat, gets an update
- IT Blogwatch: Conficker botnet wakes up and smells the coffee
- Conficker's makers lose big, expert says
- Conficker activation passes quietly, but threat isn't over
- FAQ: Just the facts on Conficker
- The State of Video Conferencing Security Video conferencing equipment, found in almost every boardroom around the world, may be opening up companies to serious security breaches. This paper explains...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Cybersecurity for Dummies eBook This book provides an in-depth examination of real-world attacks and APTs, the shortcomings of legacy security solutions, the capabilities of next-generation firewalls, and...
- 10 Things Your Next Firewall Must do Next-Generation Firewalls Defined
- What are the desktop virtualization market trends and how can you successfully deploy your solution? You've probably heard about desktop virtualization -- and some of its benefits -- things like tighter security, streamlined management and lower costs. But...
- The Value of Symantec NetBackup Appliances In this video, Symantec's Shelley Schmokel, Principal Product Manager for NetBackup Appliances, talks about the NetBackup Integrated Appliances and how they deliver enterprise-class... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!