Conficker Threat: Fact or Fiction

I’ve been writing about the Conficker worm all week and I’m pleased that nobody has accused me of over blowing the situation. My main goal has been to encourage folks to take the same steps to protect themselves as they should be doing every other day of the year.

Most of Conficker stories late in the week have been discussions on if the media has over sold the story and created an atmosphere of fear. According to The Last WatchDog on Internet Security…

“Many security experts are downplaying the significance of  millions of Conficker-infected PCs initiating an elaborate calling home sequence on April 1.

Still, concerns are growing  about the much firmer grip the bad guys are on the cusp of securing on the corrupted PCs, whether or not they choose to do anything with them on April Fools Day.”

Here are some facts I believe to be true.

USA TODAY: On that date (April 1st) all Conficker-infected PCs will begin trying to connect to 50,000 web domains to receive further instructions.

F-Secure: “The worm has some peer-to-peer functionality which means that infected computers can communicate with each other without the need for a server. This enables the worm to update itself without the need for any of the 250 or 50,000 domains.”

So, what’s it going to do?  Will the Internet be taken down?  Will a cyberterror attack be launched?  I doubt it.  What people will notice the most are news stories about Conficker. For most of the world, it will be March 31^st when computers in China think it’s April 1^st. So by Tuesday night malware researchers will be able to provide more information.

SRI Internationals Paul Porras has been quoted in many articles as saying...

“April 1 is what Conficker researchers are calling a trigger date, when the worm will switch the way it looks for software updates. The worm has already had several such trigger dates, including Jan. 1, none of which had any direct impact on IT operations…”

This evaluation makes the most sense and fits with the typical behavior of the sophisticated malware that I’ve been researching. The trend lately has been to create massive botnets or what F-Secure reports as GhostNets. The big news today is how “Canadian research uncovers cyber espionage network”. Go Canada!

Bottom line, your computer is a powerful device. Just like your automobile you need to keep your doors locked, provide regular maintenance and don’t put yourself into dangerous situations.

Security Garden: Conficker Information for the Home Computer User  March 27th, 2009

 

Read More

Real Conficker Danger is on March 31st

Yesterday, I wrote about the Conficker worm and how it was expected to launch a new attack on April 1^st.  I showed you the reverse engineered code which included a specific date stamp of April 1^st, 2009.

What I forgot, and what everyone else missed is the real danger begins on March 31^st. I woke up this morning remembering that sometime in the world, it’s already tomorrow.

Many years ago I distributed my free WinPatrol program as something called Birthdayware.  On  my birthday each year a message would pop up inviting folks to thank me by wishing me a happy birthday.

Birthdayware Easter Egg

To my surprise, the day before my birthday Emails started to flood my inbox. At first I thought a lot of people had their PC clocks screwed up. Then I looked at the Emails and saw they came from Philippines, Australia, Japan and other countries across the international date line.

It will be March 31^st in most parts of the world when it turns April 1^st across the Pacific. Most reports have indicated a majority of machines currently infected with Conficker are in China. 

Forget April Fools Day and make sure you take steps to protect yourself before March 31^st. Somewhere in the world it will be April 1^st for nearly 48 hours.

Read More

Conficker Judgement Day on April 1st

I would never want to be labeled as an “Alarmist’ but I hope my post today will make some folks take some reasonable steps to protect themselves.  After a lot of research and debate I have been convinced that April 1^st is not going to be a good day for the Internet.

I’ve written about the Conficker worm (alias Downadup) a number of times and this may not be the last time I mention it.  There are well over a million Windows PC’s which are currently infected with Conficker.  On April 1^st the infected machines will be reaching out to number of web domains to download an additional component which will contain new instructions. How Conficker will mutate is anyones guess. It could be anything from turning a machine into a spam-bot or launching a widespread cyberterror attack. My guess it will be something designed to make money.

Reverse engineering Conficker exposes April 1st

Complements of Zarestel Ferrer

April 1st will be a day that shows us who's winning the battle against malware.  If your machine doesn't already have all the Windows security patches installed ,I'd unplug from the Internet on April Fools Day. Getting a new computer?  If a new un-patched computer arrives on that day I'd wait until the 2nd before connecting it to the Internet.

So, if you’ve been planning on running the Windows Update service, this would be a good week to do it. If you don’t have a routine back-up plan you might want to back up your important data by the end of the month.

I’m really not trying to be Chicken Little and freak people out. I’m not predicting any kind of global outage. I’m just suggesting that a properly patched Window system is good idea. I’m also not trying to scare you into upgrading to my WinPatrol PLUS to protect yourself. The free version offers just as much protection against this threat.  The key point here is to make sure you have all the security patches available for free from Microsoft.

I’m actually flying to Washington Dulles Airport on April 1^st so I really hope that United Airlines has all their systems protected. 

Update: Real Conficker Danger is on March 31st
It's important to point out that April 1st begins earlier in other parts of the world.  We'll be watching for activity to begin on March 31st from Austrailia, China, Japan, etc...

Update 3/29: Conficker Fact or Fiction

References:

SRI International Conficker C Analysis March 19^th, 2009

CA Security Research Blog

The Last Watch: Countdown to Conficker...

Internet Storm Center: Third party info on conficker

Microsoft: Virus alert about the Win32/Conficker.B worm

Microsoft’s Malicious Software Removal Tool

Microsoft Security Bulletin MS08–067  October 23^rd, 2008

F-Secure WebLog Conficker Q&A  March 26,2009

Leaked Memo says Conficker Pwns Parliament

 

Read More

Protection is Here for Win32/Conficker.A and .B

Has your computer been infected recently?
Last month I wrote about the Conflicker Infection that has been the topic of many security experts.  Anyone who received an update patch from Microsoft last fall should be safe but apparently, plenty of people aren’t updating regularly.

Microsoft has recognized this infection is still around and has provided a fix along with additional information at http://www.microsoft.com/protect/computer/viruses/worms/conficker.mspx Thanks to Brett Roberts in Auckland, New Zealand for the tip.

Is it that bad?
The French publisher Libération has reported the Conficker worm disrupted computers used by the Ministry of Defense in France and grounded the Navy's Dassault Rafale aircraft.

Last Friday the City of Houston Courts System had been infected and shut itself down for the day.  While they expect the court system to be up and running on Monday, many expect to find Conficker popping up on other city systems. While I typically recommend waiting a week or so for Microsoft’s Windows Updates, this is one update too many people missed.

Additional Help
If you use OpenDNS, which I recommended last year, you’ll soon have additional protection.  Starting Monday, OpenDNS will offer a feature to help administrators detect local machines which have been infected and will block machines from phoning home their payload. This is an entirely new direction for OpenDNS but given the scope of Conficker I think they may be on the right track. If you missed my post on OpenDNS you can read more at http://billpstudios.blogspot.com/2008/03/speed-up-internet-access-with-opendns.html

Update 2/10: Reports out of Houston now indicate the city's infection was in fact W32/Virut.n a variant of the virus Virut. This is contrary to news stories still being filed. The city had been using antivirus software from McAfee which did not include a signature file for this infection. Total down time was 4 days.

PC World reports, OpenDNS has partnered with our comrades at Kaspersky to obtain updated lists of malicious IP addesses.

Update 2/12: To show how serious they think Conficker is, Microsoft has announced a $250,000 reward towards the arrest and conviction of the folks responsible for this virus.
http://www.microsoft.com/Presspass/press/2009/feb09/02-12ConfickerPR.mspx 

Update 3/26:
 Conficker Judgement Day on April 1st

 Real Conficker Danger is March 31st

 

Read More