conficker worm and the first of april

abu Hasan

Administrator
some are dismissing the threat as hype and panic; but if microsoft is offering $250,000 for information on the authors of the worm, it does not augur well.

the security community is anxious about this sophisticated worm and the potential of the worm to do damage.

one news-site captures it thus:
"But the big news with C is that the code is scheduled to come alive on April 1 and start contacting the 50,000 domains and download something. What will they download? What will it make the bots do? Honestly, nobody knows. This is the great mystery."
and they round it off with:
"Conficker is really sophisticated as malware goes. It's clear that its authors are smart people and perhaps that's what's got security people worried. But the only rational way to approach this is to do the things you know you need to do anyway and then not get hung up on it. Remember, there's a very good chance that on April 1 nothing much will happen."
---
an excellent summary can be found here.

a full analysis (the best on the worm so far) from SRI can be found here.

microsoft tries to talk.

new york times article.

advice from eset.

SANS has a list of advisories

symantec's analysis: the downadup codex. [warning: PDF link, 5.5MB]

-----------------------
 
Last edited:
anything in plain english would help, do we need to do anything to keep ourself safe. save us the pain of going through that. ( although i used to at one time )
 
okay, plain english:

assume that you live in a cozy cottage (yes, yes. it has windows too). the locks on your door are pretty awful. and you don't bother to see who gets in or out of your home while you are tending to your garden.

the trouble is that millions of people are like you - nice and careless; and they live in millions of cottages identical to yours.

now, your window had a malfunctioning latch which could be pushed to get into your cottage. rumor has it that many cottages were broken into in the last three months.

the company that made the windows identified that the latch required a nail* and they hurried to distribute the nails. some people used the nails immediately. but many others ignored it. [and you were among those who ignored it].

suddenly, a harmless looking animal appeared inside your cottage. the animal seemed to know its way well around your house and for an animal, it was surprisingly very adroit in finding all your weapons and throwing them in places where you could not reach. later, the animal seemed to give out a wail (as if it was signaling) at intervals.

the window manufacturer raised a huge cry and called out the pest control people and they listened to the wails closely. the wails seemed to be directed at certain mud hills around the place. suddenly the next day, the animal looked different; as if someone had given it a trim. it looked sleeker and much more stern.

the third day, the animal had a button sprouted upon it which said: 1st April 2009.

you ask: what then? exactly. that is the point: what? is it a bomb dressed as an animal? is it a trojan which will split open and the amazon army ants march out of it? is it a jack-in-the-box for prank value? is it just another camouflaged doggie that will leave stinky poo (spam) everywhere in your bedroom? or suddenly all these animals transform into something else in a grand co-ordinated attack?

nobody knows...at least, yet.

the skill with which, this animal has implanted itself in millions of homes is frightening. use prescribed pesticides and kill the animal. find the nail and fix the latch.

----------------------
plainer english (plainer than the plainest plain):

windows had a vulnerability. a worm conficker/downadup appeared that exploits this vulnerability. microsoft released an emergency patch (067) but it was too late. millions of machines were/are still unpatched. meanwhile the worm spread silently. the worm is apparently written by very very smart folk (it is not known if it is one or many individuals) and is executed superbly. the authors have not just superior knowledge but are at the cutting edge of technology.

these worms began phoning home to some domains indicating their presence; when microsoft/security cabal tried to thwart it, the authors revised the code. initially, it was programmed to contact 500 rendezvous points on the net, but when MS-verisign-icann blocked the domains, the worm was updated to contact 50,000 domains!

the worm is encrypted and only the true masters of this worm can control it. april 1st is supposed to be the activation date. 12 million machines are infected and at the disposal to do the conficker-authors' bidding.

no one knows what will happen on the 1st - if at all something happens. it is quite possible that nothing might happen. we can just wait and see.

----------------------------------
things you can do as a favor to yourself:

- backup your data (the worm could try to erase your hard disk among other possibilities)

- use an antivirus and keep it up to date

- use the bitdefender tool to see if conficker is present on your systems

- download the 067 patch and apply it immediately

- always download software from reputed sites

- do not open mail - particularly attachments - if you do not know the sender.

- post updates in this thread if you come across unpleasant news.

and most importantly: DON'T PANIC




-------------------------
*for want of a nail, a kingdom was lost. for want of a patch, the OS war was lost.
 
Last edited:
within the security community, fireworks were anyway not expected on the 1st. we don't know what the authors have in mind. don't think that the worm has lost its damaging potential with the date gone.
 
Back
Top