Conficker begins stealthy update

The Conficker worm has started to update infected machines with a mystery package of data. 

Computer security firms watching the malicious program noticed that it sprang into life late on 8 April. 

The activity on its update system delivered encrypted software to compromised machines. It is not yet clear what the payload contains. 

The Conficker virus variants are thought to be present on millions of PCs around the world. 

Spam connection 

The updating activity has begun about a week later than expected. Analysis of the "C" variant of Conficker (aka Downadup) revealed that its updating mechanism was due to go live on 1 April. 

The belated updates were spotted by researchers for Trend Micro following the arrival of a new file in one of the directories in so-called "honeypot" machines deliberately seeded with Conficker C. 

Analysis showed that the file had arrived via the peer-to-peer file transfer system that infected machines use to communicate. 

In a bid to avoid alerting people to its activity, the update is slowly being trickled across the population of machines harbouring the C variant. Exact figures for the number of Conficker-infected machines are hard to determine, but the minimum is widely believed to be three million. 
 COMBATING CONFICKER 

Microsoft offers bounty for worm creator 
Q&A: How do I protect myself? 
Timeline: Conficker virus 


"The Conficker/Downad P2P communications is now running in full swing," wrote Ivan Macalintal from Trend Research on the company's security blog. 

Once it arrives on a machine, the package of data randomly checks one of five different websites - MySpace, MSN, eBay, CNN and AOL - to ensure its host still has net access and to confirm the current time and date. 

Following this check the data package removes all traces of its installation. 

The strong encryption on the payload has, so far, prevented detailed analysis of what it actually does. However, security experts speculate that it is a "rootkit" that will bury itself deep in Windows in order to steal saleable data such as bank website login details. 

Security researchers are continuing to analyse the payload to get a better idea of what it is intended to do. 

Symantec said it too had noticed the increased activity of Conficker and its analysis suggested a link with another well-known virus called Waledac. This malicious program steals sensitive data, turns PCs into spam relays and opens up a backdoor so the machine can be controlled remotely. 

The security firm noticed that the update also included an instruction to the worm to remove itself on 3 May, 2009. However, the Waledac imposed backdoor on the machine will remain open, so its creators can still control compromised PCs.

A Plan to Catch the Conficker Worm

On April 1, a computer worm called Conficker, which has already infected millions of machines worldwide, is expected to do something bad, though no one knows exactly what. Some experts fear that an army of infected machines could be ordered to launch a coordinated attack or send out a barrage of spam. But a tool released today could help lessen the impact by allowing big companies and institutions to quickly weed out infected machines by scanning entire networks for signs of infection.

Analysis of the Conficker worm has previously revealed that infected computers will "phone home" on April 1 to receive a new set of instructions. It is already possible to detect the worm by scanning machines individually, but this is a relatively time-consuming process. It's also possible to detect the bug by watching for outgoing communications sent across a network, but the latest version of Conficker is designed to stay silent until April 1.

Dan Kaminsky, director of penetration testing for the Seattle-based security company IOActive, helped create the new scanning tool and says that it can identify an infected machine by recognizing the way it presents itself to the wider network. This makes it quick and easy to scan for the worm remotely and does not require any special access to machines. "It's like driving through a neighborhood looking for houses with big signs on their doors," Kaminsky says. 

The tool was created after Tillmann Werner and Felix Leder, members of an independent research organization called the Honeynet Project, asked Kaminsky to review their research on Conficker. The pair had figured out that the worm changes the way a machine appears on a network. Kaminsky seized on this, suggesting that the researchers create a tool that uses this information to find infected machines. The researchers built such a tool and worked through the weekend to get it ready for broad distribution to suppliers of other security software. "Whatever vulnerability scanner a company is using, it should have support for this by the end of the day," Kaminsky says.
Bruce Schneier, chief security technology officer at BT Counterpane, says the new tool's ability to seek out the virus remotely should be useful, since it will let people scan a huge number of machines very quickly. This is important, Schneier says, because the worm is such a nasty pest. "Conficker is an extremely well-written, extremely well-designed, extremely well-executed worm," says Schneier. "It really is an impressive piece of work, and there's someone really smart behind it." But Schneier adds that it's important for computer users and administrators to protect their machines against a variety of malware, not just a single threat.

"If you've been running a good environment, you shouldn't be worried about this," says Rich Mogull, founder of the security-consulting company Securosis, who helped connect the Honeynet researchers and Kaminsky with network-security vendors over the weekend. Mogull notes that Microsoft has already released several patches that block the vulnerability that Conficker uses to infect a machine. However, he says that companies worried about Conficker should start scanning for it right away, after checking to see if their network-security tools have been updated. 

Kurt Rohloff, a scientist who studies Internet worms at the research and development company BBN Technologies, says that the tool could prove useful, though he doubts that there's time to find and neutralize every computer infected with the worm. Rohloff says that the new scanner could be used to take preventive action by identifying infected hosts and removing them from the network, though he admits that this approach is "drastic, because you're removing connectivity." 

Kaminsky notes that the tool is intended for organizations with large networks. For individuals, he says, the best approach is to make sure that the latest security updates are installed and up-to-date antivirus software is running. Since Conficker blocks a computer from accessing certain security websites, users could test for the worm by trying to visit those sites, Kaminsky says. Werner and Leder plan to release a paper within the next day, describing the technical details of their discovery.

Melissa virus turns 10

A decade ago there was no Facebook, no iPhone, and no Conficker. There was dial-up and AOL and a nasty virus called Melissa that ended up being the fastest spreading virus at the time. 

CNET News talked to Dmitry Graznov, a senior research architect at McAfee Avert Labs who was among the researchers who worked to fight the Melissa outbreak and track down the creator. 

Q: How was Melissa discovered? 
Graznov: Avert as a whole discovered it as did some of the competitors. It was submitted to us by customers as it started to spread around the world (on March 26, 1999). 

What made Melissa different from previous viruses?
Graznov: It was the first mass-mailing virus, which used e-mail to spread on a large scale.

What harm did the virus do?
Graznov: In some cases the load on the e-mail servers in some organizations was so high that the servers were effectively shut down. 

How many computers were affected and what did the virus do?
Graznov: Hundreds of thousands of computers were affected. That's a guess...Melissa infected other documents a user opened in Microsoft Word. It also connected to Outlook if it was running and selected 50 entries in the address book and e-mailed an infected document to those addresses...including mailing lists...As a result, the virus was sent not just to 50 people, but to thousands of people easily. We didn't have any firm numbers to go by, but we did have reports from customers saying their Exchange servers were overwhelmed.

How long did the outbreak last? 
Graznov: Several days, but the infections continued to be registered for a long time after that. It was just a macro virus and we were well equipped to provide detection and removal for people's computers even then...The fact that it was so widespread in the world already meant it took a long time to remove the infections.



Security researcher Dmitry Graznov as he looked in 1999 when he was chasing down the creator of the Melissa virus for McAfee Avert Labs.
(Credit: Dmitry Graznov)

How did the virus writer get caught?
Graznov: I was running, actually still am, a project called Usenet Virus Patrol, which scans Usenet articles for viruses. The author of Melissa posted the virus to a newsgroup called "alt.sex." It was zipped up and sent as if it was a list of passwords to like 80-something different porno sites...It was just bait to entice people into downloading it and opening it. Once it was opened, it started e-mailing itself around. It was relatively easy to go back and find the exact Usenet posting that started all this. In the header of the posting it was possible to find out not only the e-mail address from which it was sent but also the IP address of the computer from which it was sent. That IP was linked to an AOL account and from that the FBI subpoenaed AOL and they provided the dial-in logs...and found out what computer was assigned that IP address and from what telephone number the call was made. The AOL account was a compromised one...The phone call that used that account came from New Jersey and the FBI linked the phone number to a particular address. That is how they found the guy's computer...The data we provided them was the clue that led straight to the criminal. (David L. Smith pleaded guilty and was sentenced to 20 months in prison and $5,000 in fines.)

What was the motivation behind Melissa?
Graznov: There was no material gain. Back then, people didn't do it for money. They did it for mischief, for fame...Today there is huge money in computer crime...Back then, we had 200 times fewer pieces of malware than we have today.

Any comments on Conficker and Melissa and how far we've come?
Graznov: Conficker is a completely different type of thing. It's not a macro virus. It's an executable and a botnet, and it downloads lots of stuff on your computer. It's basically a network for sale. It can be rented out. It can be used for password stealing. Back in 1999 there wasn't such a thing as a business model for malware...Today, big money is involved in computer malware. You cannot even compare them.

MICROSOFT BOUNTY FOR WORM CREATOR

A reward of $250,000 (£172,000) has been offered by Microsoft to find who is behind the Downadup/Conficker virus. 

Since it started circulating in October 2008 the Conficker worm has managed to infect millions of computers worldwide. 

The software giant is offering the cash reward because it views the Conficker worm as a criminal attack. 

"People who write this malware have to be held accountable," said George Stathakopulos, of Microsoft's Trustworthy Computing Group. 

He told BBC News the company was "not prepared to sit back and let this kind of activity go unchecked". 

"Our message is very clear - whoever wrote this caused significant pain to our customers and we are sending a message that we will do everything we can to help with your arrest," said Mr Stathakopulos. 

Arbor Networks said as many as 12 million computers could be affected globally by Conficker/Downadup since it began prowling the web looking for vulnerable machines to infect in October. 

Malicious payload 

The Conficker worm is a self-replicating program that takes advantage of networks or computers that have not kept up to date with Windows security patches. 

It can infect machines via a net connection or by hiding on USB memory drives used to ferry data from one computer to another. Once in a computer it digs deep, setting up defences that make it hard to extract.  
The worm can also spread via USB flash drives.


The worm slithers through networks by guessing usernames and passwords. Security specialists recommend hardening passwords by mixing in numbers, punctuation marks and capital letters. 

The virus reports in to its creators for updates by visiting a web domain. It generates the name of the domain itself using a complicated code which security firms have cracked to track the growth of the worm and block its progress. 

Malware such as Downadup can be triggered to steal data or turn control of infected computers over to malicious hackers which pool them into larger armies of so-called botnets. 

These networks of compromised machines can be used to send spam, as dead drops for stolen or pirated data and to launch attacks on other machines. 

Although Downadup is widespread its creators have yet to activate its payload to steal data or launch other attacks. 

It has caused costly headaches for network administrators dealing with users locked out of their accounts when the worm correctly guesses a password. 

While Microsoft says it does not know the intention of the worm's creator, it wants to ensure it does not wreak any more havoc. 

Experts say users should have up-to-date anti-virus software and install Microsoft's MS08-067 patch - also known as KB958644. 

Global response 

Microsoft has also partnered with security companies, domain name providers, academia, internet companies such as AOL and others on a co-ordinated global response to the worm.  
Millions of computers have been hit by Conficker


Also included is the US Department of Justice and the Department of Homeland Security. 

"The best way to defeat potential botnets like Conficker/Downadup is by the security and Domain Name System communities working together," said Greg Rattray, chief internet security adviser at the Internet Corporation for Assigned Names and Numbers (Icann). 

"Icann represents a community that's all about co-ordinating those kinds of efforts to keep the internet globally secure and stable." 

Sasser worm 

In 2003 Microsoft created its reward programme with $5m (£3.4m) in funding to help law enforcement agencies bring computer virus and worm authors to justice. 

This reward for help in tracking the creators of Downadup is the first time in four years that the company has put up some cash in response to a worm outbreak.  
Microsoft hopes its bounty has started the countdown to finding its creator


"We have not seen this type of worm or one of its class since 2004," said Mr Stathakopulos. 

In 2005 Microsoft paid out $250,000 (£171,000) to two individuals who helped identify the creator of the notorious Sasser worm. The author was arrested and sentenced by the German authorities. 

Rewards of $250,000 were offered over three other major computer worm threats known as Blaster, MyDoom and Sobig worms. 

Those perpetrators have never been caught.