Science
Conficker
|
|
|
The worm is scheduled to contact control computers and, presumably, carry out some further action on April 1. Some experts have speculated that the attackers will lease parts of the botnet to criminals who will use them for spam, identity theft, phishing exploits and other malicious activities.
Like most current malware, Conficker is a blended threat, combining features of
several different approaches. Once Conficker infects a computer, it disables
many security features and automatic backup settings, deletes restore points and
opens connections to receive instructions from a remote computer. Once the first
computer is configured, Conficker uses it to gain access to the rest of the
network.Conficker can spread by several means, copying itself to shared folders, for example, or exploiting the AutoRun utility for removable media. There are three variants of Conficker. Conficker C, the most recent version, exploits peer-to-peer networking capabilities to enhance its spread.
History
The origin of the name Conficker is thought to be a portmanteau of the English term "configure" and the German word Ficker, which means "fucker" On the other hand, Microsoft analyst Joshua Phillips described the name as a rearrangement of portions of the domain name trafficconverter.biz, which was used by early versions of Conficker to download updates.
Discovery
The first variant of Conficker, discovered in early November 2008, propagated through the Internet by exploiting a vulnerability in a network service (MS08-067) on Windows 2000, Windows XP, Windows Vista, Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2 Beta. While Windows 7 may have been affected by this vulnerability, the Windows 7 Beta was not publicly available until January 2009. Although Microsoft released an emergency out-of-band patch on October 23, 2008 to close the vulnerability, a large number of Windows PCs (estimated at 30%) remained unpatched as late as January 2009. A second variant of the worm, discovered in December 2008, added the ability to propagate over LANs through removable media and network shares. Researchers believe that these were decisive factors in allowing the worm to propagate quickly: by January 2009, the estimated number of infected computers ranged from almost 9 million to 15 million. Antivirus software vendor Panda Security reported that of the 2 million computers analyzed through ActiveScan, around 115,000 (6%) were infected with Conficker.
Recent estimates of the number of infected computers have been more notably difficult because of changes in the propagation and update strategy of recent variants of the worm.
How does the Conficker worm work?
Here's an illustration of how the Conficker worm works.
To protect your computer from Conficker, experts recommend that you:
- Keep your system's patches up to date.
- Maintain a good anti-virus product.
- Disable AutoRun.
- Use strong passwords.
- Ensure that shared folders are secured.
How do I remove the Conficker worm?
If your computer is infected with the Conficker worm, you may be unable to download certain security products, such as the Microsoft Malicious Software Removal Tool or you may be unable to access certain Web sites, such as Microsoft Update. If you can't access those tools, try using the Windows Live safety scanner.
References:
http://en.wikipedia.org/wiki/Conficker
http://www.microsoft.com/security/worms/Conficker.aspx
Comments (0)