A quick stop

So with the end of college coming up I'm madly trying to get all my work finished to distinction level so I can get that nice A*, not a lot of time to put stuff here but today I had to write an essay on current security threats and ended up writing quite a bit on the Conficker botnet and thought it could be worth a read for anyone looking to know a bit about it.

***NOTE: Due to the rate of release info on this worm, the info could be outdated very quickly, at time of writing it all fits though. ***

One of the most currently well known and hated infections is known as Conficker (Alias Downup, DownadUp and Kido). Conficker started its career sometime in 2008 but was not confirmed until November 2008. It’s considered to have the highest worm infections since an unrelated worm spread across the world in 2003. The worm uses extremely advanced techniques of exploitation, system hijacking and morphing to avoid its detection and removal wherever it ends up. Some of the places Conficker has infected have been hospitals, the French Navy systems, the Ministry of Defence and even the houses of parliament!

It started by just exploiting one quite famous hole in the Windows RPC service but since the release of versions Conficker.B, Conficker.C and Conficker.E the process has become even more complex with multiple infection routes, multiple “call to” routes and the creation of a P2P network where the infections talk to each other and update via each other. Now even the infection is spreading by removable media devices and NetBIOS shares.

To avoid removal the malware scans for processes known as anti-virus or anti-malware and kills any of them in one second intervals, it also disables Windows auto-update and even blocks DNS requests to any sites considered anti-malware help or downloads.

The worm is self updating and self maintaining and virtually impossible for the source to be traced to even a country, let alone a person(s) to hold responsible for the 15 million+ infected computers across the world.

The authors of Conficker has hoaxed its final call for instructions a few times including a good April 1st scam where the media hyped up that it would start full activity on the net then but in the end nothing happened at all. The Conficker writers currently do not give full instructions to these millions of awaiting bots that daily scan a range of 500,000 generated domains for instructions. Only one of these domains has to have instruction data in order for the entire botnet to receive its orders, so it makes it even harder to track down who is doing this. In an effort to stop these instructions being sent out Microsoft bulk bought 13% of the domains they found out about.

There has been many arguments over what the botnet is for and what it will do but all that experts are sure of at the moment is the author(s) are very clever programmers who now have enough control over the internet to turn it inside out with malicious intent.