Slashdot Mirror
Downadup Worm — When Will the Next Shoe Drop?
alphadogg writes "The Downadup worm — also called Conflicker — has now infected an estimated 10 million PCs worldwide, and security experts say they expect to see a dangerous second-stage payload dropped soon. 'It has the potential to infect about 30% of Windows systems online, a potential 300 to 350 million PCs,' says Don Jackson, director of threat intelligence in the counter threat unit at SecureWorks. The worm, first identified in November and suspected to have originated in the Ukraine, is quickly ramping up, and while Downadup today is not malicious in the sense of destroying files — its main trick is to block users from accessing antivirus sites to obtain updates to protect against it — the worm is capable of downloading second-stage code for darker purposes."
If this thing is a malicious software delivery system, wouldn't it be possible to hijack it and have it download something that removes it?
Fun with Anagarams! LADS HOST, SHALT DOS. HAS DOLTS. AD SLOTHS, HATS SOLD. ASS HO, LTD.
Gotta say, it's pretty clever of the worm writer to rediscover the sneakernet as a malware infection vector. Though I'm curious as to why it just blocks anti-virus sites and not Window updates? That'd make it almost impervious to fix by network.
But it's "Ukraine", not "The Ukraine".
At least, that's what Ukrainians say.
Just sayin... And that's what the Ukrainian rocket scientist I know says also.
deleting the extra space after periods so i can stay relevant, yeah.
Too true. The original Internet worm had only 99 lines of source code, yet incorporated encryption, password guessing, vulnerability-injection, and so on.
Except for a bug, I think the author was a genius - a true "hacker" in the original sense of the word.
Of course, both viewpoints were presented by another guy, who included this incident in the last chapter of a book.
I love how Windows apologists always qualify their answers with "I like Linux too but...". It's a bit like saying "Some of my best friends are black but..."
You're obviously an experienced Windows user and understand the importance of discretion when clicking links, installing software, etc.
The difference is, Linux users don't have exercise nearly as much caution. My wife and kids know nothing of what lies beneath their pretty GUIs yet since upgrading every system in the house to Slackware (yes upgrading), we've had no further issues involving malicious software.
^^vv<><>BA
Seeing as I was about to reboot to tryout a live CD anyways, I went there.
Other than seeing an ugly ass background pic, it does nothing to my Linux system, running firefox 3 with no script, adblock plus & flashblock.
(MANDATORY) do not use Internet Explorer.
as an example, this?
Yes, December was last year so you can argue it is a year old....
Your suggestions are good and will minimize risks. The UAC nagware needs to be addressed so that people don't get the urge to through a brick through their "Windows" though.
I am also a little nervous about the "don't need realtime anti-virus software" with Windows - I think that Windows security has been improved but it could do with some more improvements - hopefully Vista SP3 (AKA Windows 7) will do this - I haven't looked at it yet but sounds like it is addressing some major issues, if so, thank you Microsoft.
[taunt]I still prefer my Debian systems though[/taunt].
BM3
One of the big areas hit by downadup is in the corporate world where PCs are "managed". A lot of those have not been patched and are infected already or probably will be soon. Once it gets a foothold behind a firewall, it uses multiple other strategies to spread - weak passwords, etc.
In a lot of business environments, deleting files could be crippling because those often times have people who don't back up their files, there isn't really a company policy, etc. It's bad enough when somebody loses a hard drive. Try having everyone "lose their hard drive".
Another issue is this is the first time I have seen the infection attributed to a Russian-area site. Everywhere else it has been attributed to some one or some group in China.
Regardless, one of the uses of a botnet is for cyber warfare. In this case the cat is out of the bag and people are watching it closely to see what it is going to do. But if the people who built this are sophisticated enough, or maybe this one spreads laterally and more stealthily than people have yet noticed, it could have a real purpose much more sinister than just deleting files or snagging myspace passwords. Downadup could also just be a decoy.
It's been said that the first clues that war is coming will be people's computers not working properly as infrastructure and services are knocked out. Anyone starting a war will want a crushing first blow and taking out files, doing DDoS, etc, would be typical.
Not trying to scaremonger but obviously this thing is illicit and almost guaranteed malicious. It would be naive to disregard a government's hand in it.
I believe it also blocks Windows Updates.
Avast antivirus caught it for me (using Firefox)
Linux has a logo, and it's cute and cuddly, so I think that's all good. It's just nowhere to be seen.
Computers (and embedded systems) coming with Linux carrying the penguin logo on their packaging, hardware that works with Linux and software that works with Linux (but what version of what distro?) carrying the penguin logo would be a start.
The logo alone isn't enough. It would be great if it were out there, but people also need to know why they want it. Something like Compiz's spinning cubes works wonders here. The trick here is finding something that Linux does much better than the competition and that makes people go "wow" before their attention span runs out.
And honestly, I think this is difficult. What I like about my distro of choice is that it lets me just _use_ my computer, without losing lots of time on maintenance. Updates, upgrades, software installation, hardware installation, it all Just Works. But how do you show that in 5 seconds and how many people will care, given that they probably virtually never do these things, anyway? The Worm of the Week doesn't bother me, but I think that goes for most people, too, even if their system does fall victim to it.
Having said that, what really helps is raising awareness that there is a choice to be made. These days, you _can_ use a Mac and you _can_ run Linux or BSD, without isolating yourself from the rest of the computer-using world. And if you do, you will have to worry a lot less about the malicious software that is constantly attacking every computer on the Internet. If you choose Linux or BSD, you don't even have to buy a new computer. You can install it yourself or you can have your local wizkid do it for you. You can get free updates for life, you'll be free of artificial restrictions (you _can_ play the songs you bought on every device you own), and the effort of learning the new system doesn't have to be more than the effort of learning the next version of Windows.
Please correct me if I got my facts wrong.
People live in the most polluted places because that's where they live, that's where they work, that's where they play.
Within reason, of course. When there is no place to go, they stay. However, history shows that where there are alternatives, people migrate to cleaner/better environments. The Navaho and Anaszi would pack up and leave a whole city and build a new one. In the 1800s people flocked to the west for a better life. Europeans flocked to the Americas for a cleaner/better life.
Every time new virus or worm hits about half of PC world I wonder what the mystic keeps people using Windows. I think it is a kind of mental disaster that may be compared to drug addiction. Is it market inertia? Is it some kind of world domination conspiracy of American government? Or what it could be? People think that worms and viruses are normal for any computer and no one from i.e. Apple of FOSS community do not bother to explain that viruses and worms can live only in Windows.
Who can explain why people still buying that piece of crap?