Slashdot Mirror

← Back to Stories (view on slashdot.org)

Downadup Worm — When Will the Next Shoe Drop?

Posted by timothy on from the it-looks-like-you're-using-windows dept.

alphadogg writes "The Downadup worm — also called Conflicker — has now infected an estimated 10 million PCs worldwide, and security experts say they expect to see a dangerous second-stage payload dropped soon. 'It has the potential to infect about 30% of Windows systems online, a potential 300 to 350 million PCs,' says Don Jackson, director of threat intelligence in the counter threat unit at SecureWorks. The worm, first identified in November and suspected to have originated in the Ukraine, is quickly ramping up, and while Downadup today is not malicious in the sense of destroying files — its main trick is to block users from accessing antivirus sites to obtain updates to protect against it — the worm is capable of downloading second-stage code for darker purposes."

13 of 295 comments (clear)

  1. what will it download? by Anonymous Coward · · Score: 5, Funny

    the worm is capable of downloading second-stage code for darker purposes."

    So it might download vista?

    1. Re:what will it download? by hobbit · · Score: 5, Insightful

      while Downadup today is not malicious in the sense of destroying files

      How quaint! The idea that someone might infect millions of PCs just to delete people's files is so 20th century.

      --
      "Wise men talk because they have something to say; fools, because they have to say something" - Plato
    2. Re:what will it download? by Anonymous Coward · · Score: 5, Interesting

      One of the big areas hit by downadup is in the corporate world where PCs are "managed". A lot of those have not been patched and are infected already or probably will be soon. Once it gets a foothold behind a firewall, it uses multiple other strategies to spread - weak passwords, etc.

      In a lot of business environments, deleting files could be crippling because those often times have people who don't back up their files, there isn't really a company policy, etc. It's bad enough when somebody loses a hard drive. Try having everyone "lose their hard drive".

      Another issue is this is the first time I have seen the infection attributed to a Russian-area site. Everywhere else it has been attributed to some one or some group in China.

      Regardless, one of the uses of a botnet is for cyber warfare. In this case the cat is out of the bag and people are watching it closely to see what it is going to do. But if the people who built this are sophisticated enough, or maybe this one spreads laterally and more stealthily than people have yet noticed, it could have a real purpose much more sinister than just deleting files or snagging myspace passwords. Downadup could also just be a decoy.

      It's been said that the first clues that war is coming will be people's computers not working properly as infrastructure and services are knocked out. Anyone starting a war will want a crushing first blow and taking out files, doing DDoS, etc, would be typical.

      Not trying to scaremonger but obviously this thing is illicit and almost guaranteed malicious. It would be naive to disregard a government's hand in it.

  2. And now we rediscover by causality · · Score: 5, Funny

    And now we rediscover why monocultures don't work (and are generally not found) in nature.

    --
    It is a miracle that curiosity survives formal education. - Einstein
  3. its not hard by madcat2c · · Score: 5, Informative

    Use a hardware router, use a real anti-virus program that actually publishes updates everyday (Nod32 for me), and use a browser where you can kill anything that tries to auto install itself (firefox, chrome, etc).

    And don't forward or respond to chain emails!

  4. You'll All Thank Me by hksdot · · Score: 5, Funny

    You'll all thank me when I deploy the second stage to install and run SETI@home and discover alien intelligence.

    -Virus Author

  5. Keep spreading lies by Anonymous Coward · · Score: 5, Funny

    Windows is actually far more secure than Linux. Get the facts, people.

    1. Re:Keep spreading lies by Anonymous Coward · · Score: 5, Informative

      Be warned - in case you are tempted...

      This is a pretty ingenious script that

      • Opens up windows (or tabs, depending on how you open the link) as fast as your computer can - 100% CPU
      • Each window displays gay porn
      • Plays a loud sound "Hey everybody I'm looking at gay porno"
      • Behind the scenes it also copies the contents of your clipboard to this guy.

      It works in IE and firefox. It is simply a page with an image, a flash movie, and a javascript that copies your clipboard to a field then 'submit()'s' the form, reloading the page.

      Very simple and bypasses popup blockers (at least the ones I have on).

      This has got to be a security hole in firefox, both on the ability to open windows/tabs, and copying the clipboard.

      If you want to have a look, use:

      wget http://getthefacts.on.zoy.org/index.php

      WARNING: dont click on this link, just copy the wget command to a shell. Dont say I didn't warn you...

    2. Re:Keep spreading lies by NeverVotedBush · · Score: 5, Insightful

      The both of you should probably add "that you know of".

      The reality is that Linux boxes are highly prized. Their owners frequently have high speed connections and Linux can do all sorts of fun things.

      Linux isn't perfect. There have been any number of security issues that would allow a knowledgeable hacker easy access. It all depends on if you kept your systems up to date and patched, didn't set up and allow unnecessary services, had a good firewall policy with a default deny/drop stance, etc.

      Linux comes out of the box now pretty secure but it hasn't always. And individual user habits can also compromise a system. Add to that the fact that one of the big ways into a system now is through add-on things like flash and such, and the knowledge that there have been kernel bugs that let user applications get root with a single command (things like vmsplice), and there is a possibility that your Linux boxes are rooted and you just don't know it.

      For the record, I run Linux almost exclusively and am no fan of Windows. But people need to understand that just running Linux is not a guarantee of safety. I'm also not questioning your capabilities. It's just that blanket statements about Linux security should probably be qualified.

    3. Re:Keep spreading lies by ozmanjusri · · Score: 5, Insightful
      They know to keep Windows up to date and run a scan at least once a week for any suspicious. They've also learned to not click on every fool link there is just because they can.

      Why bother?

      Linux is free, and it's easier to learn Linux than how to keep Windows clean.

      --
      "I've got more toys than Teruhisa Kitahara."
    4. Re:Keep spreading lies by Spit · · Score: 5, Insightful

      A better counter is not to click links posted by anonymous idiots.

      --
      POKE 36879,8
  6. Technical examination by Prune · · Score: 5, Informative

    There's a more technical examination of the virus at https://forums.symantec.com/t5/Malicious-Code/Downadup-Small-Improvements-Yield-Big-Returns/ba-p/381717

    --
    "Politicians and diapers must be changed often, and for the same reason."
  7. Re:Why is it.. by nathan.fulton · · Score: 5, Insightful

    ".. that I can't get windows apps to do what i want without crashing, but it runs teh evil viruses perfectly?"
    Because there is a 100% correlation between a virus crashing and a virus writer's lost profit. With most legitimate software, a crash leaves only one practical option: keep using the crapware and hope it doesn't crash again.