New, Stealthy Conficker B++ Worm Discovered

nandemoari writes "A new variant of the Conficker/Downadup worm has been detected. The worm opens a backdoor on an infected machine and allows hackers remote control of infected PCs. Dubbed Conficker B++ (and not to be confused with Conficker B), the new variant of the worm opens a backdoor with auto-update functionality, allowing a hacker to distribute malware to infected machines. It's difficult to know exactly how long Conficker B++ has been circulating, but researchers first noticed it on February 6 of this year." If this seems familiar to you, it probably is.

Comments

Why only B?

[wjh31]

are they expecting another even better/worse one after this?

Re:Why only B?

[gEvil (beta)]

Whoever created this is still working on it. He's hoping to perfect it soon, and then we'll have Conficker A+.

Re:Why only B?

[Neon Spiral Injector]

Then he can sell it on eBay as A++++++++++++++

Re:Why only B?

[Anonymous Coward]

"ebay? Never heard of it. Do you know the website number?"

Sure, no problem... it's 66.211.160.88

Re:Why only B?

[Anonymous Coward]

modded as *lame*

Re:Why only B?

[DesgarTadema]

It's like with the USS Enterprise: there are a lot of letters left in the alphabet.

Detection

[jetsci]

Anyone know the procedure for detecting these? I imagine A/V companies setup 'honeypots' of sorts on high traffic networks and that but how do you detect something new like this? Do they track it through an old signature?

Re:Detection

[iztehsux]

I run a Nepenthes box on my network and I get collected hits from a variety of worms every single day. No sign of a Conficker worm trying to blast my net, but if something connects and gets detained, you can take it apart and look at it. Either way, it's pretty useful for tracking different random infected boxes and you could probably create a sig that uniquely identifies it.

Re:Screenshots

[jetsci]

Something sinister is brewing inside..

profit motive

[BigHungryJoe]

I'm assuming there's some sort of profit motive behind all this virus writing... is it to generate crappy run-of-network traffic for ad revenue? Identity theft? Extorting money from online businesses by threatening to turn your bot network on them? What?

Re:profit motive

[Anonymous Coward]

Sell anti-virus software.

Re:profit motive

[Yvanhoe]

Spam providers exist and will organize your "ad campaign" for a small fee. They need a bot to send millions of mail.
Scamers and phishers need anonymate also, a botnet can provide this.
There is also the very possible old-fashion extortion, mafia style.

Re:profit motive

[Lord Ender]

Botnets can be profitable, however, someone skilled enough to write the malware necessary for botnet creation could likely be making better money in the private sector with a real job and no jail risk (in the US, at least). Most of the stuff I see comes from Eastern Europe or Asia, where law enforcement is unlikely to prosecute and there aren't decent Software industries hiring people with programming talent.

So they make money by

• sending spam
• click-fraud (scamming web advertisers)
• stealing CC numbers
• DDoS extortion (yes, european banks have paid botnet owners' extortion demands to avoid getting DoSd.)

Re:profit motive

[Saint Aardvark]

You laugh, but that situation is just what F-Secure describes for an unrelated bit of Facebook malware. FTFA:

As we pointed out in yesterday's post, the timing of the Facebook "Error Check System" application and the subsequent Google search results pointing to rogue antivirus sites was almost too perfect to be a coincidence. It's entirely possible that the whole situation was designed to promote XP Antivirus variants such as "Antivirus 360" and "XP Police" (Rogue:W32/XPAntivirus). That's the formula, create something that spawns a search, then be ready to provide results that redirect to malicious sites. Either that or the bad guys are very quick on their feet and are ruthlessly opportunistic.... They're both.

Re:profit motive

[domatic]

DDoS extortion (yes, european banks have paid botnet owners' extortion demands to avoid getting DoSd.)

You'd think large banks would be more able to "follow the money" better than most victims and swing the clout to do something about it once they have.

Re:profit motive

[Anonymous Coward]

DDoS extortion (yes, european banks have paid botnet owners' extortion demands to avoid getting DoSd.)

Citation needed.

Re:profit motive

[Zironic]

[citation needed]

Re:profit motive

[stevey]

That's not necessarily true - I mean the skills required to exploit a known security hole aren't terribly difficult.

If you're familiar with a small amount of low-level coding you can easily follow cookbook-style tutorials to getting shellcode executed. At that point you're done.

Sure you need to do some disguising, and you need to understand a bit of crypto to setup a key-verification for downloading updates.

But I'd expect there are literally millions of coders still kicking around from the 80s/90s who did assembly programming under MS-DOS who would be able to write that kind of code - and because it isn't really really skilled work the chances are high that a significant proportion of those developers are unemployed.

Re:profit motive

[Anonymous Coward]

The weird thing with the Conflicker virus is despite its high global penetration rate and its the wiz-bang capabilities, it hasn't really done anything other than to spread itself. At least, I haven't read about any damage caused by it, other than PC's getting infected by it. So far, all the articles about it discuss its potential for causing problems, but that's it. So the question becomes, what are the virus writers waiting for? Did they create a malware-for-hire platform before they had any customers, or are they just doing beta testing and analyzing the securities industry's response for weakness in their mitigation and containment strategies?

Re:profit motive

[Lord Ender]

I disagree with you.

Point 1: Building and managing a botnet is not just "exploit[ing] a known security hole."

Point 2: Your statement that computer programming is not "skilled work" is just bizarre.

Point 3: Your statement that a "significant proportion" of "millions of coders" are unemployed isn't backed up by any evidence I've seen. Unemployment is high right now, but not among programmers.

Re:profit motive

[stevey]

A botnet starts off with one machine, scanning the world for more vulnerable hosts and exploiting them in turn. Sure you'd do better if you were to have a few hundred to start with - but building a botnet, assuming you can create an exploit is almost trivial.

I wasn't suggesting that computer programming is unskilled, merely that there are no real special skills required to exploit a security hole - which is what you were trying to imply.

(i.e. Botnet writers are not so amazingly skilled that they would be snapped up in a hurry, which was the point you were trying to make.)

As for unemployment, you could be right I'll not try to argue that either way really. My main point was that somebody capable of creating and controlling a botnet is not so very highly skilled that they're certain of a high paying job, which was your assertion.

Re:profit motive

[Anonymous Coward]

Not even unrelated, in fact. Same damn people, sort of.

Conficker-A actually did push XPAntivirus (although the download domains died really quickly) - and the update signing scheme is absolutely identical to the one XPAntivirus uses, so presumably the author of Conficker has some sort of connection to those people, either an ex-developer of Baka Software, or he's sold the stuff to them.

Conficker-B and later variants appear to be written based on the same source code after the author left Baka Software; but it's a heavily revised, v2 of the virus (or worm, if you prefer), with no spyware droppage, no avoidance of the Ukraine (the author is NOT Ukrainian, he just worked for them?), the USB infection vector added (that really pushed it out to the masses of corporate/gov/etc networks) and some heavy internal changes regarding the mutex and sploit payloads.

What we're seeing here is basically v2.1 (B+ or B++); incremental improvements, in this case swapping the centralised command & control with generated fast-flux DNS names slowly to an update mechanism that can, in a future update, go entirely P2P; I estimate we'll see a future version push itself through that mechanism, which will no longer need the DNS at all, but will have an entirely decentralised command & control.

I worry about where this is going next; the author is unusually skilled. I really hope the author doesn't know about the Nitmar countdown technique.

Re:profit motive

[Lord Ender]

Have you actually studied botnets? Especially modern ones like conficker? To build one, you need to get an exploit working, you need to write the virus component so that it spreads, and you need to write the server (bot) component. You must also include some tricks to disable security software, and perhaps implement a code obfuscation process which can't be easily reverse-engineered. On top of all that, you MUST have a sophisticated method for controlling the botnet that is highly scalable, extremely difficult to track, and extremely difficult to disable by ISPs.

This isn't something that requires a super genius, but it's not something most college-educated entry-level programmers would be able to even do. Senior-level programmers would have trouble with it, as well. It's not kid's stuff.

Re:profit motive

[stevey]

Yes I've studied them, partly because i used to code exploits in the past, and partly out of curiosity.

I did say initially there are parts to them that require knowledge. The authentication steps to ensure the owner keeps control, and the rootkit components to hide them once installed would probably be the most challenging aspects of the net.

But none of the pieces are individually hard to code (I've written several of them myself) and while a junior/entry-level programmer might struggle I'm not convinced they are particularly difficult to construct from start to finish.

If anything I'm impressed that we see so few botnets!

Re:profit motive

[dave562]

But I'd expect there are literally millions of coders still kicking around from the 80s/90s who did assembly programming under MS-DOS who would be able to write that kind of code - and because it isn't really really skilled work the chances are high that a significant proportion of those developers are unemployed.

That's right. I cut my teeth on x86 ASM cracking warez and writing virii. Programming never really grabbed my attention though. All things considered it was much too dry and structured. I didn't want to spend my life writing functions and low level code. Push to stack, pop from stack, xor, nop, znj, blah blah blah. Once Microsoft came out with Win95 and started to cut off direct calls to the CPU, my rudimentary ASM skills become more or less obsolete.

I'm still predicting that sooner or later, Apple via OSX is going to see a huge outbreak of malware. An x86 CPU is an x86 CPU. It will run the same low level code, whether that code is executed through Windows or OSX. It just seems like Apple has done a slightly better job of controlling access to the hardware than Microsoft has. The payloads are all ready to go. Someone just needs to find a chink in the armor. Once Apple gets enough market share to make it worth while, those chinks will be found. Until then, everyone will keep going after the low-hanging fruit that are the Windows boxen.

Re:profit motive

[Lord Ender]

There is a difference between writing "a few" botnets, and writing one that actually works. Yours didn't work. You didn't have a control channel sophisticated enough to scale and avoid standard security controls.

Re:profit motive

[stevey]

You misunderstand me - I didn't mean to say I've created and released botnets into the wild.

I meant that with private networks I've created self-replicating code which actively scanned and infected new hosts and had a sophisticated control mechanism which allowed control, updates, and activities.

Still I've either convinced you that writing a bot, and by extension creating a botnet, is not exceptionally difficult - or I haven't.

Re:profit motive

[Narnie]

They're creating a network to run Prime95 and win the EFF awards for finding prime numbers.

This is just a passing virus

[BadAnalogyGuy]

No need to worry. I'd be more worried about Conficker C. Lots of opportunities to shoot you in the foot.

Then someone will undoubtedly create Conficker C++ and everyone will cry about how hard it is to understand and they will all flock to Conficker Java which promises a much cleaner object system.

But eventually you know that some idiot is going to write Conficker C# which looks suspiciously like Conficker Java, but after a while grows into this gigantic mess of quickfix designs.

So if you think Conficker B is bad, just wait a while.

Re:This is just a passing virus

[jetsci]

Did they already release Conficker-Basic?

Re:This is just a passing virus

[Anonymous Coward]

Wake me up for Conficker Python.

Re:This is just a passing virus

[Ian Alexander]

Well yeah, but you need the BASIC interpreter installed to run it, so it's not like it does anything on 99% of systems.

Re:This is just a passing virus

[lennier]

Forth Conficker powerful very is to used getting some takes but.

Cornfucker national anthem...

[Smidge207]

*ahem* [taps microphone, clears throat again] *ahem*

And a five, six, seven, eight:

"Botnets, worldwide botnets.
What kind of boxes are on botnets?

Compaq, HP, Dell and Sony, TRUE!
Gateway, Packard Bell, maybe even Asus, too.

Are boxes, found on botnets.
All running Windows, FOO [fu]!"

=Smidge=

Old news?

[davidwr]

Is it just me or has /. been reading like yesterday's news lately?

Re:Old news?

[Logical Zebra]

That might be because it takes so long for stories to get approved...

Re:Old news?

[AlterRNow]

News for nerds, stuff that matter[ed yesterday]!

On another note, if the editor knew of the previous story.. why was it posted? I must admit, I'm not very knowledgeable on the editorial process of ./

Re:Old news?

[Duhfus]

I must admit, I'm not very knowledgeable on the editorial process of ./

Don't worry, the editors don't either.

Re:Old news?

[Spatial]

The editors are a great guy, they accidentally a dupe and don't afraid of anything.

Re:Old news?

[Anonymous Coward]

Slashdot has an editorial process? Dude, you just blew my mind.

Re:Old news?

[icannotthinkofaname]

I'm not very knowledgeable on the editorial process of ./

Neither am I. Come to think of it, this is the first I've heard of the "editorial process of the current working directory." I ought to go googling later....

Or is there some other dot-slash that's relevant to this story?

Re:Old news?

[Cthefuture]

Meh, I would not have seen it if it wasn't posted today. Who cares about a few duplicates every once in a while. You get a fresh update and maybe some new people talking about it.

Re:Old news?

[AlterRNow]

Nicely spotted

But can it....

[SGDarkKnight]

cause five tankers in the Ellingson fleet to capsize?

Re:But can it....

[Acapulco]

"The little boat...flipped over." - Mr. The Plague

Re:But can it....

[V!NCENT]

"A hacker planted the virus"
-"Is that -?"
"-That is mr. conflicker B++"
-"Well then, put our servers under Linux control"
"There's no such thing anymore, Duke. These computers are fully DRMised. It relies on satalite internet, which links our servers to Redmond"

Underpants Gnomes

[Anonymous Coward]

I keep trying to turn this into an Underpants Gnomes joke, but I can't figure out where to put the ?????

1) Write virus and infect your honeypot system.
2) Write paper on said virus and publish on add supported web site.
3) Post several pointers to said web site on /.
4) Profit
5) Repeat with new variants.

It just doesn't make sense. Where do the ?????'s go?

Conficker-C++ under development

[inthedump]

While all this goes on, Conficker-C++ is under development. Programmers wanted. You need to have 30+ years of experience in C++ and a work out of a garage preferred located in Asia.

I can't seem to get a Linux copy of this worm

[mrphoton]

I am feeling very left out, I can't seem to find Conficker B++ or even Conficker B in my yum repository. sigh... It is such a shame that linux is always behind the curve as far as new and exciting features are concerned.

Re:I can't seem to get a Linux copy of this worm

[Anonymous Coward]

How about you write your own version ya lazy shit?

Re:I can't seem to get a Linux copy of this worm

[gzipped_tar]

I am feeling very left out, I can't seem to find Conficker B++ or even Conficker B in my yum repository. sigh... It is such a shame that linux is always behind the curve as far as new and exciting features are concerned.

'Coz the distro maintainers refused to include non-opensource binary blob in their repo.

Make yourself heard. Chances are the malware author is considering opensourcing it too but no one's asking for it so far.

Re:I can't seem to get a Linux copy of this worm

[Anonymous Coward]

I'll check my pacman repos.

Re:I can't seem to get a Linux copy of this worm

[Anonymous Coward]

The author doesn't give a shit about your platform because it has 0% market share.

Re:I can't seem to get a Linux copy of this worm

[icannotthinkofaname]

Just install Wine and run it through that. /problem>

Confusion

[Dan East]

Conflicker B++ should not be confused with Objective Conflicker B. Fortunately, they can easily be distinguished from one another - Objective Conflicker B has many more square brackets.

How to detect Conficker C#

[Dystopian Rebel]

The only way to detect Conficker C# is that it requires the .NET runtime environment and MS SQL Server Express.

Re:How to detect Conficker C#

[Anonymous Coward]

Don't worry, Miguel de Icaza will port it to Mono

Re:How to detect Conficker C#

[b4dc0d3r]

And once again mono prevalence increases due to viruses. Just like the good old days!

Re:How to detect Conficker C#

[yanyan]

That does it. Windows users have all the fun. This is just another sign that Linux will never, ever gain widespread acceptance. And that fabled Year of the Linux Desktop? Keep dreaming guys. I'm dumping Bubuntu Linux XP and moving to Windows. See you around suckers.

Re:How to detect Conficker C#

[Vu1turEMaN]

What are you talking about? Its in the .NET 3.5 Installer!

Why do you think the full-package installer of 3.5 needs an internet connection to download more? Conspiracy!

UseLess Computer Science Departments: +1, True

[Anonymous Coward]

Why don't the genius Computer Science majors tackle this problem?

Rob Pike was right. Systems software research is dead.
More importantly , the faculty members and students are
dead heads with Linux, TeX, Java, and C++.

Yours Computationally,
Kilgore Trout

Re:UseLess Computer Science Departments: +1, True

[Anonymous Coward]

Most CS people are using virtually 100% secure platforms like OS X where worms are just curiosities, not hazards.

Who is at risk?

[Anonymous Coward]

Let's turn this blog positive.

  What current anti-virus solution detects and removes this new variant ?,
  Who is it risk?, people with updated anti virus solutions? or just people who don't use and update them?
Are people with Linux and OS-X at risk also ? What is the scope of it?
If Linux and OS-x are not threatened This might be another reason Not to use Windows ?
  The answers to these will help people determine just how big a threat or not this new variant might be, and help them help themselves

 

Re:Who is at risk?

[dave562]

The article spells it out. People who haven't applied the security patch that Microsoft released months ago are vulnerable. The rest of the world are just fine. So like usual, it comes down to the poor home users who get screwed while the corporate networks who actually have admins doing their job maintaining them are doing just fine. Luckily things are better and only the subset of home users who don't have automatic updates turned on are screwed.

Re:Who is at risk?

[gad_zuki!]

The patch stops the SMB vulnerability, but I believe the USB auto-run is just an executable. There's no vulnerability needed if the OS is going to run the autorun a file as administrator.

MS should just globally disable autorun. This is getting out of hand. Half of these infections is probably some low-paid tech inserting the same usb drive into his customers computers. That seriously would not surprise me.

You heard about the infinite amount of monkey's?

[SmallFurryCreature]

A bit like having an infinite amount of monkey's writing shakespear. Sadly they could only aford half a dozen monkey's but what they lack in numbers they make up for in poop slinging skills.

Armour Hot Dogs?

[srobert]

Seems to go with the Armour Hot Dog song. Was that the intent?

so if I understand this correctly ....

[nblender]

We (the global 'we') had a chance to stop conflicker before this version came about; by working with the registrars and/or root nameservers; pre-emptively invalidating each of the algorithmically generated domain names on a day by day basis; preventing cornfucker from updating itself or receiving instructions on how to proceed. The authors noticed that we could do that and before we could think of it, modified it so that once we did think of it; it would be too late....

I clearly must not understand the intricacies of this....

My fantasy (because I won't be affected by this) is that once the owners of the botnet are sufficiently happy with their market-share, will instruct cornfucker to encrypt all files on everyone's PC and then wait for the moneh to start rolling in....

Re:so if I understand this correctly ....

[Anonymous Coward]

I clearly must not understand the intricacies of this....

Nice understatement.

How about a million monkeys?

[Anonymous Coward]

"Imprison a million monkeys in a room with a million typewriters and wait a billion years and you'll end up with many dead monkeys and a printed copy of Wikipedia." - John Le'Brecage

Proper naming convention, please

[LordSnooty]

Conficker/Downadup? B? B++? Is it time we had a proper naming scheme for these things? For this instance we've seen several companies getting together to coordinate a response - that's good. But even better, if everyone were to agree on the same name, WE could coordinate our response too.

And what kind of scheme? Well, how about following the convention of the hurricane trackers? 26 names assigned to each major piece of malware that appears throughout the year. This is a double bonus, as ending the practice of using the authors' chosen names might take away some of that bragging aspect. "Oh, you wrote Malware Julie did you?? Bwahaha"

Re:Proper naming convention, please

[Culture20]

Conficker/Downadup? B? B++? Is it time we had a proper naming scheme for these things?

You forgot Net-Worm.Win32.Kido.bt

Well, how about following the convention of the hurricane trackers? 26 names assigned to each major piece of malware that appears throughout the year.

Malware writers might get sloppy as they vie for the top names, trying to make sure that _their_ malware becomes a headline in just the right time to be named "Thor" or "Linus".

Functional malware

[kkrajewski]

Don't about Conficker Lisp -- it overflows your buffers with parentheses.

When Change comes to viruses

[lord_sarpedon]

I'd like to see an incredibly stealthy virus - one that stays out of the way to the point that it isn't detected for some number of years.

Have it patch key parts of the Windows kernel to degrade performance in subtle but believable ways...
Lobotomize the scheduler so that context switches occur much less often than they should for responsiveness.
Kick up the swappiness from Ridiculous (stock setting) to We've-gone-plaid
Divide the given buffer length for each I/O operation so that CPU usage goes up and throughput goes down.

I wonder if we'd _ever_ notice.

Re:When Change comes to viruses

[daveime]

You just described Vista ...

Windows Update...

[Narnie]

I still think Microsoft should hire these guys to revamp Windows Update.

Re:Windows Update...

[Architect_sasyr]

I'd have given a + mod but I have to make some points

• Verification of update paths is difficult to secure if you're going to permit just anyone from doing it (i.e. a "torrent" style update).
• A central authentication service, or a distributed-yet-centralised authentication service, is going to be necessary to deal with above step
• Microsoft have to update an entire OS and package, "worm guy" only has to update a few programs, and if something breaks he doesn't care

Just a few, but there are a number of issues with distributed, safe, automatic updates. Mirroring out to secondary servers isn't a bad idea (a-la sourceforge or WSUS) but a corporation wants to maintain control over their product and who gets it. The most important one is probably the 3rd point though. Just something to think about before you go rag on an update system.

/me kicks OS X server for breaking CPAN installs

Re:Screenshots

[ImYourVirus]

goatse, goatse!!! do not open!!!

Linux Users have a root

[Anonymous Coward]

Windows would be fine if it could get a root. ;)

Seriously though - for all the "are you sure?" pop-ups from vista why are there so many exploits. That is, how could the user make vista any worse - give them superuser privileges that way you won't get exploited by an app.

cornfucker

[Anonymous Coward]

cornfucker. Yes. Thank you. WOW.

wrong

[Anonymous Coward]

YOU are the reason Slashdot sucks NOW.