Slashdot Mirror

← Back to Stories (view on slashdot.org)

New, Stealthy Conficker B++ Worm Discovered

Posted by CmdrTaco on from the god-i-love-that-name dept.

nandemoari writes "A new variant of the Conficker/Downadup worm has been detected. The worm opens a backdoor on an infected machine and allows hackers remote control of infected PCs. Dubbed Conficker B++ (and not to be confused with Conficker B), the new variant of the worm opens a backdoor with auto-update functionality, allowing a hacker to distribute malware to infected machines. It's difficult to know exactly how long Conficker B++ has been circulating, but researchers first noticed it on February 6 of this year." If this seems familiar to you, it probably is.

87 comments

  1. Why only B? by wjh31 · · Score: 1

    are they expecting another even better/worse one after this?

    1. Re:Why only B? by gEvil+(beta) · · Score: 1

      Whoever created this is still working on it. He's hoping to perfect it soon, and then we'll have Conficker A+.

      --
      This guy's the limit!
    2. Re:Why only B? by Neon+Spiral+Injector · · Score: 3, Funny

      Then he can sell it on eBay as A++++++++++++++

    3. Re:Why only B? by Anonymous Coward · · Score: -1, Offtopic

      ebay? Never heard of it. Do you know the website number?

    4. Re:Why only B? by Anonymous Coward · · Score: 0

      "ebay? Never heard of it. Do you know the website number?"

      Sure, no problem... it's 66.211.160.88

    5. Re:Why only B? by Anonymous Coward · · Score: 0

      modded as *lame*

    6. Re:Why only B? by DesgarTadema · · Score: 1

      It's like with the USS Enterprise: there are a lot of letters left in the alphabet.

  2. Screenshots by Anonymous Coward · · Score: -1, Troll

    Here are some screenshots of the worm opening its backdoor

    1. Re:Screenshots by jetsci · · Score: 0, Troll

      Something sinister is brewing inside..

      --
      Bored at work? Play Game!
    2. Re:Screenshots by ImYourVirus · · Score: 1

      goatse, goatse!!! do not open!!!

      --
      Why is common sense called that if it's not common?
  3. Detection by jetsci · · Score: 3, Interesting

    Anyone know the procedure for detecting these? I imagine A/V companies setup 'honeypots' of sorts on high traffic networks and that but how do you detect something new like this? Do they track it through an old signature?

    --
    Bored at work? Play Game!
    1. Re:Detection by iztehsux · · Score: 1

      I run a Nepenthes box on my network and I get collected hits from a variety of worms every single day. No sign of a Conficker worm trying to blast my net, but if something connects and gets detained, you can take it apart and look at it. Either way, it's pretty useful for tracking different random infected boxes and you could probably create a sig that uniquely identifies it.

  4. Your official guide to the Jigaboo presidency by Anonymous Coward · · Score: -1, Offtopic

    Congratulations on your purchase of a brand new nigger! If handled properly, your apeman will give years of valuable, if reluctant, service.

    INSTALLING YOUR NIGGER.
    You should install your nigger differently according to whether you have purchased the field or house model. Field niggers work best in a serial configuration, i.e. chained together. Chain your nigger to another nigger immediately after unpacking it, and don't even think about taking that chain off, ever. Many niggers start singing as soon as you put a chain on them. This habit can usually be thrashed out of them if nipped in the bud. House niggers work best as standalone units, but should be hobbled or hamstrung to prevent attempts at escape. At this stage, your nigger can also be given a name. Most owners use the same names over and over, since niggers become confused by too much data. Rufus, Rastus, Remus, Toby, Carslisle, Carlton, Hey-You!-Yes-you!, Yeller, Blackstar, and Sambo are all effective names for your new buck nigger. If your nigger is a ho, it should be called Latrelle, L'Tanya, or Jemima. Some owners call their nigger hoes Latrine for a joke. Pearl, Blossom, and Ivory are also righteous names for nigger hoes. These names go straight over your nigger's head, by the way.

    CONFIGURING YOUR NIGGER
    Owing to a design error, your nigger comes equipped with a tongue and vocal chords. Most niggers can master only a few basic human phrases with this apparatus - "muh dick" being the most popular. However, others make barking, yelping, yapping noises and appear to be in some pain, so you should probably call a vet and have him remove your nigger's tongue. Once de-tongued your nigger will be a lot happier - at least, you won't hear it complaining anywhere near as much. Niggers have nothing interesting to say, anyway. Many owners also castrate their niggers for health reasons (yours, mine, and that of women, not the nigger's). This is strongly recommended, and frankly, it's a mystery why this is not done on the boat

    HOUSING YOUR NIGGER.
    Your nigger can be accommodated in cages with stout iron bars. Make sure, however, that the bars are wide enough to push pieces of nigger food through. The rule of thumb is, four niggers per square yard of cage. So a fifteen foot by thirty foot nigger cage can accommodate two hundred niggers. You can site a nigger cage anywhere, even on soft ground. Don't worry about your nigger fashioning makeshift shovels out of odd pieces of wood and digging an escape tunnel under the bars of the cage. Niggers never invented the shovel before and they're not about to now. In any case, your nigger is certainly too lazy to attempt escape. As long as the free food holds out, your nigger is living better than it did in Africa, so it will stay put. Buck niggers and hoe niggers can be safely accommodated in the same cage, as bucks never attempt sex with black hoes.

    FEEDING YOUR NIGGER.
    Your Nigger likes fried chicken, corn bread, and watermelon. You should therefore give it none of these things because its lazy ass almost certainly doesn't deserve it. Instead, feed it on porridge with salt, and creek water. Your nigger will supplement its diet with whatever it finds in the fields, other niggers, etc. Experienced nigger owners sometimes push watermelon slices through the bars of the nigger cage at the end of the day as a treat, but only if all niggers have worked well and nothing has been stolen that day. Mike of the Old Ranch Plantation reports that this last one is a killer, since all niggers steal something almost every single day of their lives. He reports he doesn't have to spend much on free watermelon for his niggers as a result. You should never allow your nigger meal breaks while at work, since if it stops work for more than ten minutes it will need to be retrained. You would be surprised how long it takes to teach a nigger to pick cotton. You really would. Coffee beans? Don't ask. You have no idea.

    MAKING YOUR NIGGER WORK.
    Niggers are very, very averse to work of any kind. The nigger's most

  5. profit motive by BigHungryJoe · · Score: 1

    I'm assuming there's some sort of profit motive behind all this virus writing... is it to generate crappy run-of-network traffic for ad revenue? Identity theft? Extorting money from online businesses by threatening to turn your bot network on them? What?

    1. Re:profit motive by Anonymous Coward · · Score: 5, Funny

      Sell anti-virus software.

    2. Re:profit motive by Yvanhoe · · Score: 1

      Spam providers exist and will organize your "ad campaign" for a small fee. They need a bot to send millions of mail.
      Scamers and phishers need anonymate also, a botnet can provide this.
      There is also the very possible old-fashion extortion, mafia style.

      --
      The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
    3. Re:profit motive by Lord+Ender · · Score: 4, Insightful

      Botnets can be profitable, however, someone skilled enough to write the malware necessary for botnet creation could likely be making better money in the private sector with a real job and no jail risk (in the US, at least). Most of the stuff I see comes from Eastern Europe or Asia, where law enforcement is unlikely to prosecute and there aren't decent Software industries hiring people with programming talent.

      So they make money by

      • sending spam
      • click-fraud (scamming web advertisers)
      • stealing CC numbers
      • DDoS extortion (yes, european banks have paid botnet owners' extortion demands to avoid getting DoSd.)
      --
      A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
    4. Re:profit motive by Saint+Aardvark · · Score: 5, Interesting

      You laugh, but that situation is just what F-Secure describes for an unrelated bit of Facebook malware. FTFA:

      As we pointed out in yesterday's post, the timing of the Facebook "Error Check System" application and the subsequent Google search results pointing to rogue antivirus sites was almost too perfect to be a coincidence. It's entirely possible that the whole situation was designed to promote XP Antivirus variants such as "Antivirus 360" and "XP Police" (Rogue:W32/XPAntivirus). That's the formula, create something that spawns a search, then be ready to provide results that redirect to malicious sites. Either that or the bad guys are very quick on their feet and are ruthlessly opportunistic.... They're both.

      --
      Carousel is a lie!
    5. Re:profit motive by domatic · · Score: 1

      DDoS extortion (yes, european banks have paid botnet owners' extortion demands to avoid getting DoSd.)

      You'd think large banks would be more able to "follow the money" better than most victims and swing the clout to do something about it once they have.

    6. Re:profit motive by Anonymous Coward · · Score: 0

      DDoS extortion (yes, european banks have paid botnet owners' extortion demands to avoid getting DoSd.)

      Citation needed.

    7. Re:profit motive by Zironic · · Score: 1

      [citation needed]

    8. Re:profit motive by stevey · · Score: 3, Interesting

      That's not necessarily true - I mean the skills required to exploit a known security hole aren't terribly difficult.

      If you're familiar with a small amount of low-level coding you can easily follow cookbook-style tutorials to getting shellcode executed. At that point you're done.

      Sure you need to do some disguising, and you need to understand a bit of crypto to setup a key-verification for downloading updates.

      But I'd expect there are literally millions of coders still kicking around from the 80s/90s who did assembly programming under MS-DOS who would be able to write that kind of code - and because it isn't really really skilled work the chances are high that a significant proportion of those developers are unemployed.

    9. Re:profit motive by Anonymous Coward · · Score: 0

      The weird thing with the Conflicker virus is despite its high global penetration rate and its the wiz-bang capabilities, it hasn't really done anything other than to spread itself. At least, I haven't read about any damage caused by it, other than PC's getting infected by it. So far, all the articles about it discuss its potential for causing problems, but that's it. So the question becomes, what are the virus writers waiting for? Did they create a malware-for-hire platform before they had any customers, or are they just doing beta testing and analyzing the securities industry's response for weakness in their mitigation and containment strategies?

    10. Re:profit motive by Lord+Ender · · Score: 1

      I disagree with you.

      Point 1: Building and managing a botnet is not just "exploit[ing] a known security hole."

      Point 2: Your statement that computer programming is not "skilled work" is just bizarre.

      Point 3: Your statement that a "significant proportion" of "millions of coders" are unemployed isn't backed up by any evidence I've seen. Unemployment is high right now, but not among programmers.

      --
      A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
    11. Re:profit motive by stevey · · Score: 1

      A botnet starts off with one machine, scanning the world for more vulnerable hosts and exploiting them in turn. Sure you'd do better if you were to have a few hundred to start with - but building a botnet, assuming you can create an exploit is almost trivial.

      I wasn't suggesting that computer programming is unskilled, merely that there are no real special skills required to exploit a security hole - which is what you were trying to imply.

      (i.e. Botnet writers are not so amazingly skilled that they would be snapped up in a hurry, which was the point you were trying to make.)

      As for unemployment, you could be right I'll not try to argue that either way really. My main point was that somebody capable of creating and controlling a botnet is not so very highly skilled that they're certain of a high paying job, which was your assertion.

    12. Re:profit motive by Anonymous Coward · · Score: 0

      Not even unrelated, in fact. Same damn people, sort of.

      Conficker-A actually did push XPAntivirus (although the download domains died really quickly) - and the update signing scheme is absolutely identical to the one XPAntivirus uses, so presumably the author of Conficker has some sort of connection to those people, either an ex-developer of Baka Software, or he's sold the stuff to them.

      Conficker-B and later variants appear to be written based on the same source code after the author left Baka Software; but it's a heavily revised, v2 of the virus (or worm, if you prefer), with no spyware droppage, no avoidance of the Ukraine (the author is NOT Ukrainian, he just worked for them?), the USB infection vector added (that really pushed it out to the masses of corporate/gov/etc networks) and some heavy internal changes regarding the mutex and sploit payloads.

      What we're seeing here is basically v2.1 (B+ or B++); incremental improvements, in this case swapping the centralised command & control with generated fast-flux DNS names slowly to an update mechanism that can, in a future update, go entirely P2P; I estimate we'll see a future version push itself through that mechanism, which will no longer need the DNS at all, but will have an entirely decentralised command & control.

      I worry about where this is going next; the author is unusually skilled. I really hope the author doesn't know about the Nitmar countdown technique.

    13. Re:profit motive by Lord+Ender · · Score: 1

      Have you actually studied botnets? Especially modern ones like conficker? To build one, you need to get an exploit working, you need to write the virus component so that it spreads, and you need to write the server (bot) component. You must also include some tricks to disable security software, and perhaps implement a code obfuscation process which can't be easily reverse-engineered. On top of all that, you MUST have a sophisticated method for controlling the botnet that is highly scalable, extremely difficult to track, and extremely difficult to disable by ISPs.

      This isn't something that requires a super genius, but it's not something most college-educated entry-level programmers would be able to even do. Senior-level programmers would have trouble with it, as well. It's not kid's stuff.

      --
      A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
    14. Re:profit motive by stevey · · Score: 1

      Yes I've studied them, partly because i used to code exploits in the past, and partly out of curiosity.

      I did say initially there are parts to them that require knowledge. The authentication steps to ensure the owner keeps control, and the rootkit components to hide them once installed would probably be the most challenging aspects of the net.

      But none of the pieces are individually hard to code (I've written several of them myself) and while a junior/entry-level programmer might struggle I'm not convinced they are particularly difficult to construct from start to finish.

      If anything I'm impressed that we see so few botnets!

    15. Re:profit motive by dave562 · · Score: 1

      But I'd expect there are literally millions of coders still kicking around from the 80s/90s who did assembly programming under MS-DOS who would be able to write that kind of code - and because it isn't really really skilled work the chances are high that a significant proportion of those developers are unemployed.

      That's right. I cut my teeth on x86 ASM cracking warez and writing virii. Programming never really grabbed my attention though. All things considered it was much too dry and structured. I didn't want to spend my life writing functions and low level code. Push to stack, pop from stack, xor, nop, znj, blah blah blah. Once Microsoft came out with Win95 and started to cut off direct calls to the CPU, my rudimentary ASM skills become more or less obsolete.

      I'm still predicting that sooner or later, Apple via OSX is going to see a huge outbreak of malware. An x86 CPU is an x86 CPU. It will run the same low level code, whether that code is executed through Windows or OSX. It just seems like Apple has done a slightly better job of controlling access to the hardware than Microsoft has. The payloads are all ready to go. Someone just needs to find a chink in the armor. Once Apple gets enough market share to make it worth while, those chinks will be found. Until then, everyone will keep going after the low-hanging fruit that are the Windows boxen.

    16. Re:profit motive by Lord+Ender · · Score: 1

      There is a difference between writing "a few" botnets, and writing one that actually works. Yours didn't work. You didn't have a control channel sophisticated enough to scale and avoid standard security controls.

      --
      A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
    17. Re:profit motive by stevey · · Score: 1

      You misunderstand me - I didn't mean to say I've created and released botnets into the wild.

      I meant that with private networks I've created self-replicating code which actively scanned and infected new hosts and had a sophisticated control mechanism which allowed control, updates, and activities.

      Still I've either convinced you that writing a bot, and by extension creating a botnet, is not exceptionally difficult - or I haven't.

    18. Re:profit motive by Narnie · · Score: 1

      They're creating a network to run Prime95 and win the EFF awards for finding prime numbers.

      --
      greed@All_Evils:~#
  6. This is just a passing virus by BadAnalogyGuy · · Score: 5, Funny

    No need to worry. I'd be more worried about Conficker C. Lots of opportunities to shoot you in the foot.

    Then someone will undoubtedly create Conficker C++ and everyone will cry about how hard it is to understand and they will all flock to Conficker Java which promises a much cleaner object system.

    But eventually you know that some idiot is going to write Conficker C# which looks suspiciously like Conficker Java, but after a while grows into this gigantic mess of quickfix designs.

    So if you think Conficker B is bad, just wait a while.

    1. Re:This is just a passing virus by jetsci · · Score: 1

      Did they already release Conficker-Basic?

      --
      Bored at work? Play Game!
    2. Re:This is just a passing virus by Anonymous Coward · · Score: 0

      Wake me up for Conficker Python.

    3. Re:This is just a passing virus by Ian+Alexander · · Score: 1

      Well yeah, but you need the BASIC interpreter installed to run it, so it's not like it does anything on 99% of systems.

    4. Re:This is just a passing virus by lennier · · Score: 1

      Forth Conficker powerful very is to used getting some takes but.

      --
      You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
  7. Cornfucker national anthem... by Smidge207 · · Score: 1, Funny

    *ahem* [taps microphone, clears throat again] *ahem*

    And a five, six, seven, eight:

    "Botnets, worldwide botnets.
    What kind of boxes are on botnets?

    Compaq, HP, Dell and Sony, TRUE!
    Gateway, Packard Bell, maybe even Asus, too.

    Are boxes, found on botnets.
    All running Windows, FOO [fu]!"

    =Smidge=

    --
    Is it just my observation, or is eldavojohn an idiot?
  8. Old news? by davidwr · · Score: 1

    Is it just me or has /. been reading like yesterday's news lately?

    --
    Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
    1. Re:Old news? by Logical+Zebra · · Score: 1

      That might be because it takes so long for stories to get approved...

      --
      I have a bad feeling about this...
    2. Re:Old news? by AlterRNow · · Score: 3, Insightful

      News for nerds, stuff that matter[ed yesterday]!

      On another note, if the editor knew of the previous story.. why was it posted? I must admit, I'm not very knowledgeable on the editorial process of ./

      --
      The disappearing pencil trick. Let me show you it.
    3. Re:Old news? by Duhfus · · Score: 3, Funny

      I must admit, I'm not very knowledgeable on the editorial process of ./

      Don't worry, the editors don't either.

    4. Re:Old news? by Spatial · · Score: 3, Funny

      The editors are a great guy, they accidentally a dupe and don't afraid of anything.

    5. Re:Old news? by Anonymous Coward · · Score: 0

      Slashdot has an editorial process? Dude, you just blew my mind.

    6. Re:Old news? by icannotthinkofaname · · Score: 1

      I'm not very knowledgeable on the editorial process of ./

      Neither am I. Come to think of it, this is the first I've heard of the "editorial process of the current working directory." I ought to go googling later....

      Or is there some other dot-slash that's relevant to this story?

      --
      Let q be a radix > 1. I am in ur base-q, killing 10 d00ds.
    7. Re:Old news? by Cthefuture · · Score: 1

      Meh, I would not have seen it if it wasn't posted today. Who cares about a few duplicates every once in a while. You get a fresh update and maybe some new people talking about it.

      --
      The ratio of people to cake is too big
    8. Re:Old news? by AlterRNow · · Score: 1

      Nicely spotted

      --
      The disappearing pencil trick. Let me show you it.
  9. But can it.... by SGDarkKnight · · Score: 3, Funny

    cause five tankers in the Ellingson fleet to capsize?

    --

    ...A no smoking section in a restaurant is like having a no peeing section in a swimming pool...
    1. Re:But can it.... by Acapulco · · Score: 1

      "The little boat...flipped over." - Mr. The Plague

      --
      Slashdot. Unreadable news to annoy nerds. - wonkey_monkey
    2. Re:But can it.... by V!NCENT · · Score: 1

      "A hacker planted the virus"
      -"Is that -?"
      "-That is mr. conflicker B++"
      -"Well then, put our servers under Linux control"
      "There's no such thing anymore, Duke. These computers are fully DRMised. It relies on satalite internet, which links our servers to Redmond"

      --
      Here be signatures
  10. Ninnle is safe by Anonymous Coward · · Score: -1, Flamebait

    This blasted worm that is attacking Winzoe systems worldwide doesn't even affect Ninnle Linux.

  11. Underpants Gnomes by Anonymous Coward · · Score: 0

    I keep trying to turn this into an Underpants Gnomes joke, but I can't figure out where to put the ?????

    1) Write virus and infect your honeypot system.
    2) Write paper on said virus and publish on add supported web site.
    3) Post several pointers to said web site on /.
    4) Profit
    5) Repeat with new variants.

    It just doesn't make sense. Where do the ?????'s go?

  12. Conficker-C++ under development by inthedump · · Score: 0

    While all this goes on, Conficker-C++ is under development. Programmers wanted. You need to have 30+ years of experience in C++ and a work out of a garage preferred located in Asia.

    --
    nobody remains virgin, life fscks everyone...
  13. I can't seem to get a Linux copy of this worm by mrphoton · · Score: 1, Funny

    I am feeling very left out, I can't seem to find Conficker B++ or even Conficker B in my yum repository. sigh... It is such a shame that linux is always behind the curve as far as new and exciting features are concerned.

    1. Re:I can't seem to get a Linux copy of this worm by Anonymous Coward · · Score: 0

      How about you write your own version ya lazy shit?

    2. Re:I can't seem to get a Linux copy of this worm by gzipped_tar · · Score: 1

      I am feeling very left out, I can't seem to find Conficker B++ or even Conficker B in my yum repository. sigh... It is such a shame that linux is always behind the curve as far as new and exciting features are concerned.

      'Coz the distro maintainers refused to include non-opensource binary blob in their repo.

      Make yourself heard. Chances are the malware author is considering opensourcing it too but no one's asking for it so far.

      --
      Colorless green Cthulhu waits dreaming furiously.
    3. Re:I can't seem to get a Linux copy of this worm by Anonymous Coward · · Score: 0

      I'll check my pacman repos.

    4. Re:I can't seem to get a Linux copy of this worm by Anonymous Coward · · Score: 0

      The author doesn't give a shit about your platform because it has 0% market share.

    5. Re:I can't seem to get a Linux copy of this worm by icannotthinkofaname · · Score: 1

      Just install Wine and run it through that. /problem>

      --
      Let q be a radix > 1. I am in ur base-q, killing 10 d00ds.
  14. Confusion by Dan+East · · Score: 1

    Conflicker B++ should not be confused with Objective Conflicker B. Fortunately, they can easily be distinguished from one another - Objective Conflicker B has many more square brackets.

    --
    Better known as 318230.
  15. How to detect Conficker C# by Dystopian+Rebel · · Score: 4, Funny

    The only way to detect Conficker C# is that it requires the .NET runtime environment and MS SQL Server Express.

    --
    Rich And Stupid is not so bad as Working For Rich And Stupid.
    1. Re:How to detect Conficker C# by Anonymous Coward · · Score: 0

      Don't worry, Miguel de Icaza will port it to Mono

    2. Re:How to detect Conficker C# by b4dc0d3r · · Score: 1

      And once again mono prevalence increases due to viruses. Just like the good old days!

    3. Re:How to detect Conficker C# by yanyan · · Score: 1

      That does it. Windows users have all the fun. This is just another sign that Linux will never, ever gain widespread acceptance. And that fabled Year of the Linux Desktop? Keep dreaming guys. I'm dumping Bubuntu Linux XP and moving to Windows. See you around suckers.

    4. Re:How to detect Conficker C# by Vu1turEMaN · · Score: 1

      What are you talking about? Its in the .NET 3.5 Installer!

      Why do you think the full-package installer of 3.5 needs an internet connection to download more? Conspiracy!

  16. UseLess Computer Science Departments: +1, True by Anonymous Coward · · Score: 0

    Why don't the genius Computer Science majors tackle this problem?

    Rob Pike was right. Systems software research is dead.
    More importantly , the faculty members and students are
    dead heads with Linux, TeX, Java, and C++.

    Yours Computationally,
    Kilgore Trout

    1. Re:UseLess Computer Science Departments: +1, True by Anonymous Coward · · Score: 0

      Most CS people are using virtually 100% secure platforms like OS X where worms are just curiosities, not hazards.

  17. Who is at risk? by Anonymous Coward · · Score: 2, Informative

    Let's turn this blog positive.

      What current anti-virus solution detects and removes this new variant ?,
      Who is it risk?, people with updated anti virus solutions? or just people who don't use and update them?
    Are people with Linux and OS-X at risk also ? What is the scope of it?
    If Linux and OS-x are not threatened This might be another reason Not to use Windows ?
      The answers to these will help people determine just how big a threat or not this new variant might be, and help them help themselves

     

    1. Re:Who is at risk? by dave562 · · Score: 2, Informative

      The article spells it out. People who haven't applied the security patch that Microsoft released months ago are vulnerable. The rest of the world are just fine. So like usual, it comes down to the poor home users who get screwed while the corporate networks who actually have admins doing their job maintaining them are doing just fine. Luckily things are better and only the subset of home users who don't have automatic updates turned on are screwed.

    2. Re:Who is at risk? by gad_zuki! · · Score: 1

      The patch stops the SMB vulnerability, but I believe the USB auto-run is just an executable. There's no vulnerability needed if the OS is going to run the autorun a file as administrator.

      MS should just globally disable autorun. This is getting out of hand. Half of these infections is probably some low-paid tech inserting the same usb drive into his customers computers. That seriously would not surprise me.

  18. THIS FP FOR 0GNAA by Anonymous Coward · · Score: -1, Redundant

    FreeBSD used to cans cAn become

  19. You heard about the infinite amount of monkey's? by SmallFurryCreature · · Score: 1

    A bit like having an infinite amount of monkey's writing shakespear. Sadly they could only aford half a dozen monkey's but what they lack in numbers they make up for in poop slinging skills.

    --

    MMO Quests are like orgasms:

    You may solo them, I prefer them in a group.

  20. Armour Hot Dogs? by srobert · · Score: 2, Funny

    Seems to go with the Armour Hot Dog song. Was that the intent?

  21. so if I understand this correctly .... by nblender · · Score: 2, Interesting
    We (the global 'we') had a chance to stop conflicker before this version came about; by working with the registrars and/or root nameservers; pre-emptively invalidating each of the algorithmically generated domain names on a day by day basis; preventing cornfucker from updating itself or receiving instructions on how to proceed. The authors noticed that we could do that and before we could think of it, modified it so that once we did think of it; it would be too late....

    I clearly must not understand the intricacies of this....

    My fantasy (because I won't be affected by this) is that once the owners of the botnet are sufficiently happy with their market-share, will instruct cornfucker to encrypt all files on everyone's PC and then wait for the moneh to start rolling in....

    1. Re:so if I understand this correctly .... by Anonymous Coward · · Score: 0

      I clearly must not understand the intricacies of this....

      Nice understatement.

  22. How about a million monkeys? by Anonymous Coward · · Score: 0

    "Imprison a million monkeys in a room with a million typewriters and wait a billion years and you'll end up with many dead monkeys and a printed copy of Wikipedia." - John Le'Brecage

  23. Proper naming convention, please by LordSnooty · · Score: 2, Interesting

    Conficker/Downadup? B? B++? Is it time we had a proper naming scheme for these things? For this instance we've seen several companies getting together to coordinate a response - that's good. But even better, if everyone were to agree on the same name, WE could coordinate our response too.

    And what kind of scheme? Well, how about following the convention of the hurricane trackers? 26 names assigned to each major piece of malware that appears throughout the year. This is a double bonus, as ending the practice of using the authors' chosen names might take away some of that bragging aspect. "Oh, you wrote Malware Julie did you?? Bwahaha"

    1. Re:Proper naming convention, please by Culture20 · · Score: 1

      Conficker/Downadup? B? B++? Is it time we had a proper naming scheme for these things?

      You forgot Net-Worm.Win32.Kido.bt

      Well, how about following the convention of the hurricane trackers? 26 names assigned to each major piece of malware that appears throughout the year.

      Malware writers might get sloppy as they vie for the top names, trying to make sure that _their_ malware becomes a headline in just the right time to be named "Thor" or "Linus".

  24. And guess what? by Anonymous Coward · · Score: -1, Redundant

    It doesn't affect me and I don't care!

  25. Functional malware by kkrajewski · · Score: 1

    Don't about Conficker Lisp -- it overflows your buffers with parentheses.

  26. When Change comes to viruses by lord_sarpedon · · Score: 1, Funny

    I'd like to see an incredibly stealthy virus - one that stays out of the way to the point that it isn't detected for some number of years.

    Have it patch key parts of the Windows kernel to degrade performance in subtle but believable ways...
    Lobotomize the scheduler so that context switches occur much less often than they should for responsiveness.
    Kick up the swappiness from Ridiculous (stock setting) to We've-gone-plaid
    Divide the given buffer length for each I/O operation so that CPU usage goes up and throughput goes down.

    I wonder if we'd _ever_ notice.

    --
    "Strangers have the best candy" -Me
    1. Re:When Change comes to viruses by daveime · · Score: 2, Funny

      You just described Vista ...

  27. Windows Update... by Narnie · · Score: 1

    I still think Microsoft should hire these guys to revamp Windows Update.

    --
    greed@All_Evils:~#
    1. Re:Windows Update... by Architect_sasyr · · Score: 1
      I'd have given a + mod but I have to make some points
      • Verification of update paths is difficult to secure if you're going to permit just anyone from doing it (i.e. a "torrent" style update).
      • A central authentication service, or a distributed-yet-centralised authentication service, is going to be necessary to deal with above step
      • Microsoft have to update an entire OS and package, "worm guy" only has to update a few programs, and if something breaks he doesn't care

      Just a few, but there are a number of issues with distributed, safe, automatic updates. Mirroring out to secondary servers isn't a bad idea (a-la sourceforge or WSUS) but a corporation wants to maintain control over their product and who gets it. The most important one is probably the 3rd point though. Just something to think about before you go rag on an update system.

      /me kicks OS X server for breaking CPAN installs

      --
      Me failed English...
      FreeBSD over Linux. If my comments seem odd, this may explain...
  28. Linux Users have a root by Anonymous Coward · · Score: 0

    Windows would be fine if it could get a root. ;)

    Seriously though - for all the "are you sure?" pop-ups from vista why are there so many exploits. That is, how could the user make vista any worse - give them superuser privileges that way you won't get exploited by an app.

  29. cornfucker by Anonymous Coward · · Score: 0

    cornfucker. Yes. Thank you. WOW.

  30. wrong by Anonymous Coward · · Score: 0

    YOU are the reason Slashdot sucks NOW.