Slashdot Mirror
New, Stealthy Conficker B++ Worm Discovered
nandemoari writes "A new variant of the Conficker/Downadup worm has been detected. The worm opens a backdoor on an infected machine and allows hackers remote control of infected PCs.
Dubbed Conficker B++ (and not to be confused with Conficker B), the new variant of the worm opens a backdoor with auto-update functionality, allowing a hacker to distribute malware to infected machines.
It's difficult to know exactly how long Conficker B++ has been circulating, but researchers first noticed it on February 6 of this year." If this seems familiar to you, it probably is.
Anyone know the procedure for detecting these? I imagine A/V companies setup 'honeypots' of sorts on high traffic networks and that but how do you detect something new like this? Do they track it through an old signature?
Bored at work? Play Game!
Then he can sell it on eBay as A++++++++++++++
No need to worry. I'd be more worried about Conficker C. Lots of opportunities to shoot you in the foot.
Then someone will undoubtedly create Conficker C++ and everyone will cry about how hard it is to understand and they will all flock to Conficker Java which promises a much cleaner object system.
But eventually you know that some idiot is going to write Conficker C# which looks suspiciously like Conficker Java, but after a while grows into this gigantic mess of quickfix designs.
So if you think Conficker B is bad, just wait a while.
cause five tankers in the Ellingson fleet to capsize?
News for nerds, stuff that matter[ed yesterday]!
On another note, if the editor knew of the previous story.. why was it posted? I must admit, I'm not very knowledgeable on the editorial process of ./
The disappearing pencil trick. Let me show you it.
Sell anti-virus software.
Don't worry, the editors don't either.
Botnets can be profitable, however, someone skilled enough to write the malware necessary for botnet creation could likely be making better money in the private sector with a real job and no jail risk (in the US, at least). Most of the stuff I see comes from Eastern Europe or Asia, where law enforcement is unlikely to prosecute and there aren't decent Software industries hiring people with programming talent.
So they make money by
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
You laugh, but that situation is just what F-Secure describes for an unrelated bit of Facebook malware. FTFA:
Carousel is a lie!
The editors are a great guy, they accidentally a dupe and don't afraid of anything.
The only way to detect Conficker C# is that it requires the .NET runtime environment and MS SQL Server Express.
Rich And Stupid is not so bad as Working For Rich And Stupid.
Let's turn this blog positive.
What current anti-virus solution detects and removes this new variant ?,
Who is it risk?, people with updated anti virus solutions? or just people who don't use and update them?
Are people with Linux and OS-X at risk also ? What is the scope of it?
If Linux and OS-x are not threatened This might be another reason Not to use Windows ?
The answers to these will help people determine just how big a threat or not this new variant might be, and help them help themselves
That's not necessarily true - I mean the skills required to exploit a known security hole aren't terribly difficult.
If you're familiar with a small amount of low-level coding you can easily follow cookbook-style tutorials to getting shellcode executed. At that point you're done.
Sure you need to do some disguising, and you need to understand a bit of crypto to setup a key-verification for downloading updates.
But I'd expect there are literally millions of coders still kicking around from the 80s/90s who did assembly programming under MS-DOS who would be able to write that kind of code - and because it isn't really really skilled work the chances are high that a significant proportion of those developers are unemployed.
Seems to go with the Armour Hot Dog song. Was that the intent?
I clearly must not understand the intricacies of this....
My fantasy (because I won't be affected by this) is that once the owners of the botnet are sufficiently happy with their market-share, will instruct cornfucker to encrypt all files on everyone's PC and then wait for the moneh to start rolling in....
Conficker/Downadup? B? B++? Is it time we had a proper naming scheme for these things? For this instance we've seen several companies getting together to coordinate a response - that's good. But even better, if everyone were to agree on the same name, WE could coordinate our response too.
And what kind of scheme? Well, how about following the convention of the hurricane trackers? 26 names assigned to each major piece of malware that appears throughout the year. This is a double bonus, as ending the practice of using the authors' chosen names might take away some of that bragging aspect. "Oh, you wrote Malware Julie did you?? Bwahaha"
You just described Vista ...