Slashdot Mirror
New, Stealthy Conficker B++ Worm Discovered
nandemoari writes "A new variant of the Conficker/Downadup worm has been detected. The worm opens a backdoor on an infected machine and allows hackers remote control of infected PCs.
Dubbed Conficker B++ (and not to be confused with Conficker B), the new variant of the worm opens a backdoor with auto-update functionality, allowing a hacker to distribute malware to infected machines.
It's difficult to know exactly how long Conficker B++ has been circulating, but researchers first noticed it on February 6 of this year." If this seems familiar to you, it probably is.
Anyone know the procedure for detecting these? I imagine A/V companies setup 'honeypots' of sorts on high traffic networks and that but how do you detect something new like this? Do they track it through an old signature?
Bored at work? Play Game!
Then he can sell it on eBay as A++++++++++++++
No need to worry. I'd be more worried about Conficker C. Lots of opportunities to shoot you in the foot.
Then someone will undoubtedly create Conficker C++ and everyone will cry about how hard it is to understand and they will all flock to Conficker Java which promises a much cleaner object system.
But eventually you know that some idiot is going to write Conficker C# which looks suspiciously like Conficker Java, but after a while grows into this gigantic mess of quickfix designs.
So if you think Conficker B is bad, just wait a while.
cause five tankers in the Ellingson fleet to capsize?
News for nerds, stuff that matter[ed yesterday]!
On another note, if the editor knew of the previous story.. why was it posted? I must admit, I'm not very knowledgeable on the editorial process of ./
The disappearing pencil trick. Let me show you it.
Sell anti-virus software.
Don't worry, the editors don't either.
Botnets can be profitable, however, someone skilled enough to write the malware necessary for botnet creation could likely be making better money in the private sector with a real job and no jail risk (in the US, at least). Most of the stuff I see comes from Eastern Europe or Asia, where law enforcement is unlikely to prosecute and there aren't decent Software industries hiring people with programming talent.
So they make money by
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
You laugh, but that situation is just what F-Secure describes for an unrelated bit of Facebook malware. FTFA:
Carousel is a lie!
The editors are a great guy, they accidentally a dupe and don't afraid of anything.
The only way to detect Conficker C# is that it requires the .NET runtime environment and MS SQL Server Express.
Rich And Stupid is not so bad as Working For Rich And Stupid.
That's not necessarily true - I mean the skills required to exploit a known security hole aren't terribly difficult.
If you're familiar with a small amount of low-level coding you can easily follow cookbook-style tutorials to getting shellcode executed. At that point you're done.
Sure you need to do some disguising, and you need to understand a bit of crypto to setup a key-verification for downloading updates.
But I'd expect there are literally millions of coders still kicking around from the 80s/90s who did assembly programming under MS-DOS who would be able to write that kind of code - and because it isn't really really skilled work the chances are high that a significant proportion of those developers are unemployed.