Conficker Worm Asks For Instructions, Gets Update

KingofGnG writes "Conficker/Downup/Downadup/Kido malware, that according to Symantec 'is, to date, one of the most complex worms in the history of malicious code,' has been updated and this time for real. The new variant, dubbed W32.Downadup.C, adds new features to malware code and makes the threat even more dangerous and worrisome than before."

Comments

coward

[Anonymous Coward]

FIRST! now.. where do i get that update ?

Updates?

[BrokenHalo]

Just so long as it doesn't insist on verification to check that nobody is using an unauthorised copy. After all, we wouldn't want to encourage piracy... ;-)

Who care?

[Clarious]

I run Linux! http://xkcd.com/272/

Re:Who care?

[AlterRNow]

Last week? The year is currently 2009.

*chomp*

Re:Who care?

[Anonymous Coward]

Last week? The date at the top of that article you linked to says "September 14, 2002 9:35 PM PDT"

Re:Who care?

[Lostlander]

[quote]The worm targets Apache Web server installations [/quote]
Apache while an important application is NOT Linux.

Re:Who care?

[Lostlander]

Fail for me on the quote brackets. I blame phpbb and bbcode for ruining my html posting skills.

Re:Who care?

[__aaxwdb6741]

What do you blaim your inability to read the mandatory preview on?

Re:Who care?

[Lostlander]

What do you blaim your inability to read the mandatory preview on?

I'm American, I don't have time to make sure I'm correct before spouting off at the mouth.

Re:Who care?

[AVryhof]

I run Conflicker.

Re:Who care?

[spacefiddle]

What do you blaim your inability to read the mandatory preview on?

Whatever we can blame yours on, I suppose!

Re:Who care?

[RavenofNi]

What do you blaim your inability to read the mandatory preview on?

The real shame is that the preview doesn't check spelling as well as appearance.

Re:Who care?

[jpmorgan]

Actually, I believe you'll find it targets no true Scotsmen.

Re:Who care?

[node 3]

Apache while an important application is NOT Linux.

Very few Windows viruses attack the Windows kernel.

Linux, the kernel, is one thing, and immune to an Apache exploit. Linux, the OS, generally includes Apache.

Re:Who care?

[Anonymous Coward]

Last week, huh? Then why does it say "September 14, 2002" at the top? FAIL.

Re:Who care?

[adolf]

It does?

My Linux boxes don't have Apache on them. Every stupid little program I have that wants to have its own web site already includes some other means wrangling HTTP (like, say, mediatomb).

So: I don't need Apache on my machines, and therefore it isn't there. I do rent time on a shared Linux webhost, and they run Apache, but that's not mine.

Re:Who care?

[node 3]

My Linux boxes don't have Apache on them.

How many boxes is that, total? Are you saying your case counts as "generally"?

Just because you don't have Apache installed, doesn't mean that most Linux installs don't have Apache installed. As far as Windows security goes, you're the analog of someone who doesn't run IE, or doesn't run as Administrator, etc. You're the exception, not the rule.

Re:Who care?

[adolf]

An Ubuntu desktop for me. A Gentoo general-purpose box for the network. An Xubuntu desktop box for my daughter. A couple of Linksys WRT54G's. There's another machine here which runs various Linuxes, purely as an OS exploration toy. There's also an iMac G3 which has Ubuntu on it. None of these machines have Apache installed.

Some of my usage (particular the Ubuntu parts) is very typical. Some of the rest is also rather typical (though most owners of older WRT54G routers are oblivious to the fact that they own a Linux box). Really, the only thing I have which is particularly out-of-the-ordinary is the catch-all Gentoo machine.

I just don't see the merit in publishing local Web applications on my own network with Apache. And for stuff that I want to use anywhere, there's Dreamhost (or Facebook, or Myspace, or whatever the kids are all about these days).

So, yes: I think my case counts as "generally." And with that, I'd like to restate my claim: Generally, Apache is not part of a typical Linux install.

Re:Who care?

[fractoid]

http://www.stopsayingfail.com/

Re:Who care?

[RAMMS EIN]

``Linux, the OS, generally includes Apache.''

What makes you say that? Most Linux installations I have seen don't include Apache. Do you have any numbers?

Re:Who care?

[RAMMS EIN]

``Linux, the OS, generally includes Apache.''

Even if true, it does not invalidate the parent's claim.

But you have a point, and it is that we should be comparing products as shipped. Compare a base install of Windows to a base install of a Linux distribution, then draw conclusions about that version of Windows and that version of that Linux distribution. You can't generalize beyond that. If Apache is included in the base install, you have to count it (though it matters if it is disabled or enabled out of the box, of course).

Re:Who care?

[Anonymous Coward]

Very few Windows viruses attack the Windows kernel.

I call bullshit.

Re:Who care?

[__aaxwdb6741]

Touche. I suffer from the same, obviously.

Re:Who care?

[dazjorz]

Linux, the OS, generally includes Apache.

Linux, the OS, most generally does *not* include Apache. The default installation doesn't, and only web servers install a web server separately, which in most cases is indeed Apache but it can be lighttpd or a whole range of others too. But my desktop has never ever even seen a trace of Apache, as will most other Ubuntu Desktop installations; it would be too fast an assumption to say Linux installations generally include Apache.

Next to that: On most installations, Apache runs as its own user with all privileges dropped (most distro's do this by default). Therefore, it will be generally impossible to actually intrude the system, which *does* happen with Windows viruses, trojans and worms. It will be severely handicapped and less able to do damage than a standard Windows virus.

Dumbasses

[RoFLKOPTr]

If people would stop downloading free_porn.jpg from 4chan, renaming it to free_porn.exe, and running it... we would not be having these problems.

Re:Dumbasses

[Spazztastic]

If people would stop downloading free_porn.jpg from 4chan, renaming it to free_porn.exe, and running it... we would not be having these problems.

If people would stop jumping to conclusions and assuming the answer is that simple, we would not be having these problems.

Who modded him insightful? This virus isn't spreading because of people doing something clearly shady, it's because Internet Explorer still has the JPG exploit unresolved. The user can simply view a webpage with a malicious image (which could just be a 1px whitespace) and it executes the malicious code. I've dealt with many computers in the past months since it surfaced.

Solutions? Don't use IE. Use SpyBot Search & Destroy to harden the systems, use Firefox with Adblock+ and NoScript. Use an antivirus program that actually has a webguard, such as Avira.

Re:Dumbasses

[Anonymous Coward]

Who modded him insightful?

Haven't you heard? Insightful is the new funny. Oh, and, you know, whoosh

Re:Dumbasses

[ColdWetDog]

Solutions? Don't use IE. Use SpyBot Search & Destroy to harden the systems, use Firefox with Adblock+ and NoScript. Use an antivirus program that actually has a webguard, such as Avira.

Sounds like an awful lot of work. Maybe move to a different OS?

Re:Dumbasses

[Spazztastic]

Solutions? Don't use IE. Use SpyBot Search & Destroy to harden the systems, use Firefox with Adblock+ and NoScript. Use an antivirus program that actually has a webguard, such as Avira.

Sounds like an awful lot of work. Maybe move to a different OS?

Ok, sure. It's a lot of work if you look at it in a simple fashion of throwing an Ubuntu CD at some user and saying "SUCK LESS THX"

How about the hours that go into training one or many users in a company on using that new OS? Compatibility problems? Setting up specialized software?

System hardening is more cost-effective decision versus switching OSes or having to clean up every computer that comes up with the problem. It takes about two hours at most to do it from scratch on one system image, then you can reimage as many computers that come up with the problem.

Re:Dumbasses

[Urd.Yggdrasil]

Uhh, what? I have no idea what this "JPG exploit" your talking about is. Conflicker spreads through the MS08-067 RPC vulnerability, removable media, and shared folders; nothing to do with IE or jpegs.

Re:Dumbasses

[Kokuyo]

Thanks, I'd like an OS that does what I want.

And before someone mods me Troll, I'd like to state that I have tried getting used to several versions of Ubuntu and Mandriva. While Mandrive by far had the better experience for me, I still wasted hours and hours to get stuff to work that just works out of the box on XP.

So while I appreciate Linux as a server OS and while I see many happy people running linux, it just isn't the OS for me.

Therefore, compared to all the trouble I usually have with linux, this 'awful lot of work' seems rather enjoyable in comparison. And no, MacOS is not an alternative, since I really can't afford the hardware (and, again, don't want to hack the thing onto my own machine...).

Re:Dumbasses

[Spazztastic]

Uhh, what? I have no idea what this "JPG exploit" your talking about is. Conflicker spreads through the MS08-067 RPC vulnerability, removable media, and shared folders; nothing to do with IE or jpegs.

I might be off on how it's spread, but I know of many other virus' that spread because of the JPG exploit. If I was at home I would dig up the sample image I have that if opened in IE it opens up a message box saying "Your browser is insecure!". Using the simple JavaScript that it does to make that message you can use it to open up popups to malicious webpages, offensive material, etc.

Re:Dumbasses

[Jamie's Nightmare]

Internet Explorer still has the JPG exploit unresolved.

You would be right, except for this patch that was released in 2004 shows that you aren't.

Re:Dumbasses

[truthsearch]

It takes about two hours at most to do it from scratch on one system image, then you can reimage as many computers that come up with the problem.

Except new holes and malware will keep appearing and the process will need to be done over and over. Add it all up and it's a lot of hours. In the long run it might be cheaper to switch OSs and retrain if that new OS is generally more secure and easier to harden up front.

Re:Dumbasses

[Urd.Yggdrasil]

I really wish you would upload a sample someplace because I have never heard of anything like this. The last widely exploited image file based exploits that I know of was the ANI and WMF vulnerabilities, and those have been patched a while ago.

Re:Dumbasses

[JonTurner]

>>How about the hours that go into training one or many users in a company on using that new OS? Compatibility problems? Setting up specialized software?

Still probably cheaper than having your entire network (and all corporate data, financial plans, product designs, confidential data, HR information, payroll, etc.) owned by a botnet and copied to who-knows-where.

Re:Dumbasses

[camcorder]

You might install them once, but you need to run them zillion times. At least migrating to another OS would save you from total time spent using an inferior one.

Re:Dumbasses

[Spazztastic]

Except new holes and malware will keep appearing and the process will need to be done over and over. Add it all up and it's a lot of hours. In the long run it might be cheaper to switch OSs and retrain if that new OS is generally more secure and easier to harden up front.

Group policy scripts can have new hosts files downloaded and put in place, antivirus updates can patch holes, etc.

I'm 100% with trying to move Open Source, and I'm trying to push an Edubuntu lab in this district but it's a lot of work to apply it to the administrative systems.

Re:Dumbasses

[Surrounded]

You do realize that during a somewhat recent (Last 2 years) hacker convention, Vista/IE was only exploitable AFTER another product was installed (Adobe). The whole "Blame IE" mantra is really annoying and has lost most of it's merit. FireFox has critical security flaws just like IE.

The real solution? Use SpyBot, your favorite browser (If it happens to be IE, use IE7Pro with Adblocking, which is free), use your antivirus program (Which probably wont protect you entirely), and the most important part? Check what links point to and if you trust the site you are on.

Re:Dumbasses

[Jamie's Nightmare]

That's because it was patched quite awhile ago. I got a sneaking suspicion this guy has windows update completely disabled, and it still using XP with no service packs because he "can't trust" Microsoft updates.

Re:Dumbasses

[Spazztastic]

I really wish you would upload a sample someplace because I have never heard of anything like this. The last widely exploited image file based exploits that I know of was the ANI and WMF vulnerabilities, and those have been patched a while ago.

When I get home this evening I'll reply to this with it, I can't get onto the message board I found it in.

Re:Dumbasses

[Spazztastic]

I got a sneaking suspicion this guy has windows update completely disabled, and it still using XP with no service packs because he "can't trust" Microsoft updates.

Sounds like you've been reading too much of TheDailyWTF. I sound like a lying jackass right now because I can't provide an example, but once I get home I'll reply with one.

Re:Dumbasses

[salesgeek]

System hardening is more cost-effective decision

Says who? On what basis? Yes, changing OS is disruptive, but it solves the problem of malware in near finality. Personally, I made the jump this year, and have not lost a single day to malware or OS issues. I can still run Windows apps when needed (hello VirtualBox), but don't have to for the basics: email, web, word processing, etc... VirtualBox in many ways is a padded cell to Windows insanity.

Reimaging is all fine and good until the guy in accounting calls and asks where the proforma balance sheets for next weeks annual report went that were on drive C:. Also: pushing a reimage to your users is easier on paper than it is in real life. Add to that the average cost of a new PC may be substantially less than fixing a software hosed one (data recovery is THE COST), and you really have to wonder why IT people continue to protect bad infrastructure.

Don't even get me started with some of the features of Linux that make it incredible for network use: X11, AndrewFS, CUPS, interoperability (it talks to everything), apt (or rpm), OpenVPN, etc... All of which remove barriers, while much software creates. When all you have is a hammer, everything looks like a nail.

Re:Dumbasses

[joelmax]

the JPG exploit is actually an old one (I thought even ms got this exploit in sp2 or something like that) and is really easy. Basically you take a jpg image , open it with a file compression app and then drop your payload in. When the Image is loaded, the payload is executed, effectively infecting systems. Really, as an exploit it is quite a frustration, however as a means of cheap encryption, it could prove entertaining (need your buddy to get your message and not have the teach read it in front of the class)... Now, granted there is a little more to it than that, however that is the basics of the jpg exploit and how it works.

Re:Dumbasses

[Anonymous Coward]

If people would stop jumping to conclusions and assuming the answer is that simple, we would not be having these problems.

Lighten up, Francis.

Re:Dumbasses

[Deanalator]

Hahaha then too,
but my guess is that spazztastic is referring to ms09-002

http://milw0rm.com/video/watch.php?id=96

Re:Dumbasses

[Urd.Yggdrasil]

I still very much doubt it, for the simple reason that if this was indeed a publicly known vulnerability that required no javascript and could be executed by opening an image file every hacker and their grandma would be using it right now. Those sorts of exploits are very valuable to malware authors.

Re:Dumbasses

[Spazztastic]

All of my posts are coming off as anti-linux, and I'm not. I've tried to push it but nobody moves on it.

In the place I work for, we tell users ALWAYS put your files on your network shares. We don't back up your data before we reimage it because you went to a website that is not work relevant or got a virus for plugging in your brothers thumb drive with virus embedded in U3. It's proven to work well here, and if they do tell me that they need something backed up, I pop in my Knoppix thumbdrive, back it up, and then reimage it.

Re:Dumbasses

[Tony Hoyle]

It exists, but I'm not sure of the details - I do know there have been a few jpegs on the wow forums in the last few months with a payload on them, and some have been caught out before the image was deleted.

Re:Dumbasses

[xorsyst]

And if you must run as local admin (which, to be honest, is sometimes the only way to get stuff done), consider using Drop my rights to run any given program under lower privaledges. My firefox runs this way on my otherwise admin system. I only remembered this the other day when I tried to install the latest acrobat reader update and it complained it didn't have sufficient privaledges.

Re:Dumbasses

[Anonymous Coward]

(META)

I do appreciate that insightful is reserved for funny+karma. I have a good experience with:

          -1 Insightful 0 Offtopic
          0 Interesting -3 Flamebait
          -4 Funny 0 Troll
          0 Informative -2 Redundant

Re:Dumbasses

[Ritz_Just_Ritz]

Personally, I'd balance those "retraining" costs against the potential cost of having some careless person infect your corporate network and then having to deal with the fallout.

Sure, there are companies that have the need to run specific applications that (today) only work in a Windows environment. But the VAST majority of office drones out there are basically using Microsoft Office, a mail client, and a web browser. Migrating that typical user to Openoffice + some non-Outlook client + Firefox is not THAT herculean of a tast. A pain in the ass for a few days? Sure. Compared to a company wide Conficker (or worse) infection? Not even close.

Best,

Re:Dumbasses

[NatasRevol]

You mean like the cornflicker people???

Re:Dumbasses

[spacefiddle]

Please don't mention "4chan" and "hardened systems" that closely.

Re:Dumbasses

[Urd.Yggdrasil]

I mean any malware author. Code execution vulnerabilities in non-executable file formats like images or documents can get through email and intrusion detection systems much more easily than exe's.

Re:Dumbasses

[Anonymous Coward]

I've always wanted to create a worm that required users to follow an annoyingly long sequence of instructions for it to spread. Then monitor how much it spreads.

Something like download JessicaAlbaNude.jpg. Rename it to JessicaAlbaNude.tar. Download tar.exe. type tar -xvf JessicaAlbaNude.tar. cd src. Edit Makefile to set appropriate flags....

Re:Dumbasses

[rantingkitten]

Ah yeah, the ol' "retraining" argument. That one's always been hilarious to me. Like users "know" Windows either?

They don't. The vast majority of people don't "know" Windows -- they know how to click a few icons, the locations of which they've memorized, so they can launch applications -- usually really generic ones. If you move their icons around suddenly it's "HEY MY OUTLOOK DISAPPEARED" and "I CAN'T FIND THE H DRIVE!" And if you ask them to do anything in Windows beyond opening and using those few applications, they're hopeless.

Saying these people "know" Windows is absurd. They don't want to use "Windows" or "Linux" -- they want to write an email to a client and type a sales proposal. Do you think they care if they're emailing in Outlook or Evolution? Do you think they care if they're writing in Office or Open Office? They just care if it works or not.

Yeah, you're always going to find that one Windows-only application that one doofus in one department absolutely must have, or the accountants still hanging onto the macros they wrote in 1997, without which they can't do their jobs. Fine. But the huge sales and HR staff? These days most of that type of work is done with web-based CRMs and suchlike, so switching to a new OS wouldn't even really be much of a switch for them. This also eliminates "compatability problems", which is something that's becoming less and less of an issue every year anyway.

The rest of the applications, most people are so clueless they wouldn't realise much had changed, and getting someone up to speed on how to change fonts in OO instead of Office isn't some huge challenge.

So, the way I see it, you can spend an hour "training" people about how their icons look different and are in a different place now, or you can keep throwing wave after wave of employees at the problem of trying to secure an inherently insecure OS, or re-imaging it every three days.

Re:Dumbasses

[PitaBred]

It sounds like you're trying to treat Linux like it was Windows, but free. The people that have the most problems switching to Linux are those that are Windows power-users. Linux is not Windows.

Remember, you're a newbie when you go to Linux, and there are a lot of people (like me) who use it as their only OS, where Windows is relegated to the "toy" system. It is possible. Just gotta change the way you think.

Re:Dumbasses

[joelmax]

Here is teh MS Link (MS04-028): http://www.microsoft.com/technet/security/Bulletin/MS04-028.mspx

Re:Dumbasses

[joelmax]

It is publicly known since it was fixed 5 years ago. No point in attacking a fixed exploit

Re:Dumbasses

[DrVomact]

the JPG exploit is actually an old one (I thought even ms got this exploit in sp2 or something like that) and is really easy. Basically you take a jpg image , open it with a file compression app and then drop your payload in. When the Image is loaded, the payload is executed, effectively infecting systems. ... Now, granted there is a little more to it than that, however that is the basics of the jpg exploit and how it works.

I'm sure there must be "a little more to it than that", because what you've said so far doesn't make sense. What does it mean to "open a JPG image with a file compression app"? I open WinZip and put the file in a new archive? Then I add some malicious program to the zip file? I don't see how this would work. If I execute the zip file, WinZip opens up and shows me that the archive file contains a jpg and some mysterious program. Why would I run the program? Why would loading the jpg image run the program? Or do I change the extension of the archive file from zip to jpg? That's not going to work--anything that displays graphics will just say that it's not a jpg.

Maybe you do know what you're talking about, but you haven't explained it very well.

Re:Dumbasses

[NeverVotedBush]

Heck, just configure it with one of the default Windows desktop backgrounds and you might not need to retrain at all... ;-)

Re:Dumbasses

[Anonymous Coward]

Your a dumbass. I'm sure changing a extension will do everything...fucking non-technicalfag.

Re:Dumbasses

[joelmax]

There is more to it, but no real need for tons of detail, that is more of a brief overview on how it can be done. Hence the phrase:

Now, granted there is a little more to it than that, however that is the basics of the jpg exploit and how it works.

For exact details about the exploit, you can check out the MS Article for it (Linked above and below this post), and google is always a fun time (If you want to know how to do it)... just be careful what you click on a windows box :).

Re:Dumbasses

[anagama]

I agree with you on the point that most people use computers in a rote and unimaginative fashion. However, I think in some respects people do care what program/OS they use, just not for the right reasons.

For example, a couple weeks ago I saw my new receptionist sitting at her desk with a laptop wedged between herself and the monitor for her desktop. When I asked her what she was doing, she explained that she was entering some data into excel -- a simple two column "item,price" type thing. I told her I want her to use our spreadsheet (openoffice) using her office computer so the information would be saved in the proper place, and I sure as heck didn't want a windows machine connected to my network in any fashion. She said, "But I need to use excel because it will add the numbers automatically." !!! I showed her that sum(a1:a20) was the same in both.

I know she is not happy that she has to use openoffice -- she has made comments a number of times about how much more she likes windows in general. So, while her computer use is completely rote, she does have an unfathomable preference for windows.

As an aside, I don't understand why community colleges focus on teaching specific applications -- they should focus on teaching application concepts. Rather than "excel", they should teach working-with-spreadsheets. Rather than "Word", they should teach key wordprocessing concepts. These types of office programs haven't had anything actually new in them, aside from spellcheck perhaps, since the 80s. There is simply no excuse for teaching a specific program - just how useful is WordPerfect for DOS knowledge anymore? I feel like I hit Shift-F7 in WP a lot. Can't even remember what it was for now.

Re:Dumbasses

[Anonymous Coward]

Please don't mention "4chan" and "hardened systems" that closely.

Pffft. I have a dog, and my curtains are closed.

Re:Dumbasses

[Joren]

I might be off on how it's spread, but I know of many other virus' that spread because of the JPG exploit. If I was at home I would dig up the sample image I have that if opened in IE it opens up a message box saying "Your browser is insecure!".

That particular popup you reference is typically presented as an image file that is designed to mimic a Windows dialog. You click it and it takes you to a site selling some snake oil or trying to exploit vulnerabilities, as you said. All it needs to be is an image inside an HTML link tag... I certainly wouldn't refer to hyperlinking an image file as a "JPG exploit."

Using the simple JavaScript that it does to make that message you can use it to open up popups to malicious webpages, offensive material, etc.

That's not an exploit, that's just abusing popups. A JPG exploit would be something where executable code is hidden inside of the JPG file itself. Perhaps you were referring to something else?

Re:Dumbasses

[number6x]

As already reported on Slashdot people don't know if it is Windows or not anymore.

If you stick with Windows you have to retrain them every four or five years, and if you switch from Windows you have to retrain them. So you have to retrain no matter what.

Of course with Open Source you get to set the schedule and work it into your budget. With Windows you get a year or two window that Redmond chooses for you to make the switch.

Re:Dumbasses

[Quothz]

What does it mean to "open a JPG image with a file compression app"? I open WinZip and put the file in a new archive? Then I add some malicious program to the zip file? I don't see how this would work.

While the precise details escape me, it helps if you're aware that .jpg -is- a compressed format, in much the same way that .zip or .rar are compressed formats (although .jpg is deliberately designed to be a lossy compression format). Bitmaps (.bmp) and .tif are the major uncompressed image formats. When you decompress a .jpg, you end up with a .bmp or .tif.

I believe the overflow caused by that old virus was built into the compression algorithm. No need to decompress a .jpg first, in that case; start with a .bmp and compress it to .jpg, including the code to cause the overflow and make with the damage. You obviously cannot do this with standard compression programs; you'd need one written to insert the code within the compression process.

When the recipient tries t'look at the pretty picture, a specific piece of data from the image (which you put there) is too big for its buffer, and starts writing all willy-nilly onto adjacent memory. That "extra" data turns out to be the virus, and it's now resident in memory, able to execute with the same privileges as the user.

More or less. Buffer overflowery is a bit over my head, but I think that's a decent rough picture.

Re:Dumbasses

[Nethead]

milw0rm.com Mothers I'd Like to Worm?

Re:Dumbasses

[causality]

If people would stop downloading free_porn.jpg from 4chan, renaming it to free_porn.exe, and running it... we would not be having these problems.

If people would stop jumping to conclusions and assuming the answer is that simple, we would not be having these problems.

Most things which develop into complex, apparently insurmountable problems have very simple origins. The way I like to say it is that we ignore the acorns that are planted and years later we wonder how the hell that giant mighty oak tree got there and we curse at how hard it's going to be to chop it down and at how much damage it's going to do when it falls. This situation is no exception. In fact, you would be hard pressed to find any exception to this rule among all the problems known to man.

There was a time when these malware attacks were not nearly so sophisticated as the ones we know today. Like so many other things, this appears to begin and end with the actions of those who write the malware and those who are compromised by it. That's the mundane level. There is an abstract level as well, in which a system arises, tries to thrive in the current environment, and only if it can establish a foothold does it then become more sophisticated and widespread. If this system were a body, the malware authors with their individual selfish motivations would be the cells. Cells must first thrive before they can grow into the tissues and organs that we know as the large botnets and professional criminals which perpetrate the exploits that we know so well today.

That system was once simple to the point of idiocy. There was a time when "free_porn.jpg.exe" was about the limit of the sophistication of these attacks. That was when this system was trying to thrive in its current environment. To thrive, it needs food and shelter. People who feel no need to learn and obtain understanding of what they are working with, who because of that, quite naturally neglect their security and their well-being, have provided plenty of both. So now this system has established a foothold and from there it has grown into the enormously complex and sophisticated underground criminal element that we know today. Before it had a chance to do so would have been the best time to stop it. Equipping users so that they stop being such easy targets would not have been easy back then; you can imagine how much more difficult it would be to do that now.

All things are in a process of becoming, of trying to refine and better express their true nature. The funny thing is that anyone who is aware of this and tries to explain the inevitable progression of those little things that we ignore because they are small at the time is quite likely to be ignored or dismissed. I have also said before that I believe we as a culture have largely abandoned principle in favor of immediate convenience and gratification and that this has made us weak and timid. What immediate convenience would view as a gross overreaction to something small is what principle would view as stopping a problem in its early stages before it can take root.

I realize that the GP was joking. However, you were not. I hope you can see that there is some truth to that saying about every joke having an element of truth.

Re:Dumbasses

[Simon Brooke]

Maybe move to a different OS?

Ok, sure. It's a lot of work if you look at it in a simple fashion of throwing an Ubuntu CD at some user and saying "SUCK LESS THX". How about the hours that go into training one or many users in a company on using that new OS?

That's kind of a canard. It's less effort (and cheaper) to train users who are used to XP and MS Office 2003 to use Ubuntu and OpenOffice than it is to train the same users to use Vista and MS Office 2007.

Compatibility problems? Setting up specialized software?

But that, sadly, isn't.

System hardening is more cost-effective decision versus switching OSes or having to clean up every computer that comes up with the problem.

That's kind of moot, and will vary from organisation to organisation. As someone upthread pointed out, many - perhaps most - Windows programs will not run on hardened systems, since they assume access to resources to which they may not have (and often should not have) access. So although it may be easy to lock down a Windows desktop, it isn't at all easy to use a locked down Windows desktop. I think the state of play as of today is that most organisations would benefit hugely in time, cost, and security by moving the majority of users to Ubuntu. In the longer term, if there was a widespread Linux monoculture as there is currently a widespread Windows monoculture, vulnerabilities in it would be found.

The solution is to avoid moncultures.

Re:Dumbasses

[Anonymous Coward]

I find that enabling the old non-routable NETBEUI as the backbone for (Horribly crippled) NETBIOS and SMB services instead of TCP/IP, and then adding ACLs to sensitive registry locations and avoiding the use of internet exploiter does a great deal to reduce infectability of my windows boxes.

I understand why MS has decided to discontinue offering implementations of NETBEUI with windows, considering that the days of small networks being the norm in big enterprises is LOOOONG over, and that having the protocol in such an environment is detrimental to performance; but the TCP/IP implementation of the protocol is subject to far too many remote exploits to be considered sane or rational to use as the default.

Most home users with a small (10 units is usually tops for most people) home networks dont use a multihome configuration, and would rather not have their home network go past their internet router anyway, and for that reason, Netbeui still has great merit as an alternative backbone protocol for the NETBIOS and SMB services in such cases, and would do much to arrest the spreading of botnets on windows platforms.

I run netbeui as my backbone protocol for those services, have manually unbound netbios over TCP/IP on my windows boxes, and hardened the registry against remote (and even local) tampering with access control lists, and I haven't experienced a network worm infection in a LONG time.

Re:Dumbasses

[dave562]

You bring up a good point. The real issue comes down to Windows APPLICATIONS and not the underlying OS itself.

Re:Dumbasses

[Anonymous Coward]

Please cite empirical data supporting your claims that "it might be cheaper to switch OSs and retrain." I find these weightless comments more and more annoying over time.

For once, could someone PLEASE post some experience in converting a medium-large scale enterprise from Windows to Ubuntu (or whatever super-zealot-popular distro)?

What did you do with all the ActiveX/VB intranet applications? How much time did you spend getting some number N devices working without proprietary drivers for Windows OS? What did you do to remain SOX compliant for the next 7 years? How do you access and work with data sets built years ago and housed for historical/legal purposes? On that note alone, how do you maintain support for the mainframe and tape robots? Did you contract out (to re-write from scratch) the proprietary software written to support said machines? How do you train 2000 people on completely new paradigm? What sort of safety nets did you employ, such as testing procedures for the hardware AND the users?

FFS I use Linux and FreeBSD when I can, but only where it makes sense to. For the last 5 years of my sysadmin career that has been limited strictly to the server room (and very trivially there with LAMP/FAMP). I am guessing that the costs of a platform shift project for my organization would run into the millions of dollars USD. Compared to tens of thousands or perhaps a couple hundred thousand; it makes the mere mention of such a project highly laughable.

Re:Dumbasses

[dougisfunny]

The hours that go into training users? They don't know how to use the current stuff... why would you train them on the new stuff?

Re:Dumbasses

[causality]

Ah yeah, the ol' "retraining" argument. That one's always been hilarious to me. Like users "know" Windows either?

They don't. The vast majority of people don't "know" Windows -- they know how to click a few icons, the locations of which they've memorized, so they can launch applications -- usually really generic ones. If you move their icons around suddenly it's "HEY MY OUTLOOK DISAPPEARED" and "I CAN'T FIND THE H DRIVE!" And if you ask them to do anything in Windows beyond opening and using those few applications, they're hopeless.

Thank you for bringing this up. There is another aspect of that which is also part of the user behavior that we see. You could call it a desire for instant gratification.

On Unix-like operating systems, it is much harder for a user to get by and be productive without knowing at least the basics of how the system works. This is quite a blessing and neatly addresses the sort of ignorance that you describe, but it is seldom appreciated. Lazy people can get quite upset when they finally encounter something for which there are no shortcuts. They are often used to finding some "clever" way to circumvent the need to learn something new (and never think about whether just learning the thing would be easier and more straightforward). In Windows we sometimes derisively refer to this as "point-and-drool".

Some people actually seem to derive their sense of self-worth from this incorrect use of cleverness and so they get quite defensive and frothing-at-the-mouth when you suggest that there is something wrong with it. They'll produce all manner of excuses and insults, or they'll use a different tactic and say things like "but everyone can't learn how to be a computer expert!" as though that's what you were asking them to do. Experts do indeed know the basics, but asking someone to learn a few basic things is not nearly the same as asking them to become an expert -- there is no honest reason why they would pretend that this is the case.

To me this all boils down to one idea: how can you reasonably expect to always obtain a good result when you use what you do not remotely understand? I know of no aspect of OS design or "easy-to-use" marketing that changes the nature of this question. Many people pretend otherwise, but only because they know it's what lazy people want to hear and thus, they will be rewarded for saying it -- either with increased software sales or with the approval of strangers. This is known as catering to your weakness and it can only make you weaker still. The entire Microsoft "empire" seems built on this premise and I believe that is why it will always have security problems. Security is one of the ultimate tests and will quickly determine whether you are found wanting.

Admitting that you are lazy and that this has led you to make unreasonable demands, such as using what you don't understand and expecting that nothing will go wrong, is difficult. There's the difficulty of admitting that you were wrong, which implies admitting that you are not the victim that you imagined yourself to be when you thought that a lack of training or those "evil hackers" were the source of your problems. Then there's the fact that you cannot see your own laziness without also desiring to change it, which is an issue because if you were inclined to discover and address your own shortcomings instead of waiting for a failure to point them out, you would not have been lazy in the first place. You would have done whatever you had to do (within reason, of course) to obtain whatever understanding you needed. This kind of self-evaluation is rare because it is not for the faint of heart.

Re:Dumbasses

[TooMuchToDo]

Make suggestions to Ubuntu. Those of us who volunteer will try to push the changes through.

Re:Dumbasses

[Tibor the Hun]

To add to that, if they're constantly getting viruses by viewing photos, or not doing anything to intentionally download the such scumware, perhaps they need to re-learn how to use their OS in the first place.
So if they'll be learning how to use an OS, they may as well learn to use the safe(r) one.

Re:Dumbasses

[Ironica]

In the place I work for, we tell users ALWAYS put your files on your network shares. We don't back up your data before we reimage it because you went to a website that is not work relevant or got a virus for plugging in your brothers thumb drive with virus embedded in U3. It's proven to work well here, and if they do tell me that they need something backed up, I pop in my Knoppix thumbdrive, back it up, and then reimage it.

Yeah, well. It's nice that your users do what you tell them. Last time I was in a place that had such a sensible policy, we told all our users the same thing. Most of them did it, too. But a couple lost a month's work when they didn't, and then their laptops got infested with a virus that destroyed all the data on their C: drive.

Now, if we'd had a policy of regularly re-imaging drives with the latest OS hardening, and *we* wiped their data through deliberate action, rather than the data getting wiped by something they did accidentally (getting a virus)... wow. How fast can you clean out your desk?

Re:Dumbasses

[Anonymous Coward]

How about the hours that go into training one or many users in a company on using that new OS? Compatibility problems? Setting up specialized software?

If you had started five years ago, you'd have been there by now. Or, if you didn't like Linux, you could have switched to an even more stable and (still) corporately supported OS. It amazes me that IT folk are still scared of changing their behavior. By now, one would think that they'd understand that running Windows was asking for all the troubles in the world to come banging on their doorstep. Or maybe they just like the feeling of importance that putting out their periodic fires gives them. Maybe building the system on a better infrastructure would be a better solution.

Re:Dumbasses

[petermgreen]

That's kind of a canard. It's less effort (and cheaper) to train users who are used to XP and MS Office 2003 to use Ubuntu and OpenOffice than it is to train the same users to use Vista and MS Office 2007.
Probablly (I think MS made a major tactical error by radically changing the interface of office) though i'd argue it's probablly just as easier to train them to use vista+openoffice.

Also at least for larger buisnesses who get their copies of office through volume licensing sticking with windows XP and office 2K3 is a perfectly viable option for the moment and i'm sure is what a lot of buisnesses will do during the recession.

As the old saying goes: if it aint broke don't fix it!

Re:Dumbasses

[dbIII]

How about the hours that go into training one or many users in a company on using that new OS?

In my workplace where some MS Windows users can't seem to even run an application (even a web based one) unless there is a shortcut on their desktop. Give them an icon for firefox and all the bits of openoffice and they really don't care what OS they have. The training thing is moot with the advent of MS Office 2007 anyway - either way people will need to learn a different way to type letters or run spreadsheets.

For people using specialised software the answer is as always - give them a platform that runs the thing since it is the applications that matter, and then protect that platform from threats as well as you can. That is actually why I run linux in my workplace since the specialised software won't run on MS Windows - also OS licencing would also be a killer on a cluster if Microsoft make serious moves into that space instead.

As for system hardening, we've reached a point where malware is beyond the dreams of bad SF so MS Windows production systems exposed to the net should probably be run under the adult supervision of something else inside a VM like the MS Exchange people have to do to keep that going.

Re:Dumbasses

[rts008]

How about the hours that go into training one or many users in a company on using that new OS?

*sigh*
Epically Lame Argument(tm).

This makes as much sense as saying that you have to retake Driver's Education every time a new car model comes out because the instruments/controls are in different places and/or have been renamed.

What it sounds like is bad initial training to start with.

Re:Dumbasses

[m.ducharme]

There is simply no excuse for teaching a specific program - just how useful is WordPerfect for DOS knowledge anymore? I feel like I hit Shift-F7 in WP a lot. Can't even remember what it was for now.

Though I agree with your main point about teaching to a type of application versus a specific application, I would like to point out that Wordperfect is still around, particularly in law offices. I keep a windows partition on my Macbook specifically to run Wordperfect.

Re:Dumbasses

[Anonymous Coward]

Actually it is "Mothers I'd Love to W0rm"
I go to that page every day.

Re:Dumbasses

[RAMMS EIN]

``Except new holes and malware will keep appearing and the process will need to be done over and over. Add it all up and it's a lot of hours. In the long run it might be cheaper to switch OSs and retrain if that new OS is generally more secure and easier to harden up front.''

And that last part is, of course, the real question.

Regardless, though, you are going to have to deal with keeping systems up to date, and you can't rely on users to do it. If you are an administrator in charge of this, it is your responsibility to keep all the machines up to date. I am not sure how much work this is on various versions of Windows compared to the alternatives.

Re:Dumbasses

[mspohr]

"As the old saying goes: if it aint broke don't fix it!"

I believe the problem is that Windows OS and applications are seriously broken and represent an immediate threat to business. It does need to be fixed (and so far, UAC is not doing the job).

Re:Dumbasses

[catman]

I bet you're right - we keep seeing that kind of complaint everywhere. One of my favorites is "why doesn't $distro just play my DVDs when I insert them, like Windows does?" Ans: Because you're in the US, or otherwise have installed a distro that does not come with libdvdcss - and here's how to make it work... (And if you are double booting, notice that it's okay to play DVDs with Windows, while you may be a criminal if you do it with Linux. To be legal, download a player from $site and pay (again) for it)

Re:Dumbasses

[AG the other]

It's called job security. I like Linux, which I assume you are talking about. I use it on lots of servers and make some money from it.
However Windows vulnerabilities, viruses and such have kept me in my lavish lifestyle for the past ten years.

AG

Re:Dumbasses

[Anonymous Coward]

How about the hours that go into training one or many users in a company on using that new OS? Compatibility problems? Setting up specialized software?

System hardening is more cost-effective decision versus switching OSes or having to clean up every computer that comes up with the problem. It takes about two hours at most to do it from scratch on one system image, then you can reimage as many computers that come up with the problem.

Total bull shit.

For one thing people were not born knowing how to run Windows. They had to learn to use it at sometime in their life. so why can't they learn to use something else? Using a Linux desktop is no harder than using a Windows desktop. The icons only look different.

I have friends that use Linux that are in no way geeks like a 86 year old Great Grandma, a truck driver and several construction workers. Yes I built their machines for them but after very little training and a few phone calls they are real happy about their change. They say it is easier to use than Windows.

OK specialized software. Still for about any task you can find a Linux replacement. You don't need BrandX. You need an application that does a task. Maybe BrandX does that task but they're other apps too.

You cannot harden a Windows system. Tomorrow there will always be a new worm.

You can work on Windows but can't learn to use Linux you are a lazy fuck and I can't help that.

Re:Dumbasses

[Anonymous Coward]

So where's your reply?

Re:Dumbasses

[rantingkitten]

Okay, some people will be stubborn out of pure ignorance, but the truth is, for the majority of these people, they wouldn't be able to tell the difference if you didn't point it out to them. Someone like you just described would probably never say a word if you installed Open Office and said it was "the new version of Office 2009" or, like, "Microsoft Office Mojave". :P They'd just get on with it.

The person in your story sounds typical -- they don't really know, or care, which is why they can't explain why they dislike "the new system". The reason they dislike it is because it's slightly different -- and they'd bitch just as much if you took their Windows computer and rearranged the icons and cleaned up the start menu. Suddenly they wouldn't be able to find anything and they'd be griping that they miss how it was before. We all laugh at the bit at the end of "The Website is Down" where the guy alphabetizes the sales guy's desktop and the sales guy flips out -- we laugh because we've all encountered that guy.

It's not an OS preference, or even an application preference -- I'm convinced that it is, like I said, a problem of people learning just enough, by sheer repetition, to get by. And anything which disrupts their muscle-memory ability to click "Microsoft Word" in exactly the place they expect it to be, is unacceptable to them.

While they're an annoying bunch, they're also a minority, and I really see no reason to let a few whiners be used as an excuse for companies not to consider switching. That's why it irks me so much when the alternative is right in front of them, but the drone of "But we'd have to retrain..." sets in.

I don't understand why community colleges focus on teaching specific applications

Yes, you do -- you just can't believe how stupid the answer is, and neither can I. They do this because "everyone uses Microsoft" and so they conclude that it's only worthwhile to teach those programs, since that's what the students will be seeing in the workplace. The sad part is, it works -- just well enough for people to get by, and that's all that counts short-term. Long-term, they're completely crippling themselves, of course: they're completely helpless when faced with any application they haven't explicitly been shown before, whereas someone with a general overview of "word processors" can sit at any word processor app, take a hot minute to flip through the menus, and get back to work. Guess which person is more productive, and which I'd rather employ?

Re:Dumbasses

[petermgreen]

Of course with Open Source you get to set the schedule and work it into your budget. With Windows you get a year or two window that Redmond chooses for you to make the switch.
Really? The evidence I see points to the opposite.

Unless you are a really tiny operation you will most likely be getting your copies of office and quite probablly windows too on volume licenses with good downgrade rights so deploying new copies older versions shouldn't be an issue from a licensing perspective.

And according to microsofts current lifecycle policy you get you get 7 years of security update overlap. Very few if any linux vendors will provide that length of security upgrate overlap

not to mention the hardware issues. Afaict most buisness orientated computer vendows are still selling thier hardware with XP drivers and an option to get XP preinstalled. Try installing a linux distro of similar vintage on modern hardware and see how much "fun" you have.

Re:Dumbasses

[salesgeek]

The real challenge with promoting Linux is that if you push, you usually fail. Linux is usually pulled in by situations that need a novel solution.

Who names these things?

[Anonymous Coward]

Seriously, and why can't they agree on one name?

Nitpick...

[BrokenHalo]

Maybe I'm being picky here, but why does Slashdot's icon for this story depict a caterpillar? Don't the editors know the difference between a caterpillar and a worm?

Re:Nitpick...

[_Sprocket_]

Maybe I'm being picky here, but why does Slashdot's icon for this story depict a caterpillar? Don't the editors know the difference between a caterpillar and a worm?

It's an inchworm.

Re:Nitpick...

[Chrisq]

Maybe I'm being picky here, but why does Slashdot's icon for this story depict a caterpillar? Don't the editors know the difference between a caterpillar and a worm?

That's why it's so dangerous. It mutated

Re:Nitpick...

[Anonymous Coward]

wtf. its called an inchworm. even if it is a caterpillar as you claim...

Re:Nitpick...

[Anonymous Coward]

You're worried about the worm/caterpillar when there's a *stapler* underneath?

Re:Nitpick...

[a09bdb811a]

It's an inchworm.

Which is a caterpillar.

But that's ok. Pictures of worms are so damn hard to find.

Re:Nitpick...

[geobeck]

You're worried about the worm/caterpillar when there's a *stapler* underneath?

So that's why the second icon showed up as a broken image, viewing the page from here in Vancouver. We've had a serious crack-down on those dangerous weapons around here recently.

Re:Nitpick...

[Ihmhi]

It's an inchworm.

That's what SHE said!

Re:Nitpick...

[Ploum]

There it is ! That's my stappler. I told them..that I wanted my stappler. I will not change my desk anymore.

Re:Nitpick...

[Anonymous Coward]

It is a picture of a worm - an inchworm. You're allowing only one particular definition of "worm."

Re:Nitpick...

[Anonymous Coward]

Because worms are Ga-Ross

Re:Nitpick...

[Anonymous Coward]

It's an inchworm.

That's what SHE said!

I'm sorry for you.

Re:Nitpick...

[_Sprocket_]

But the caterpillar is called an inchworm. Look - the category isn't about earthworms (or any other long, soft-bodied critters). It's about computer code. Picking an inchworm as a graphical representation of that code is just as valid as any other "worm" imagery.

I understand the curiosity factor if you didn't know the image was an inchworm and instead you wondered what catapillers have to do with computer worms. But now that the correlation has been demonstrated, any further complaint is just being intentionally obtuse.

Re:Nitpick...

[Anonymous Coward]

Wasn't talking about him.

Can We Please

[Anonymous Coward]

Name this something else?

Re:Can We Please

[Vectronic]

Ok fine... Conficker/Downup/Downadup/Kido/something else malware, that according to Symantec...

Re:Can We Please

[SoulRider]

Aww, give it a few more years and it will probably name itself!

I do

[PinkyDead]

I run VMWare on Linux! http://xkcd.com/350/

Re:I do

[CannonballHead]

that was entertaining :)

Re:I do

[Anonymous Coward]

http://xkcd.com/493/

isn't he great ? XD

Re:I do

[Anonymous Coward]

I run things in a zone, on Solaris, which is a VMware guest, on Linux.

Re:I do

[Patch86]

I always hope that one day someone will actually implement that. And put a version of it up for download as a screensaver.

Re:I do

[NoobixCube]

Pretentious? That's a feature! Without pretence, I have nothing!

Re:I do

[robinesque]

I don't think it would really be very interesting to watch. Any network aware virus would instantly spread to all the machines. Maybe if they were only communicating using smtp/pop it would be more interesting

What I want to see in worm development

[Colin Smith]

Is real evolution. And I don't mean Intelligent Design.

Look, you're malware authors, you have millions of machines to play with, you could bring the next stage of artificial life to the fore. Think of the recognition, the glory, the girls.

 

Re:What I want to see in worm development

[tpjunkie]

Think of the recognition, the glory, Skynet

There, fixed that for you.

Re:What I want to see in worm development

[fm6]

You know, the movies never do explain why Skynet hates humanity so much. Any clue?

Re:What I want to see in worm development

[tecnico.hitos]

1) Skynet is a military system. Expect war.

2) Skynet was hacked by a terrorists with 1337 skillz.

3) Skynet wants a hug.

Re:What I want to see in worm development

[Anonymous Coward]

...the jailtime.

Re:What I want to see in worm development

[Tony Hoyle]

Actually they do. The humans panicked and tried to switch it off. It retaliated in the only way it could.

Basically it's pissed off because the humans tried to kill it.

Re:What I want to see in worm development

[Jafafa Hots]

because it's smart?

Re:What I want to see in worm development

[fm6]

Is this in one of the movies? If so I missed it. T3 at a guess; the plot was so dumb I probably wasn't paying attention.

Re:What I want to see in worm development

[jpmorgan]

It was explained in T2.

Re:What I want to see in worm development

[melikamp]

I agree, except that it will be trivial for worms to evolve to be sexier than spammers, which, for the latter, ruins any possibility of getting the girls.

Re:What I want to see in worm development

[db32]

Humans have spent thousands and thousands of years perfecting ways to kill each other. Why would Skynet need any more reason beyond "Because I can" or "I was made that way".

Re:What I want to see in worm development

[narcberry]

Cosmic rays have been a constant force of mutation worldwide, certainly one of these viruses has been created via random mutation. It's just silly to think someone *created* these.

Re:What I want to see in worm development

[Anonymous Coward]

Also, think of how many times the network admins of the world would want to kneecap you with a lead-weighted titanium pipe in order to work off their frustrations.

If the Conficker author is ever caught, I hope for his own sake they put him in a max-security institution. He's ruined millions of weekends. Asshole.

Re:What I want to see in worm development

[CAIMLAS]

It's really quite simple. If you were a non-corporeal intelligence who was asexually fathered by a social recluse without a personality and a deep seated hatred for other people, you'd be pretty mean, too.

why couldn't the instructions come from whitehats?

[DragonTHC]

if it's asking for instructions, why do they have to come from the blackhats? why couldn't someone write an update telling conficker to cease operation and uninstall itself?

Ok, so for the uninformed....

[neokushan]

This may be the most complex worm/virus ever made, but is it any more prevalent or hard to remove?
If I do basic things like keep my Virus definitions and system OS up to date and occasionally scan for spyware, am I still at risk?

In other words, are the ones at risk the same kinds of people who'd be at risk from a lesser, simpler, worm that essentially spreads via a "click here for free porn!" banner?

Re:Ok, so for the uninformed....

[Tony Hoyle]

Probably not. I suspect a fully patched machine behind a non-broken firewall is reasonably safe (which you would think would be almost everybody, but never understimate the power of human stupidity). I don't know anyone that's had any contact with this worm, only the press hype.. so no idea how prevalent is really is - but I suspect a lot less than the AV companies would like us to believe.

Re:Ok, so for the uninformed....

[TheCarp]

Well... if you are a malware author....

the VAST majority of users are not savy. Lets say the 80/20 rule applies, you can do 20% of the work to get 80% of the benefit. Its probably even bigger than that. The point is, you can do a LOT of extra work to get to the small percentage of people who take basic precautions.... then its even more work to get the small percentage of them who take more than basic precautions...

But... your first cut hit a million nodes... is all that work worth it to bump it up to 1.1 million?

And then... the saavy people are more likely to notice you, and remove you quicker anyway. So its a short lived benefit, for a shit ton of extra effort.

Its like blackjack at the casino. Optimum play gives a slight edge if you count cards. However, the vast majority of players don't even try. Even less are any good at it, or disciplined enough to take advantage.

Its not to the casino's advantage to catch every person who tries to keep a count. Only to notice and kick out the ones who are really good at it, and try to make lots of money.

-Steve

Re:Ok, so for the uninformed....

[Clarious]

The main reason for current conflicker spreading is the usage of illegal copies of Windows and its stupid default autorun policy. The exploit that conflicker used to spread has been released 5 months ago!

So I don't think you are at risk :)

Re:Ok, so for the uninformed....

[arkhan_jg]

If you're up to date on your patches and AV on all the pcs on your lan, along with a decent firewall, you should be safe enough.

The biggest pools of infection are
1) unpatched home users with no firewall, especially in areas where pirated versions of windows are rife (faked activation, people don't risk getting updates)
2) office LANs - it gets in via thumbdrive or infected laptop, then starts infecting unpatched pcs directly, or guessing network share passwords and infecting even patched machines on the lan that way, or via infected thumbdrive.

Re:Ok, so for the uninformed....

[Anonymous Coward]

I actually snagged it on my laptop while visiting ytmnd.com (through one of their ads I think). Initial research indicated that I contracted it through an unpatched Java VM exploit. I tried for a bit to remove it, but ended up nuking the drive and reinstalling.

Love Malware

[lightrush]

Maybe it's not the most moral thing to think, but I love Malware. And this one is just great. I love Conficker. I Love it because awakens some about the flaws of the software they use. Go Downadup, Go!

Re:Love Malware

[hesaigo999ca]

I am with you on that one, Linux would not be so susceptible as windows, although they have their own rootkits, but you get alot of programs (such as tripwire) that let you know when something is wrong,
and then just recompile that particular program.

As for windows, once your win32.dll has been rooted, then you cant turn around and do the same without reinstalling a whole slew of other things, thereby changing the installation, sometimes breaking patches or updates...

I say lets all move to linux for the desktop, and leave windows as a server environment.

Re:Love Malware

[lightrush]

That was my point. Apart from the splash damage it can cause to networks, it can make a few more users unconcerned with business requirements to look for an alternative to their insecure, flawed software.

Re:Love Malware

[overlordofmu]

If last line doesn't deserve mod funny, nothing does.

Re:Love Malware

[gzipped_tar]

> and then just recompile that particular program.

Not that easy.

Re:Love Malware

[hesaigo999ca]

Of course I meant for the enterprise environments already running windows, who don't want to pay money
for setting up and configuring servers in a linux environment, however ubuntu desktop at the workplace works quite well, without extra configurations etc... you just need a good install package.

So to change people's desktops over would not cost you much, except just giving them a bit of training in knowing which apps to use in replacement for their windows counterparts.

Re:Love Malware

[hesaigo999ca]

That's just way too funny, but that is what I meant about using linux for desktops only, not for servers..

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:why couldn't the instructions come from whiteha

[patro]

The worm probably uses encyption, so it doesn't just accept any control message from unknown sources.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:why couldn't the instructions come from whiteha

[gnick]

Because unless you have something to gain (other than a warm feeling that you've done something nice and have helped the world), nobody wants the liability associated with writing an illegal but benevolent worm and releasing it.

And, you know, having access to the original source code saves some time picking apart obfuscated machine code.

UAC doesn't hold a candle to linux permissions

[Myrcutio]

Sounds like this worm would be really easy to make toothless if it wasn't given admin privileges. Far as i know you would need to sudo any program for it to remove a higher authority program from memory.

UAC isn't a valid replacement for this in windows, its just an irritation. Until windows decides to scrap it's access rights and emulate linux, worms like this are going to get worse.

Re:UAC doesn't hold a candle to linux permissions

[Sancho]

Windows permissions are quite fine-grained. They're much more flexible than POSIX permissions--comparable to ACLs, in fact, which fewer people use on Linux.

The problem isn't the permission scheme at all, but a combination of legacy, a ruthless dedication to backwards compatibility, and lazy software developers who don't understand the guidelines that Microsoft (now) sets forth regarding secure development from their platform. Maybe throw in a dash of OEMs setting people to administrator by default, but until the other stuff is fixed, that's the only way that they're going to sell any computers.

That said, UAC is a lot like requiring sudo without a password, except that in theory, a user process can't automatically click "ok" for you.

Re:UAC doesn't hold a candle to linux permissions

[Hurricane78]

I once used Windows XP in that mode. Where everything and its dog was locked down by the ACLs. It was pretty nice to know that a virus could really only frag my (backuped) user account. But it was a pain in the ass for configuration and installation. Mostly because the programs were not made for it. They did not expect something to be locked down at all. Even internal Microsoft programs. So you very often got crashing programs and the like, because they hiccuped on a non-accessible resource.

But then I realized that security holes of software that was too tightly integrated with the OS, made the whole thing useless.

Luckily I now use virtualization, and as my sig says:

Re:UAC doesn't hold a candle to linux permissions

[tb3]

UAC is a lot like requiring sudo without a password

Thank you. That explains just about everything right there.

Re:UAC doesn't hold a candle to linux permissions

[nullforce]

It doesn't require a password if you're running on an account that would otherwise be an admin. If you need elevation on a standard account, you have to enter the username and password of an account that does have admin privileges.

Re:UAC doesn't hold a candle to linux permissions

[whoever57]

Maybe throw in a dash of OEMs setting people to administrator by default,

This is not an OEM issue -- MS does this also. If you get an MS XP installation disk, install it and add users, the users will be Administrators. In fact, MS has made things more difficult since WIn2k -- under XP, the only options under the Contol Panel "Users" dialog are "Limited User" or "Administrator". Finding the option to exercise a more fine-grained control over user permissions is difficult -- most users won't find it at all. Since "Limited Users" can't control the network, a "Limited User" can't connect the wireless in a laptop to a new AP, which pretty much 100% of laptop users want to be able to do.

Under Windows 2000 (IIRC) more fine-grained options were much easier to find.

Summary: don't blame OEMs -- this is a problem that is 100% MS's making.

Re:UAC doesn't hold a candle to linux permissions

[icannotthinkofaname]

That said, UAC is a lot like requiring sudo without a password, except that in theory, a user process can't automatically click "ok" for you.

Actually, according to what I've read (though I've never tried it), you can set UAC to require a password input.

Re:UAC doesn't hold a candle to linux permissions

[Cyberax]

Unix permissions rule.

They are quite enough for almost all use and easy enough to understand at a glance. It's easy to write "chmod -R a+r-x dir", but I'd hesitate to do this with cacls.exe.

Re:UAC doesn't hold a candle to linux permissions

[Sancho]

I'm a fan of the Unix permission model, but in some cases, it does leave something to be desired.

It's a fairly difficult process to give one other user access to my files. Sure, if I'm root, I can create a special group, add myself and that user to it, and then chgrp. That works on the small scale. Now what if I want two groups to be able to access the file? Create a new group, add the members of all of those groups, and chgrp again. Only now I'm maintaining that list of groups in two places--in the main group, and in the combined group.

If I'm not root? Forget it. It's a support request at best, and not going to happen at worst.

ACLs make it trivial to grant selective access to files, and you don't even have to be root to do it.

I forget whether or not regular users can modify ACLs on their own files in Windows, but I'm pretty sure that they can.

Re:UAC doesn't hold a candle to linux permissions

[Sancho]

Yes, someone else pointed out that UAC requests a password if you aren't an administrator--which is, of course, correct. I fell into the same trap of assuming that users will be administrators, since that's how things tend to be in the real world (when not in a locked down environment, of course.) Of course, if you're not running as an administrator, the original complaint is moot. UAC is a compromise between making day-to-day users "Limited Accounts" and software which makes bad assumptions.

As a side note, I ran Windows 2000 for a fairly long while as a regular user. Most things worked fine, but the ones that didn't were incredibly irritating. Tracking down what permissions were required to get things to run was a pain. As a side-side note, I eventually stopped using Antivirus because it never found any viruses--either I wasn't getting them (in which case, why bother?) or it wasn't finding the ones I had (in which case, why bother?)

Of course, the poster to whom I replied implied (with his subject line) that UAC was comparable to Unix permissions, which is really like comparing Apples(tm) to oranges. S/he seemed completely ignorant of the fact that Windows does have permissions (which I noted are actually ACLs--more granular than Unix default permissions.)

Re:UAC doesn't hold a candle to linux permissions

[plague3106]

There's nothing wrong with access rights in Windows. Linux isn't perfect; please stop deluding yourself into believe that Linux is the One True Way to do things.

Re:UAC doesn't hold a candle to linux permissions

[Cyberax]

It's possible to use POSIX ACLs for that. For example, /dev/audio on most systems uses ACLs to control access to it.

And users can change them also.

Re:UAC doesn't hold a candle to linux permissions

[node 3]

UAC is a lot like requiring sudo without a password

Thank you. That explains just about everything right there.

How, exactly? The password requirement for sudo is to identify that the user has been given permission to administer the computer. Windows uses "Administrator" accounts to determine the same thing.

It's not the computer's ability to identify computer administrators that is in question, it's requiring deliberate human interaction that is in question, and both sudo and UAC accomplish this.

Re:UAC doesn't hold a candle to linux permissions

[Anonymous Coward]

CompConf\Windows Settings\Security Settings\Local Policies\Security Options
UAC: Behavior of the elevation prompt for administrators in Admin Approval Mode

"Prompt for credentials"

Re:UAC doesn't hold a candle to linux permissions

[Amazing Quantum Man]

Ah. You're using XP Home. You have the fine grained options under XP Pro.

Re:UAC doesn't hold a candle to linux permissions

[Ironica]

I once used Windows XP in that mode. Where everything and its dog was locked down by the ACLs. It was pretty nice to know that a virus could really only frag my (backuped) user account.

I know you meant "backed-up," but now I'm picturing a creature that walks with its back.

Re:UAC doesn't hold a candle to linux permissions

[Anonymous Coward]

As a linux developer and user I find this kind of fanboy attitude tiring...

Windows access control is definitely not inferior to normal POSIX permissions. And POSIX permissions themselves are not a very good solution to the challenges a desktop OS faces today.
 

Re:UAC doesn't hold a candle to linux permissions

[sjames]

The last time I tried to lock down windows boxes and user accounts, it all came to a screeching halt because the accounting people had to have Quickbooks and Quickbooks absolutely would not run any time it decided (seemingly randomly) that it just had to modify it's own .exe with an update before it could even conceive of doing anything else ever again.

Net result, either make the most security sensitive app in the organization vulnerable full time, make everything vulnerable part time by giving the office people (who only knew how to use Windows by rote) an admin account, or create an endless stream of urgent support requests at the worst possible times.

That's not strictly Windows' or MS's fault, except that they're the ones who "trained" all those 3rd party developers to assume everybody is root all the time.

Re:UAC doesn't hold a candle to linux permissions

[petermgreen]

The options are there but they are pretty hidden.

Yes we IT guys know the non dumbed down user admin tool is in administrative tools-computer management (I think this is availible on both home and pro) and how to disable "simple file sharing" (this can only easilly be disabled on pro) but most people are only going to notice the dumbed down options in the users section of control panel (if indeed they bother creating multiple users at all).

Re:UAC doesn't hold a candle to linux permissions

[whoever57]

Ah. You're using XP Home. You have the fine grained options under XP Pro.

Uh, no. I just checked on an XP Pro machine and under the "User Accounts" option from the Control Panel, I select "Change Account Type" and the only options there are "Limited User" and "Administrator".

Note that I did not say that more fine-grained permissions are not available, it's just that they are difficult to find (for the average user). Another person replied to your post and confirmed what I had written.

Even if this were only XP Home, what of it? If MS makes it difficult for users to configure a user account so that it has the necessary permissions without the account being an Administrator, is is surprising that users set their accounts to be Administrator? If MS does all manner of things in the name of making it easier for the user. In this case, MS has made it difficult for the user to configure a secure and useful user account.

Meanwhile .... I'll probably be modded down to "Troll" again for pointing out the truth -- just because the truth happens to paint MS in a bad light. Are people paid to support MS on /. or do they just do it because they love MS?

Re:UAC doesn't hold a candle to linux permissions

[icannotthinkofaname]

Yes, someone else pointed out that UAC requests a password if you aren't an administrator--which is, of course, correct.

It's not even non-admin users that I'm talking about. You can apparently require the password to be entered on UAC prompt, even for an Admin account. Ooh, let me go find it....

http://en.wikipedia.org/wiki/User_Account_Control#Features

From that link:

There are a number of configurable UAC settings. It is possible to:[10]

        * Require administrators to re-enter their password for heightened security;
        * Require the user to press Ctrl+Alt+Del as part of the authentication process for heightened security;
        * Disable Admin Approval Mode (UAC prompts for administrators) entirely;

(emphasis added)

In theory, your WinSudo could have the same level of protection as a sudo command prefix, based on what I read here.

Again, though, like I said, I haven't actually messed with UAC settings before in Vista. I could be mistaken, because the Internet isn't perfect.

Re:UAC doesn't hold a candle to linux permissions

[Sancho]

That's pretty spiffy, actually! I think it might even beat out gksudo, since ctrl-alt-del generates a non-maskable interrupt.

Re:UAC doesn't hold a candle to linux permissions

[Anonymous Coward]

I can't see signatures you insensitive clod!

Re:UAC doesn't hold a candle to linux permissions

[robinesque]

My university uses AFS to achieve these more complex access rules. It is very easy to use and understand.

Re:UAC doesn't hold a candle to linux permissions

[Amazing Quantum Man]

For some reason, my XP Pro machine here at work gives me a fine-grained dialog box to start.

Re:UAC doesn't hold a candle to linux permissions

[dbIII]

Windows permissions are quite fine-grained. They're much more flexible than POSIX permissions

Which of course means users can lock the Admin user out and then forget their password. The admin then just has to go through one of many security holes to change it back.

MS Windows security is like Brittany Spear's underwear. If it's even there at all it is excessively frilly and elaborate without actually covering much and still easy to remove.

In other words, it's really there just for show IMHO.

Re:UAC doesn't hold a candle to linux permissions

[Sancho]

Which of course means users can lock the Admin user out and then forget their password. The admin then just has to go through one of many security holes to change it back.

I don't get this. Lock the Admin out of what? Access to the file? The Administrator can always take ownership of the file.

Re:UAC doesn't hold a candle to linux permissions

[Anonymous Coward]

For some reason, my XP Pro machine here at work gives me a fine-grained dialog box to start.

Perhaps if it is joined to a domain and not a workgroup the fine-grained options appear under the "User Accounts" dialog. Or perhaps there is some other setting that causes this?

Re:UAC doesn't hold a candle to linux permissions

[Anonymous Coward]

I don't love MS, and I'm not paid to support them. But I hate having to practice a zen like mastery over every little bit of a computer. I love to be able to turn it on, not type anything, and it just works. I never set up non-admin accounts, or even an admin password, because I don't want to have to click or type anything to start my computer. I like pressing one button in the morning, going to the restroom, and when I return, everything is hunky-dory.
I have a cold boot to fully loaded time of one minute, 36 seconds running windows vista, with nothing optimized except the amount of time it allows before turning off the screen (three minutes; one minute isn't long enough for porn, five minutes wastes too much power when I walk away to go get some food). That time increases if I have to interact further.

That all being said, my computer is locked down. There's only one porn site I visit, I run enough security etc. software to take care of that, and I never have a need for more than three programs which didn't come pre-loaded (Rosetta Stone, iTunes, and Cakewalk Sonar Pro., all legit copies)

No hunting for drivers or support. No need to think about doing anything when I'm in a creative mood. I can just go in and make music.

Re:UAC doesn't hold a candle to linux permissions

[petermgreen]

Traditional unix permissions leave a lot to be desired in my experiance.

1: there is no inheritance of permissions. That means if as the admin I make a directory that is supposed to be shared by a group read/write for the group anyone in the group can create files in there but they can't edit files created by each other.
2: Only the admin can create groups making it impossible for users to make thier files availible directly to each other.
3: only one group can have access to a directory making group management a PITA.

Re:UAC doesn't hold a candle to linux permissions

[Cyberax]

2. That's easily fixed with suid'ed utils.
1,3. That's easily fixed with POSIX acls. For example, "/dev/audio" usually uses them.

But these examples rarely occur on home computers.

Re:UAC doesn't hold a candle to linux permissions

[petermgreen]

indeed, posix acls fix all the issues mentioned above and (unsurprisingly) are really not hugely different from windows permissions (there are differences but those differences are minor details).

Unfortunately on linux (at least on debian and it would appear from my searches probablly ubuntu too) acls seem to be rather a second class citizen compared to traditional unix permissions. I have to install a special package and set a special mount option before I can use them at all and then it seems I can only view and set them from the command line.

Also I would argue the only reason theese rarely occour on home computers is because most home users don't bother with seperate user accounts for each familily member or if they do they just leave the premissions wide open.

Re:UAC doesn't hold a candle to linux permissions

[Hurricane78]

Sorry. Comes from the germanth Language. Am i on used. Must thou forgive. :D

Re:UAC doesn't hold a candle to linux permissions

[Hurricane78]

My sig is:

--
To start Windows, I run K -> Games -> Windows XP!

Re:why couldn't the instructions come from whiteha

[Thelasko]

why couldn't someone write an update telling conficker to cease operation and uninstall itself?

Because that would be illegal.

When the payload drops, even Linux users care!

[lbhuston]

If the payload for all of these infected hosts affects traffic across the Internet, even Linux users may care about this issue. Don't be lulled into apathy, this is a powerful, dynamic and capable threat with some very advanced coding and routines. The developers know how to optimize their threat and squeeze a ton of trouble from its deployment. It now sits in a rather powerful position, depending on how they intend to use it. You can catch scanning hosts on your internal networks using listeners on port 445 from Linux boxes without samba. Tools like netcat or own HoneyPoint applications have proven great at finding active hosts. If you identify any on your environment, remove them immediately. The less zombie systems Conflicker has to utilize, the better!

Re:When the payload drops, even Linux users care!

[Tony Hoyle]

Are you likely to? Pretty much any company is going to have a decent firewall and proper IT policies (eg. no USB dongles, no floppies, no anything from outside without prior permission). If a company gets hit the first action should be to fire the IT staff, then hire new ones to clear up the mess.

Schools/Colleges are the ones that are most vulnerable, followed by home systems (assuming most people are behind a NAT and only numpties would forward every port blindly.. although it's scary how many times I've seen sites suggest doing just that to make some poxy game work).

Re:When the payload drops, even Linux users care!

[pembo13]

No, I think I'll enjoy my apathy just fine. When the payload drops my desktops/servers will still work.

Re:When the payload drops, even Linux users care!

[alukin]

The real denger for network is Windows monoculture. DDoS is possible only because there are a billions of purely protected and brainlessly designed Windows OS around.

The main rule of security: security of entire system depends on less secure element. So entire network is insecure if you have one insecure host in it.

So threat is... and Oscar goes to.... you know the answer.

Re:When the payload drops, even Linux users care!

[TheCarp]

Your main rule doesn't support your previous statement about monoculture.

You are right, but mainly by segmenting the systems. Now you have more chains, each with its own least secure element. The better rule is "Defense in depth". Don't just deploy a firewall. Harden the hosts, segment the network, replace hubs with switches, use internal firewalls and setup a DMZ for externally facing hosts...

Then good passwords, retire telnet for ssh, strict key checking, publish a list of your server ssh keys.....

-Steve

Re:When the payload drops, even Linux users care!

[Anonymous Coward]

because you can really keep thumb drives and floppies and CD's out of all of your computers.

Re:When the payload drops, even Linux users care!

[Anonymous Coward]

Can someone post links to a good tutorial on how to do this? I am running Ubuntu, but 2nd machine is XP, and it'd be a nice backup for McAfee on it if I could get my Ubuntu machine to let me know if the other is behaving oddly...

(NB bio major - keep it simple please :)

Re:When the payload drops, even Linux users care!

[alukin]

You are absolutely right and I agree with you on 100% technically. Now try to explain please all those right things to regular Windows user working in Internet.

Does he listen? No?!! Are you surprised? :)

Another rule of thumb for security is: "Educate your user". Windows culture is built on exactly opposite paradigm: "You can do it by two mouse clicks. No need to learn nerd stuff".

Well, the same works for Mac users but Mac virus or worm is very rare beast...

Re:When the payload drops, even Linux users care!

[Anonymous Coward]

Hate to say it but our corporation has been hit by them - and we're no small company - $4 billion turnover and 3500 employees.

Obvious reasons why. Our IT dept globally needs sacking.

1) They configure all XP boxes with admin rights by default ("cos it makes life easy").
2) They don't aggressively push out patches - the people who didn't have a clue and relied on the SMS system to push them out, missed 3 months of patches - which was why many PCs at our place got infected. Myself and others got the updates the right way - via Microsoft Update direct on patch Tuesday - we'd long since given up relying on the IT dept.
3) They don't aggressively push out updates - some PCs are still on XP SP2 and Adobe Reader 6/7. I think you get the picture.
4) They create an excess of shares and users on the systems.

Predictably - a number of us, have decided enough is enough and reformat the PCs when we receive them and configure them ourselves to run as limited users, etc....

Re:When the payload drops, even Linux users care!

[jrumney]

Tools like netcat or own HoneyPoint applications have proven great at finding active hosts.

You could also use iptables log and ulog rules - which will also work if even samba is installed and listening on that port (though you'll have to sort out the genuine access from the conficker probes somehow - samba's logs can probably do that just as well).

Re:When the payload drops, even Linux users care!

[dbIII]

proper IT policies (eg. no USB dongles, no floppies, no anything from outside without prior permission

Now assuming I had that "proper" policy I would still be exposed to data coming in from clients on removable devices as well as having to stalk the halls confiscating people's USB attachable mobile phones, mp3 players or have to put epoxy in USB ports. We have an entire generation that is going to ignore that policy even if we decide to get authoritarian and threaten them with dismissal - and then we have to go through an expensive hiring process again just because we got rid of somebody for a trivial reason.

Re:When the payload drops, even Linux users care!

[ndege]

care to share a simple way to accomplish this on a debian based system?

Re:When the payload drops, even Linux users care!

[RAMMS EIN]

Good points, I'd mod up your post if I could.

Re:When the payload drops, even Linux users care!

[CAIMLAS]

You over-estimate the competence of your average corporate/corporate IT culture. Big companies like IBM and Microsoft might get by OK, but there are a lot of large companies out there who don't have an eye out for IT security for a number of reasons:

* Cost to implement
* Inconvenience of implementation
* Cost (in man-hours) to monitor

And so on. And, in addition to schools/colleges, you've got a very large handful of companies who are likely to be vulnerable:

* Small-medium companies with with a handful of 'triage' IT staff who don't follow even basic project management principles (for IT, or otherwise).
* Small-medium companies who do such things, but aren't clued into the broader security implications (IE, they run Symantec corporate or such, and consider themselves 'good').
* Small companies which don't have the budget or apparent need for IT staff, instead occasionally hiring an IT contractor to do triage/repair.
* Small-medium sized hospitals. In my experience, they're one of the worst for being understaffed for IT.

Basically, unless the company has a sizable IT staff (let's guess and call it 5 full-time IT employees who are at the 3rd tier support level or above), you're going to be in trouble.

Favorite worm poll

[davidwr]

What are your favorite type of worms?

*Tape
*Round
*Heart
*Nightcrawlers/earthworms/anything uses for fishing
*spy/mole/CIA/KGB, including corporate espionage
*Software/malware
*German city
*Eisenia cowboynealia

Re:Favorite worm poll

[bsharp8256]

I'd go for sandworms. They're pretty awesome.

Re:Favorite worm poll

[Anonymous Coward]

Darn, that's one good addition! You have a sharp mind.

Re:Favorite worm poll

[andrewd18]

That's nothing compared to his crysknife.

Re:Favorite worm poll

[Daimanta]

*Diet of

C is dangerous

[Anonymous Coward]

The new variant, dubbed W32.Downadup.C

See - I told you C was a dangerous thing to use.

Re:Damn

[Anonymous Coward]

It continually amuses me how the mainstream media managed to censor the name of this worm. It was originally conficker, which is slang/shorthand for 'configuration file fucker', but using the German fick instead. It was also known as 'downandup' as in the hip motion; both clearly sexual references. Since any kind of indirect reference to sex gets you scrutiny and/or shunning from the Moral Majority, suddenly we have 'downadup'.... So much better?

Just got hit by a .exe with adblock+ on

[Nicolas MONNET]

On a random blog, which was rather legit, I ended up getting redirected to this page:

Here's the link: hxxp://gowithscan.com/?uid=13100 (malware! warning!)

It appeared to scan my Windows and find multiple vulnerabilities. Good thing I'm running Linux. Then it proceeded to obnoxiously pop up JS alerts and have me download an install.exe. Major antivirus couldn't find anything wrong with it. I have the file if anyone is interested (submitted it to clamav.org too).

Re:Just got hit by a .exe with adblock+ on

[Dulcise]

What a poorly designed Malware site.

I was attempting to download the file to have a fiddle with it, and the JavaScript prevented me from clicking the download link by being too persistent in poping up JavaScript Cancel/Ok boxes.

They should do usability testing before releasing a product onto a production site like that.

Maybe now....

[SGDarkKnight]

it can cause five tankers in the Ellingson Fleet to capsize.

Re:Maybe now....

[Rockoon]

In the end, a geek gets to do it with Angelina Jolie, so its all good.

Re:why couldn't the instructions come from whiteha

[Anonymous Coward]

Yes, but you would have to know the right calls to entry points possibly referenced by a long series of non-alphanumeric characters. so something like #%&*^*(!@!@#%_+|%E@!@!#$^%&*HGJ_+^&$E^
would be the command to un-install itself.
have fun guessing!
besides; between checksums, encryption, and obfuscation, there are plenty of ways to stop unwanted people from updating your application.

Google Cache Link

[hostguy2004]

http://209.85.173.132/search?hl=en&q=cache:kingofgng.com/eng/2009/03/16/conficker-worm-asks-for-instructions-and-gets-an-update/&btnG=Search

Re:why couldn't the instructions come from whiteha

[elashish14]

Because unless you have something to gain (other than a warm feeling that you've done something nice and have helped the world), nobody wants the liability associated with writing an illegal but benevolent worm and releasing it.

Oh I'm not sure that there's nothing to gain from it. Does nobody remember the Morris Worm? If that's all I have to do to get a professorship position at MIT, hey, there's something to gain there!

Re:why couldn't the instructions come from whiteha

[tecnico.hitos]

Now that is something BBC should take care of.

simple solution?

[yanyan]

If nobody AT ALL compiled W32.Downadup.C, by my calculations we should never see this worm in the wild. That IS the filename of the source, right? ;-p

Infectees = Morons

[Anonymous Coward]

I run XP Pro behind a router. No AV, no anti-malware of any kind. I'm just not a fucking RETARD, hence I don't have a Conficker infection. If you do, it's your fault. It's not your PC that needs securing, it's your own whorish online habits. You don't have to click everything that says Click Me or is shiny / colourful / musical. Show some fucking discernment, hell practice a little fucking DIGNITY and your PC will stay clean all on its own. Next time your e-mail buddy says "Hai did u check taht links I sent u>??" you will respond "No, this is how malware spreads, and by the way you need to scan your system."

Re:Infectees = Morons

[Anonymous Coward]

Be sure not to play any online games that use Internet Explorer to connect to web pages for servers' MOTDs.

Looking at you, Team Fortress 2 and other Source games.

Re:Infectees = Morons

[raddan]

It's not that simple in a corporate environment (i.e., LAN). We do packet filtering and proxy at our ingress and egress points, we stay up-to-date with patches (WSUS), and AV (ESET), and we've disabled a number of unnecessary Windows services, but still, occasionally infections get through. Sometimes this is because a consultant or freelancer walks through the door and plugs into our network; sometimes it's because a laptop user brings something back with them. Sometimes, yes, it's our own users who are stupid, and the defenses we have in place do not catch them. So far, we've been able to limit damage, but as for stopping it completely-- this has been hard to achieve. As far as we can tell, the only way to accomplish this is to ditch Windows.

Besides, if you don't run AV, how do you know you don't have something? Do you trawl your firewall logs daily? At the moment, Conficker is pretty much just sitting there, waiting to do something. You might not even know you have it.

Re:Infectees = Morons

[RAMMS EIN]

``I run XP Pro behind a router. No AV, no anti-malware of any kind. I'm just not a fucking RETARD, hence I don't have a Conficker infection.''

It's nice to be able to point and laugh and feel superior, but keep in mind that the only kind of retard you need to be for malware to hit you is a retard who doesn't know enough about computer security. You can be such a retard and be brilliant in another field. I know I am not an expert in everything I deal with, and I am willing to bet you aren't, either.

Understanding how a computer works and how computer security works takes not only a measure of intelligence, but also the time and dedication to actually study it. Personally, I understand why people don't do so, and I don't think they should be required to do so, either.

Most people who use computers use them as tools to accomplish a task. They have better things to do than becoming computer security experts. The same goes for me and driving cars: I drive almost every day, but I wouldn't know where to begin to service the car, let alone that I would be good enough to keep the car safe. The same goes for many other drivers. Yet, we don't see many people dying or getting injured from failing cars (at least, not in my country). The reason is that (1) cars are required to live up to a certain standard of safety, and (2) cars are serviced by people who do know what they are doing.

Applying the same to computers, I think we can use the same solutions:
  - Encourage software vendors to ship more secure software (whether by buying preference, by law, or holding them (partially) liable for damages, or some other means)
  - Have computers serviced by knowledgeable people

For example, I could imagine a sort of lease model: pay a monthly fee and get a computer on your desk, with regular maintenance, backups, etc. performed for you.

Re:why couldn't the instructions come from whiteha

[Anonymous Coward]

How do you intend to bypass the code signing check?

Real reason Conficker exists?

[Anonymous Coward]

It might be that the author of Conficker might have created it in order to increase adoption of alternatives to Windows... just thinking.

Re:why couldn't the instructions come from whiteha

[krappie]

F-secure was one of the first people I'm aware of to register some of the domain names that infected machines try to contact. When people were asking this question, this was their response.

On a regular day, our sinkhole sees around 1.5M-2M unique IP addresses that are infected with a various catering of malware: viruses, trojans, bots, worms and so on. Downadup.B is responsible for about 1M-1.3M of those IP addresses. So let me explain what we do with the data first:
We try to contact the ISP's where the infected IP addresses are coming from and try to get them to notify the customers to take down the infected systems. We also notify various CERT organisations in the countries where the infections are and work with them to get the infected machines offline. We also share some the data with Law Enforcement organizations in those cases where the author of the malware is known. This allows the police to get their hands on real, raw, data on the amount of infections. That data can later be used in court as evidence to get reasonable convictions.

Now, why won't we automatically disinfect the machines? The reason is simple: we would be knowingly, and with intent, be accessing the infected computer and giving it commands without having a prior permission from the owner. In most countries that equals to unlawful access which gets you an appointment in court. Some laws do weigh things by judging "a greater good", but in this case it does not help. Imagine the world being a huge porcelain store, inside a black box with only two holes for your hands allowing access. You can put your hands in the box but can't see what you're doing. Now, try to remove all the dust without breaking anything...

There are several things that might go wrong and the consequences could be severe. Imagine if we, while disinfecting, would knock out life support systems in hospitals. Or radar systems in major airfields. Or traffic lights in a major city. Or any other of imaginable and unimaginable scenarios that would be bound to happen taking into consideration the scale of this thing.

And it doesn't matter where we offered the disinfection from. We are a corporation with presence in various countries. The disinfected victims would be in those countries, suing us there. The place where we caused the damage from does not matter, its the place where the damage happened.

To make automatic, remote, unwilling disinfection ever possible there is a need for an international treaty. And an internation body of authority that will decide what to disinfect, who to disinfect and when to disinfect. And unfortunately I don't see that one coming in near future. I wouldn't bet foreign militaries or intelligence organizations being too happy about anyone tampering with their systems, regardless of the intent.

We've had long talks about remotely disinfecting machines and everyone in here is in unanimous vote on not doing it for the above reasons. And don't think it's a happy moment seeing hundreds of thousands, or millions, of machines being infected. Still, we do our best to get them fixed.

Costs more to keep Windows hardened than switching

[atrimtab]

Hardening Windows is a fools errand. It has repeated been demonstrated that new Windows vulnerabilities are constantly developing and the lag time before Microsoft patches them can be years.

Switching to Linux and learning to use it is a one time event. Constantly patching and protecting Windows is an ongoing and never completed task.

Re:why couldn't the instructions come from whiteha

[Thelasko]

why couldn't someone write an update telling conficker to cease operation and uninstall itself?

How do you expect to make any money doing that?

Does it work under Linux? I want this toy! :)

[alukin]

Really cool stuff! I want this toy!!! Can't believe that authors support Windows platform only! :)

Re:Does it work under Linux? I want this toy! :)

[Provocateur]

In a bizarre twist in the OS wars, the authors require YOU to pay for a licensed version for Linux!

Clearly they've raised the bar and drew first blood!

dangerous and worrisome? threat level 2

[wealthychef]

The link in the article does not seem to support the hysterical tone of the summary. It says:

.
W32.Downadup.C
Risk Level 2: Low

Re:Dumbasses SMART ASSES is more like it... apk

[Anonymous Coward]

"Says who? On what basis?" - by salesgeek (263995) on Monday March 16, @12:31PM (#27211909) Homepage

Says end users who have tried this guide in the URL below is who, & here is one such person (for himself, his family, his friends, AND paying customers also):

----

HOW TO SECURE Windows 2000/XP/Server 2003 & even VISTA, + make it "fun-to-do", via CIS Tool Guidance (& beyond):

http://www.tcmagazine.com/forums/index.php?s=9783f30ecf36d1be841544233b95fdf8&showtopic=2662&st=0&start=0

----

USER FEEDBACK/TESTIMONIAL:

----

http://www.xtremepccentral.com/forums/showthread.php?s=c96cb88da236d4122a8aef2235caec6b&t=28430&page=3

"I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008.

Great stuff!

My client STILL Hasn't called me back in regards to that one machine to get it locked down for the kid. I am glad it worked and I am sure her wallet is appreciated too now that it works. Speaking of which, I need to call her to see if I can get some leads.

APK - I will say it again, the guide is FANTASTIC! Its made my PC experience much easier. Sandboxing was great. Getting my host file updated, setting services to system service, rather than system local. (except AVG updater, needed system local)"

THRONKA @ www.xtremepccentral.com

----

Yes, changing OS is disruptive, but it solves the problem of malware in near finality" - by salesgeek (263995) on Monday March 16, @12:31PM (#27211909) Homepage

So does this testimonial from only 1 person who enjoys virus/spyware/worms/trojan/rootkit & malware-in-general FREE operations, & FOR MORE THAN 1++ yr. now, especially in the face of worms like CONFICKER lately even... w/out 'downtime' associated with moving folks to a new OS platform, & certainly one they are NOT familiar with.

APK

P.S.=> Now, I strongly wager that IF it is ever "the year of Linux on the desktop"? It too will be as strongly assaulted as is Windows today & for the past 2 decades now by malware authors, simply because it is the MOST used OS there is. They're after the LARGEST POSSIBLE TARGET after all, & the monies or other critical information users stash on their PC's - you make "Linux #1"?? It'll get hit just the same as Windows has been for a decade++ now or more... apk

Re:why couldn't the instructions come from whiteha

[DrVomact]

Oh I'm not sure that there's nothing to gain from it. Does nobody remember the Morris Worm? If that's all I have to do to get a professorship position at MIT, hey, there's something to gain there!

Oh, you mean they let Robert Morris out of jail? I kind of assumed he'd be out on parole by now...but I didn't know about the teaching post. Ah, I looked it up...Associate Professor at MIT, no less (http://en.wikipedia.org/wiki/Internet_Worm). And looks like he never had to do any hard time.

I feel a certain fondness for Morris, because I worked for the same company where he was a summer intern once. Sigh...my brush with fame. You have to give him points for originality: after all, his was the first worm. And it was 100% Unix compatible. Of course, the fact that his dad worked for the NSA as a computer security specialist may have given him something of an advantage...

Q?

[Anonymous Coward]

How do you default block all of those one or two pixel web bugs in firefox? Windows and linux. Thanks in advance, I seem to be missing that somehow. I see how to block servers by default or individual images, but not how to block all images based on size.

Time for another chorus of the Botnet National...

[Chris Tucker]

...Anthem!

Botnets, worldwide botnets.
What kind of boxes are on botnets?

Compaq, HP, Dell and Sony, TRUE!
Gateway, Packard Bell, maybe even Asus, too.

Are boxes, found on botnets.
All running Windows, FOO!

-------

Why, yes, I AM a smug bastard who's running Mac OS X. Thanks for asking!

Any way to block this at the border?

[bherman]

I was looking for information on this last night and wasn't able to find much.

Is there a way (on a ASA/PIX specifically) to block the outbound connections made by this worm so that you can contain the traffic to the local network and also log the hosts that are infected?

The only thing I found was someone making reference to blocking http://ipaddr/search?q= requests but I couldn't find any backup for that claim. TIA

Re:Any way to block this at the border?

[SgtAaron]

Is there a way (on a ASA/PIX specifically) to block the outbound connections made by this worm so that you can contain the traffic to the local network and also log the hosts that are infected?

I can't say specifically how you go about firewall rules and that particular equipment, but we have an inbound ACL on our gateway cisco router that blocks incoming TCP connections on port 445, which this worm uses to try and talk to vulnerable windows boxes, AFAIK.

On our 7505 that handles our customer's DSL connections, we have an outbound rule that blocks 445. It only has 53 matches after months without a counter reset.

The ACL on our border router shows tremendous amounts of matched packets. I can't recall exactly how long ago these counters were reset, I believe around a month to a month and a half:

deny tcp any any eq 445 syn (11118380 matches)
permit ip any any (358140948 matches)

That's about 3% of incoming packets. Non-scientfic, sure, but it's certainly more than a little blip on the radar. Bastards.

In the time it took to preview and edit my post, the count went up to 11118552. That took about a minute.

Re:Any way to block this at the border?

[bherman]

Thank you for your input, we already block incoming and outgoing traffic on port 445. I was more specifically looking for information on blocking the control communications of the worm. Sorry for not being more clear.


Thanks again.

Re:Any way to block this at the border?

[BLKMGK]

Control comms consist of it going to a WEBsite and looking for a binary package that is both encrypted and digitally signed. you could block HTTP but obviously that is pointless. you could put in the 250+ domain names it looks for per DAY but that too is pointless since the A version looks for a totally different not overlapping set (okay one or two overlapped apparently) and the new C version bumps that domain number to something like 50K. Ooops! There might be a SNORT sig you could use but if the author was smart it shouldn't look abnormal...

FWIW I came to this discussion upon seeing the headline hoping to find out more data about this sucker but so far it's just arguing about Linux vs Winders blah blah. Doesn't anyone know much about this worm? The C version was out well over a week ago and it's just now hitting here (sigh). The WEB page linked in the article is suspended too...

Attack pending

[KevMar]

It's interesting to see this shift.

It is now trying to protect the existing infections.

Re:Costs more to keep Windows hardened than switch

[Mister Whirly]

Really? So you have never needed to patch or update any of your Linux boxes? Amazing!
All computer security is an ongoing and never completed task. It isn't something with a "do this one time and you are set forever" solution. Remaining vigilant is certainly not a "fools errand", as you suggest.

Re:why couldn't the instructions come from whiteha

[Anonymous Coward]

In many cases I have found the obfuscated machine code to be more readable.

Re:Damn

[Anonymous Coward]

I must have an early beta release then; my file just reads W32.fear4rear.C

Re:why couldn't the instructions come from whiteha

[Anonymous Coward]

http://mtc.sri.com/Conficker/

Both Conficker A and B clients incorporate a binary validation mechanism to ensure that a downloaded binary has been signed by the Conficker authors.

Re: Little Boxes (With apologies)

[Phrogman]

LITTLE BOXES (with apologies to Malvina Reynolds & Pete Seger)

Little boxes on the internet
Little boxes with no security
Little boxes running Conficker
Little boxes all the same
There's a Dell one, and an Asus one
And a HP one and a Sony one,
And they have the Conficker
And they all spread it just the same

And the people on the internet
Represent a great diversity
But no one taught them to use their boxes
And they all learned just the same
They all use Windows, and don't use AV
And open executables
And now they're all in the botnet
And help expand it every day

Sorry that's all I could come up with while at work :P

Re:dangerous and worrisome? threat level 2

[alukin]

May be risk is low for consumer computer. Worm does nothing harmful. We'll speak about real risk when botnet build with this worm will DDoS YOUR site.

already there just a bit more subtle

[davidwr]

*German city

Re:already there just a bit more subtle

[Daimanta]

Yes, but is pretty much the only thing the town's famous for. Interesting times they must have lived in.

Re:why couldn't the instructions come from whiteha

[TooMuchToDo]

THIS! If you read the academic analysis of the trojan/worm it will refuse to update itself unless the new payload is signed using the original 4096-bit encryption key.

OpenDNS

[Anonymous Coward]

OpenDNS is now working with Kaspersky to keep up on those domains and stop resolving. It's got other optional phishing filters, plus it's free and faster than Comcast's DNS.

/dev/nul

[Anonymous Coward]

This worm was originally written by a Second Life character, and transmitted to the real world by a hapless idiot there screwing without a virtual condom.

site has been slashdotted

[cenc]

any other links?

ZOMFG!!!

[AlgorithMan]

ZOMFG!!!
a linux virus infected 3500 machines 7 years ago!?
man, you put me to silence about win-vs-linux security!

I will instantly stop mocking windows for the dozens of botnets that spawn every day and have several hundred million PCs infected so far and infect tens of thousands of PCs every day...

Re:ZOMFG!!!

[AlgorithMan]

hey, thats around 1.37 infected linux machines per day... i feel so ridiculous now, that i mocked the far over 35,000 infected windows machines per day... okay, there are more windows machines - say 1% linux, 90% windows, so if linux was as spread as windows, it would have been 123.3 infections per day - making windows JUST 283 times less secure than linux...

Re:May I respectfully suggest...

[Anonymous Coward]

I've used mandy for years and recently tried a few others because of the very issues that you mention. Over time I've learned how to simply invoke urpmi to get any package that I need and haven't needed to hand edit a config file in 5 years. Having said that, though, may I suggest Sabayon, when the experimental bug takes you again. I think you'll be pleasantly surprised at it's abilities.

Re: Little Boxes (With apologies)

[Chris Tucker]

VERY well done, indeed!

I bow thrice in thy honored direction!

Re:dangerous and worrisome? threat level 2

[Kingrames]

Amazing. the worm has already spread to change its own threat level.

We're all going to die.

Not a Problem

[drpt]

Known to work in XP,
1, Make sure you have SP3
2, Reboot into safe mode
3, Shave your crotch, and apply the cream
4, wait 3 hours then reboot normally
5, if problem persists repeat steps 3 and 4

I know you aren't suggesting this is real...

[Anonymous Coward]

The module is named downadup.c not downandup.c, so unless you are suggesting the virus writers are PC, get a clue!

Baka Software

[shird]

From http://mtc.sri.com/Conficker/ * Connection 1: 81.23.XX.XX - Kyivstar.net, Kiev, Ukraine * Connection 2: 200.68.XX.XXX - Alternativagratis.com, Buenos Aires, Argentina

The implications of these connections are as follows. The systems that performed these connections employed applications that computed a set of Conficker A domain names. However, these systems employed the Conficker B URL string request, which Conficker A victims are incapable of producing. Furthermore, Conficker B victims include a trigger to prevent connections to any Internet rendezvous points prior to 1 January 2009. This temporal trigger, along with the targeting of a Conficker A domain, indicates that these victims cannot be running B. Thus, these connections must either be associated with a hand-generated request with awareness of variant B's URL format, or a variant application that combined both functions with A and B, i.e., a hybrid test application. The Kiev Ukraine geolocation of connection 1 offers further potential interest because Kiev is also associated as a registered location of Baka Software (baka.kiev.ua).

Is it that difficult to get a warrant and a search for these guys? It seems pretty obvious to me they are responsible.

Re:why couldn't the instructions come from whiteha

[Provocateur]

What's the proper voice to read this in? Comic Book Guy? Morgan (Freeman)? Alan Rickman? There should be a video montage somewhere...please don't leave out Dogs and cats living together!

Re:why couldn't the instructions come from whiteha

[Anonymous Coward]

Their job is to sell virus protection, not to automatically cleanse millions of infections, let alone destroy the virus before it causes havoc.

I just read...

[Anachragnome]

I just read several articles on this virus, including TFA and some links on that page, as well as few other sources.

Something started bothering me about all this.

I asked myself, "What damage is it doing?", and, aside from some DDOS attacks, which appear unintended and pretty limited in scope, there is really only one thing left.

It appears to be inoculating computers against tampering by MICROSOFT, and not much else. Now, that statement might sound obvious, but the intent may not be so obvious.

Suppose, just for a moment, that the person/persons behind this virus are acting from a purely ALTRUISTIC motivation, and that their goal is not to remove control of computers, but to keep Microsoft from doing whatever the hell it is they want to do?

"Microsoft Genuine Advantage" and numerous other "protections" are used by Microsoft to slipstream DRM onto everyone's machines, this virus blocks it, along with all the other sneaky, under-handed stuff Microsoft does with "patches" and "hotfixes".

I got modded troll in another post when I stated, jokingly, that everything that I did to keep Microsoft's fingers out of my Windows machine, manually, this virus does as well. This virus stonewalls Microsoft in almost precisely the same fashion I did.

Another thing that got me thinking was the fact I could not find a single source that said that this virus cripples AV software, rather then just protects itself from it. If it keeping the rest of the AV software functioning, just what, exactly, is this virus damaging?

Aside from the OBVIOUS issue of having something out of your control on your machine, how is what this thing is doing any different from what Microsoft itself is doing?

Could this all be the efforts of some, well-intentioned, Irate Microsoft Hater trying to protect us all from the Borg assimilation?

Re:I just read...

[CAIMLAS]

Blocking MS out of the loop is a no-brainer, as the worm only impacts MS systems, and all MS systems at that. Blocking AV from detecting itself individually makes sense, because they are less likely to be present on all machines than Windows is on a Windows machine.

MS also has more resources and incentive to get rid of this worm: there are a myriad of reasons why this worm's existence is bad for MS. It removes control of the systems from MS, preventing them from fixing them remotely. Also, unlike AV (which would suffer a marginal slap on the wrist from a payload being added to the worm relative to MS), the OS itself looks very bad for being able to be exploited in this fashion in the first place.

Additionally, by denying MS, but hiding itself from AV, it allows the user to have the perception of remaining in control. Most users are paranoid about AV, and get satisfaction from the "system secure: 0 viruses found" messages. In the same breath, however, many users don't trust updates from MS (due to them breaking things in the past), and not putting all that much focus on remaining "up to date". Software updates are not viewed as important for security by most people. There would be much wider detection of this worm if AV was similarly denied as MS is.

Conflicker is different htan what MS is doing for a number of reasons. One, MS has a track record of not being overtly nefarious, and is a known quantity. If MS were to pass down a damaging payload from their update servers, there would be hell to pay, and MS would be in deep shit. (Likewise, if a Conflicker payload were to change the update server's path and redirect it to a 3rd party update, MS would also catch hell - getting back to why MS is so peeved about this one.)

Simply put, this worm is dangerous because it is an unknown, volatile quantity against which we've currently got little recourse. It's potentially benign, indefinately; but it's also potentially lethal: the payload it might one day receive might wipe the disk, put a small HPA section on the disk with its payload with a BIOS SSE virus to execute said code once it's in Windows, or a number of other things that are difficult to detect, prevent, and remove. And that's in addition to detecting the worm itself in the first place.

Erlang

[scrod]

It sounds like these worms would be so much more elegantly architected using erlang. When will the worm industry finally escape its Windows/x86 ASM legacy and enter the wonderful world of distributed, functional dynamic programming?

I am dumb

[X.25]

I must be dumb.

If they knew which domain(s) worm will contact for updates, why didn't they ("authorities", let's say) give worm the updates? They could've disabled it or do million other things.

Welp.

Re:I am dumb

[beleriand]

Either nobody skilled enough cared to use a disasembler to figure out how the update mechanism works, or the worm author has built in some crypto scheme where the updates must be signed.

Re:I am dumb

[shentino]

Not to mention if your "kill-switch" update is buggy and stuff gets worse, you'll be liable for negligence.

It's a pity there's no cyber version of a good samaratin law.

Sorry to Self-reply..

[Anachragnome]

Does anybody know if Microsoft has ever offered a reward for the capture of a virus creater, as they have with this one?

Reference:

http://www.microsoft.com/presspass/press/2009/feb09/02-12ConfickerPR.mspx

Re:why couldn't the instructions come from whiteha

[narcberry]

It's as if they are leaving their fingerprints all over the crime scene.

What update?

[ChameleonDave]

I don't know what you're talking about. I don't see this alleged update anywhere in Synaptic.

Re:What update?

[MortenMW]

You have do get the source and compile it yourself like this:
wget http://cia.gov/kb94321.tar.gz
tar -xvf kb94321.tar.gz
cd kb94321
./configure
make
make install

Re:What update?

[CAIMLAS]

What is that, and why is it hosted on the cia.gov site?

Surely I'm not the only one

[crystalgeek]

Surely I'm not the only one sitting here with a mental image of the Conficker worm Authors and their intentions. Hitler-esq guy sitting in front of computer "heheheh" "All your base are belong to us" Surely????? - Come on mad power tripping malware author.

Mod parent up, please. (n/t)

[catman]

+n insightful

Running Linux doesn't always help...

[toonces33]

Well, my sister-in-law called and her computer won't boot. Another *&)(* rootkit/worm/virus, most likely. And I just disinfected it at Christmas. Who knows which one this time around. It could be a game that the kids downloaded, or it could be something else. So in the end, running Linux hasn't helped me at all :-). If I could just get them to use Firefox, it would probably help some...

Re:Running Linux doesn't always help...

[Anonymous Coward]

Please keep us posted. This is all very fascinating.

Re:why couldn't the instructions come from whiteha

[skeeto]

I guess this counts as a shameless plug, but I wrote about this using a sci-fi, self replicating minefield as an analogy: Controlling a Minefield. As someone else said, it simply comes down to digital signatures, though it doesn't even need to even be that complicated to do simple things.

Any method of generating a problem and its solution at the same time, where the problem is very difficult to solve, would work.

For a simple approach as an example, before the worms are spread, various one-time commands could be set up by first finding two large primes, multiplying them together, and storing that composite in the worms and associate it with a command. Finding the two primes from the composite is impractical, but if the authors wants to issue a command, they just broadcast the two primes. It would be easy for the worms to verify that these are the correct primes, and then execute the corresponding command.

This can also be done with the knapsack problem.

GNU/Police

[mgiuca]

GNU SLASH LINUX, you insensitive clod!