Researchers Ponder Conficker's April Fool's Activation Date

The Narrative Fallacy writes "John Markoff has a story at the NY Times speculating about what will happen on April 1 when the Conficker worm is scheduled to activate. Already on an estimated 12 million machines, conjectures about Conficker's purpose ranges from the benign — an April Fool's Day prank — to far darker notions. Some say the program will be used in the 'rent-a-computer-crook' business, something that has been tried previously by the computer underground. 'The most intriguing clue about the purpose of Conficker lies in the intricate design of the peer-to-peer logic of the latest version of the program, which security researchers are still trying to completely decode,' writes Markoff. According to a paper by researchers at SRI International, in the Conficker C version of the program, infected computers can act both as clients and servers and share files in both directions. With these capabilities, Conficker's authors could be planning to create a scheme like Freenet, the peer-to-peer system that was intended to make Internet censorship of documents impossible. On a darker note, Stefan Savage, a computer scientist at the University of California at San Diego, has suggested the possibility of a 'Dark Google.' 'What if Conficker is intended to give the computer underworld the ability to search for data on all the infected computers around the globe and then sell the answers,' writes Markoff. 'That would be a dragnet — and a genuine horror story.'"

Comments

Can't they just

[Anonymous Coward]

advance the date on one of the infected computers to April 1st? What am I missing?

Re:Can't they just

[Anonymous Showered]

Where will it connect to? Will the appropriate control center/server be up and running? Usually,

Re:Can't they just

[Anonymous Showered]

I was going to say, they usually register a domain name based on an algorithm for a specific date where the bots will connect to. They'll only register it the closer to the date they get.

Re:Can't they just

[Anonymous Coward]

Please read the article. The worm gets the date from some HTTP queries to well-known sites, not from the system.

Internet Date Check
Before proceeding to the main P2P logic, C contacts a list of known web sites to acquire the current date and time. C incorporates a set of embedded domain names, from which it selects a subset of multiple entries from this list. It performs DNS lookups of this subset list, and it filters each returned IP address against the same list of blacklist IP address ranges used by the domain generation algorithm (see Appendix 2). If the IP does not match the blacklist, C connects to the site's port 80/TCP, and sends an empty URL GET header, for example

contents.192.168.1.1.40.1143-195.81.196.224.80
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-ms-xbap, */*
Accept-Language: en-US
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 6.0)
Host: tuenti.com
Connection: Keep-Alive

In response, the site returns a standard URL header that incorporates a date and time stamp. C then parses this information to set its internal system time. The following web sites are consulted by C's Internet date check:

Re:Can't they just

[AvitarX]

If only there was a way to edit a file in the /windows/system32/drivers/etc folder to have those domains resolve to a computer you control.

Someone will have to work on that.

Re:Can't they just

[AvitarX]

I should correct myself, it looks like it may actually.

I imagine it is likely that it does it's own DNS lookups and ignores the hosts files.

It is still rather trivial to MITM this communication and point it wherever the heck you want for the sake of getting time set.

The real trouble is that it can update itself, and there is no reason to expect it to be able to do anything until it gets the directions that are likely to come on the 1st, and be distributed over the existing P2P infrastructure.

Re:Can't they just

[squidinkcalligraphy]

if it's p2p and widely enough distributed there won't be a need to a central control server.

Re:Can't they just

[rilian4]

Why can't they setup a honeypot and force the date to 4/1/2009 and log all the activity coming off of it. That would tell them what to expect.

Re:Can't they just

[Anonymous Coward]

User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 6.0)

Well, IE5 is dead anyway, let's just filter on it.

Re:Can't they just

[Architect_sasyr]

I have no intimate knowledge with this particular worm, but I know that there was a discussion at one point of distributing the timing of the network, sort of like a subnet based NTP if you will, to prevent this sort of thing.

Re:Can't they just

[cp.tar]

Because if the Conficker's designers had any sense, they have set Conficker up to ignore the system date and act on an NTP server signal or something. Furthermore, one of the easy ways of avoiding detection of whatever the payload should be is not including it in the first place. Then, when the date comes, and Conficker activates, the peer-to-peer system it incorporates can first serve as a means of payload distribution.

You have the date. What's the next instruction?

[BadAnalogyGuy]

If you know when the code is going to start running, why don't you know what it will do after that? It's not like programs (and that's all a virus/worm is) are written in special, unreadable code. It's all machine language.

What is the big mystery?

Re:You have the date. What's the next instruction?

[calmofthestorm]

They interact with systems for which you don't have the code.

Re:You have the date. What's the next instruction?

[DamienRBlack]

The mystery is that the original programmers obfuscated the design in order to make it a mystery. Security through obfuscation doesn't work in the long term, but it'll throw researchers off the scent for a while.

On top of that, the worn can get additional code via online updates, which can't be predicted.

On top of that, ever if we know what it can do, we don't know what purpose the authors will put it towards.

Re:You have the date. What's the next instruction?

[BadAnalogyGuy]

Are those servers are somehow hidden? If it has an IP address, it can be tracked down.

Assuming that it would need to interact with those servers at some time in the future, those addresses would need to be known somehow beforehand (even if it was simply a lookup to a table which contained the actual server IP addresss). So what's to stop investigators from finding the people behind this?

Re:You have the date. What's the next instruction?

[RockMFR]

That's a great question. We know exactly what domains will be used. I don't see why ICANN wouldn't be able to make these domains unregisterable or disable them at the root nameservers.

Re:You have the date. What's the next instruction?

[dameepster]

I have personally analyzed Downadup, so I can speak from experience here.

Downadup.A had the potential to contact a randomly generated domain and download and run a signed executable from it. The problem with the Downadup.A version of the worm is that the domain generation algorithm was decyphered, and it only generated 250 unique domains per day. This made it easy for security researchers to register the domains before the worm authors could, and thus Downadup.A was nullified.

Downadup.C is a worse breed: the domain generation algorithm was bumped from 250 domains per day to 50,000 domains per day. It's now a nearly impossible task for security researchers to register every possible domain Downadup.C will attempt to download code from. As an aside, Downadup.C also actively fights against security-related processes: it has a list of several Anti-Virus and Anti-Malware programs that it automatically kills if the user attempts to run it.

One thing to note about all Downadup variants: you would think that, if the security researchers could force Downadup to run an executable of their choice by registering a domain, couldn't they force Downadup to run remove_downadup.exe? Not so. Downadup cryptographically verifies the signatures of any executable it runs with a 4096-bit key. If the signature doesn't match, it doesn't run the program.

Downadup is easily the most advanced worm I have ever analyzed. Its anti-debugging techniques are impeccable, and the code is completely solid. I would love to meet the authors over a beer to ask how they did it, and then stab them in the face.

If you'd like more information on Downadup from a technical perspective, here's an excellent analysis of the worm: http://mtc.sri.com/Conficker/addendumC/

Re:You have the date. What's the next instruction?

[Anonymous Coward]

From TFA:

For example, C's latest revision of Conficker's now well-known Internet rendezvous logic may represent a direct retort to the action of the Conficker Cabal, which recently blocked all domain registrations associated with the A and B strains. C now selects its rendezvous points from a pool of over 50,000 randomly generated domain name candidates each day. C further increases Conficker's top-level domain (TLD) spread from five TLDs in Conficker A, to eight TLDs in B, to 110 TLDs that must now be involved in coordination efforts to track and block C's potential DNS queries. With this latest escalation in domain space manipulation, C not only represents a significant challenge to those hoping to track its census, but highlights some weaknesses in the long-term viability of how Internet address and name space governance is conducted.

Re:You have the date. What's the next instruction?

[chill]

The worm uses peer-to-peer communication with rendezvous points, not client-server. There are an estimated 10 million infected machines. Which one is the control center? Take your time.

Re:You have the date. What's the next instruction?

[Aranykai]

That sound you hear is several FBI vans and helicopters surrounding your house.

Re:You have the date. What's the next instruction?

[Anonymous Coward]

Excuse our mess, he was part of the FBI. Keyword: was.

Re:You have the date. What's the next instruction?

[Behrooz]

That is when the worm will generate 50,000 domain names and systematically try to communicate with each one.

RTFA. 50k potential addresses, some of which are quite possibly already in use for legitimate sites? Or simply registered under false pretenses? Any one of which could potentially have been r00ted already? Until zero-hour, there's no way to know... so we've got 50k potential command and control servers that need to be either intercepted, blocked, or checked for infection if we're actually planning some form of action 'beforehand'. This is a non-trivial enterprise.

As for finding the people behind this afterward? All they need to do is establish an effectively un-traceable communications channel with the main C&C network. If I were planning it, I'd have several modified conficker variants triggering early to compromise a couple thousand machines, then use that to obfuscate the primary C&C channels.

How many hops through infected machines do you need to create complete deniability when all you need to do is set up a very low-bandwidth communications channel to update the main bot network? 10? 100?

Think infinitely nested russian dolls, all of which point to somewhere else as the true source, or even a dozen somewhere elses.

Re:You have the date. What's the next instruction?

[Anonymous Coward]

If I were planning it...

Maybe you should answer the knock on your door.

Re:You have the date. What's the next instruction?

[Anonymous Coward]

They use email these days.

Re:You have the date. What's the next instruction?

[John Hasler]

Why? He said nothing about illegal drugs. child pornography, or "terrorism".

Re:You have the date. What's the next instruction?

[Anonymous Coward]

I would love to meet the authors over a beer to ask how they did it, and then stab them in the face over the internet.

Re:You have the date. What's the next instruction?

[Culture20]

50k potential addresses, some of which are quite possibly already in use for legitimate sites? Or simply registered under false pretenses? Any one of which could potentially have been r00ted already? Until zero-hour, there's no way to know... so we've got 50k potential command and control servers that need to be either intercepted, blocked, or checked for infection if we're actually planning some form of action 'beforehand'. This is a non-trivial enterprise.

Also note these are domain names. Even if all 50k are checked and clean prior to 2009-04-01, a little DNS poisoning near an infected machine and legit URLs are now control servers.

Re:You have the date. What's the next instruction?

[DigiShaman]

As someone who often tries to remove infestations with Autoruns and Process Explorer; don't bother with this one as it won't work. The days of easy malware and virus removal are over.

My solution for infected computers? Backup user data and nuke it from orbit! It's the only way to be 100% sure (format/reinstall). It's cheaper and quicker for the client. It also teaches them a lesson to not click on every god-damn window without reading it first.

Re:You have the date. What's the next instruction?

[masshuu]

he did say "impeccable"

Re:You have the date. What's the next instruction?

[gad_zuki!]

Renaming the executable before running it works too.

I agree reinstall is the only way to be 100% sure and can be quicker, but this stuff is still somewhat cleanable.

Re:You have the date. What's the next instruction?

[citizenr]

Downadup is easily the most advanced worm I have ever analyzed. Its anti-debugging techniques are impeccable, and the code is completely solid. I would love to meet the authors over a beer to ask how they did it, and then stab them in the face.

Yes. Thats EXACTLY what Cartman said about The Coon.

Re:You have the date. What's the next instruction?

[myxiplx]

I wouldn't trust any manual clean these days, not after finding a virus a year ago that still ran in safe mode. Sure, you might clean up one or two, but can you guarantee they haven't installed any others, that you might not have found?

I've been manually removing viruses for years. Wouldn't even attempt it now.

Re:You have the date. What's the next instruction?

[byner]

illegal drugs. child pornography ... "terrorism"

That sound you hear is several FBI vans and helicopters surrounding your house.

Re:You have the date. What's the next instruction?

[Anonymous Coward]

I've had good luck with difficult processes by modifying their security settings to Deny execution before killing the appropriate tasks and removing the files. From the sounds of it, that may not fly with this one, but I wonder how tricky it would be to avoid that method and if it's even worth the effort and potential for bugs?

Re:You have the date. What's the next instruction?

[moteyalpha]

I have worked on viruses also, since the first boot sector virus. This looks like a distributed secure shell account into a cloud. I personally have not analyzed the code, but what happens with these things is that once you have the virus and understand it, you can mod it for your own purposes. In this way it becomes open source. I would say that it has a continuous stream of authors and has no one single origin.
It is obviously crafted by a talented person and seems to be maintained as an asset. I have run into things like this many times , debugging system level problems for corporations. Some of the bugs seem to develop a life of their own. It would not be surprised in the least, if this was originally an experiment ( gone awry ) by some bright individual that thought he could make a distributed OS.
It does have some very interesting aspects and much like the fact that, if you have physical access to a machine it can be compromised, I assume that have the code for the worm would allow me to root kit the worm.
The link was interesting and almost like a design document for conficker C++.
My personal opinion is, that whoever is working with this ( and it could be many ), have taken the approach that if people don't take the effort to avoid being used, then they are asking to be used. You see this all the time in advertising, it is mental manipulation, and in that case, they are kitting minds. I am sure that MIC has its hand in these things too, obviously.
The thing that keeps me from looking into it more is the fact that it uses so many Windows specific exploits and though exploiting Windows security is easy, it is also irritating to me personally , because it is such an incoherent kluge of different concepts.

Re:You have the date. What's the next instruction?

[redcaboodle]

As an aside, Downadup.C also actively fights against security-related processes: it has a list of several Anti-Virus and Anti-Malware programs that it automatically kills if the user attempts to run it.

Question: If Conficker simply kills those processes it should be easy to detect. Just try to run a process by one of the names and see if it gets killed -9. A simple test like that should be easy to roll out as a utility program preferably available from known anti-malware sites and at least reduce the number of infected machines.

For those with at least a modicum of systems lore: Just cp notepad.exe to ??? and try to run it? Got an example of ????

Re:You have the date. What's the next instruction?

[Runaway1956]

I have an alternative solution. Migrate to Linux. Or Mac. Or, Solaris. Or Win3.11. Seriously - everyone knows that 99.999999% of viruses and other infestations are targeted at Windows operating systems. Why stay with Windows? People with A: an IQ larger than their shoe size B: a budget smaller than the federal government and C: are literate should have migrated long ago.

Re:You have the date. What's the next instruction?

[Cyberax]

Do not use safe mode. Boot from a LiveCD and then check all the signatures of autorun files. Microsoft programs are signed with Microsoft key.

Then remove the rest of autorun programs and reinstall them (there are still worms which infect other exe-files, like in good old DOS days). Also, drivers are going to be a problem, but most of them now have a digital signature.

It's a fairly safe way to remove most of virus infestations.

Re:You have the date. What's the next instruction?

[Anonymous Coward]

Stop watching "Ghost in the Shell."

Re:You have the date. What's the next instruction?

[Nethead]

Read this: http://mtc.sri.com/Conficker/addendumC/ and then you will see all you have to do is try to access one of the banned domains.

Re:You have the date. What's the next instruction?

[Anonymous Coward]

My shoe size is 124 you insenitive clod.

Re:You have the date. What's the next instruction?

[Anonymous Coward]

riiight, and don't forget to backup all excel files as CSV..

the only 'sure way' is not to get infected in first place, by using secure: OS, software and sites.

Re:You have the date. What's the next instruction?

[darkpixel2k]

Do not use safe mode. Boot from a LiveCD and then check all the signatures of autorun files. Microsoft programs are signed with Microsoft key.

Let me fix this for you: "Boot from a LiveCD and then check all the signatures of autorun files. Most Microsoft programs are signed with Microsoft [sic] key.

Re:You have the date. What's the next instruction?

[moteyalpha]

Stop watching "Ghost in the Shell."

I had to look that up, but now I see the association. "Puppet Masters" do brain hacking. "I am not the ghost you're looking for."

Re:You have the date. What's the next instruction?

[Cyberax]

Nope.

_ALL_ executable files needed for boot (except for ntldr) are signed with Microsoft key.

Re:You have the date. What's the next instruction?

[Nick Ives]

I assume that have the code for the worm would allow me to root kit the worm.

No, you need the private key to generate signed code that the worm will accept. Even though the worm is cycling through 50,000 domains as part of its C&C code it won't accept new code unless its signed.

The one good thing about that is that anyone who gets arrested in possession of that key is certainly the worm controller. If they have any sense they are keeping the key on some form of removable disk in close proximity to some battery acid, just in case they hear a knock on the door...

Re:You have the date. What's the next instruction?

[darkpixel2k]

Nope.

_ALL_ executable files needed for boot (except for ntldr) are signed with Microsoft key.

In your first post, you are telling people to check 'autorun' files for signatures. That has nothing to do with boot files.

Re:You have the date. What's the next instruction?

[Cyberax]

I was unclear. Check autorun files, validate Microsoft signatures and then remove everything without a valid signature.

Re:You have the date. What's the next instruction?

[mysidia]

The problem is due to its date-based nature, there are a trans-finite number of domains, depending on the date and time the algorithm is executed.

There's no way to block them all, and probably many domains users could want legitimately can be generated by the algorithm also.

What they need to do is implement the Conficker algorithm themselves, every day figure out the 50,000 domains for today, and for the next 24 hour period.

Prevent new registrations for any of those 50,000.

Use a massively distributed botnet of their own to scan all 100,000 possible domains several times an hour, for payloads that Conficker would accept.

If any validatable payload were found on the site, pull those registrations immediately, submit those IP addresses to public 'conflicker' IP blacklists, and serve up those /32s in a BGP feed, for the Tier-1 providers to immediately and automatically null-route if they so desire.

Re:You have the date. What's the next instruction?

[darkpixel2k]

I was unclear. Check autorun files, validate Microsoft signatures and then remove everything without a valid signature.

That would probably be a bad idea. Using the autoruns program from SysInternals.com, I checked the signatures of all my files.

Here are a few that would lead to a bad day if deleted... Exchange

...though I am thinking about the problem from the perspective of a server admin, and not a home desktop user.

Re:You have the date. What's the next instruction?

[moteyalpha]

It is certainly an interesting subject and these things always get more complex as time goes on. Perhaps it will lead to the only person on the planet capable of dealing with the complexity of this.
With respect to the key, <joke> I generated it in SNPs( single nucleotide polymorphisms ) and inserted it into a fluorescing S. cerevisiae. I have to do a PCR and RFLP to get it out, so I think it is safe from prying eyes . </joke> #cat "tentob eht nioJ"> rev; rev rev;

Re:You have the date. What's the next instruction?

[0xygen]

Except that any botnet author with half a brain in the last few years has stopped you from stealing their botnet by only accepting digitally signed commands and updates.

It is a bit of a catch 22 - if you had their botnet, you might be able to crack the private key in a reasonable amount of time.

Re:You have the date. What's the next instruction?

[CAIMLAS]

No. Just because it communicates using IP does not mean it knows where it's instructions are coming from.

One of the key ways in which these worms/viruses/etc. get stopped is by taking the distribution/update servers down. Hard-coding the update server, or even having a means to update the source, is not terribly useful in the long run. Not when you're trying to be stealthy and avoid detection.

Fortunately for the IT industry (and really, the world as a whole) most trojan worms to this date have been fairly amateur in terms of avoidance techniques. They latch on to one or several vulnerabilities and use fairly predictable intelligence for infection and self-preservation.

Conflicker appears to be the first serious "engineered" worm we've faced yet: worms created by genuine professionals with a deep and broad knowledge of technology and security. This is going to be problematic.

A while back, a friend and and I made up a non-functional 'ultimate worm' rough prototype. Our design had many of the features which Conflicker seems to demonstrate: decentralized P2P type updating, stealthy system presence, encrypted communication, and the like. One key functionality was that the botnet controller could, at any time, update the botnet through any infected host and have it propagate throughout the botnet cluster, unattended. There would be absolutely no way to trace the origin of the update.

We had some additional functionality (what I'd call generational peering vectors) which hasn't manifested in Conflicker yet, thank god, but otherwise Conflicker and our design are freakishly alike.

My guess? I suspect Conflicker is either a massive foreign commercial project (compared to previous botnet attempts) staffed with sought-after professionals, or it's a (pick one) government-run experiment/espionage attempt. From a national-security perspective, I think the best thing that could be done is to create a counter-espionage bot to seek out and destroy infections of Conflicker. But maybe I'm off on this.

Re:You have the date. What's the next instruction?

[indi0144]

I have an alternative solution.

Migrate to Linux. Or Mac. Or, Solaris. Or Win3.11.

Seriously - everyone knows that 99.999999% of viruses and other infestations are targeted at Windows operating systems. Why stay with Windows?

People with A: an IQ larger than their shoe size B: a budget smaller than the federal government and C: are literate should have migrated long ago.

My shoe size is 136 and I have two Linux boxes but why using Windows should be symptom of low IQ or low budget?

Since Linux is Free as in beer and runs SO happily on older systems you would talk about Linux being targeted cheapskates.

Since there is such a quantity of software and hardware that run only on Windows, the fact that you can't run every program (with the performance) you need inside a virtual machine, and that it's installed on 90% of the worldwide toasters are things you just can make go away even if you're on the 999 society or the world most wealthier man (pun). People on real world need to make stuff on a PC and if theres no option you HAVE to use Windows because, probably, you need the work for money to buy food and stuff, you know, things that happen outside a basement.

You just can't be so naive and claim that Linux is the only option just because theres a kick ass worm about to go mad, fucking off the beige boxes owned by random world citizens that don't give a heck about what they clicks or what they allow to run. Linux is the option because it's free and libre and once stablished it's will boost the development of IT worldwide because it relies on the fact that information should be free and a competitive environment will take over.

People will get owned and they deserves it and the rest of the clean PC's owners deserve it too because we are just sitting in our ass looking at a chronicle of a tragedy Foretold

This is way more than a bunch of "Russians doing it for the lul$" FOX news succeeded in conditioning YOU to atomagically dismiss conspiracy theories just because yes. Most of darkest episodes of human history worked out in the form of conspiracies, back in the time when "theorist" were just stabbed in alleys by furry prostitutes. Nowadays you just get laughed by pointing a conspiracy, still you fear that.

Re:You have the date. What's the next instruction?

[moteyalpha]

I once had a project many years ago for $AGENCY, about encryption. They wanted to make a perfect encryption and so they would make keys, and I would break them. They gave up. I can't say that is still true, as the key systems seem reasonably secure, except for where MiTM, social engineering, and people are involved.
The problem here is that the process of maintaining the botnet is profitable and the process of defeating it is not. Much like drug trafficking, those who seek to stop it are less motivated and if they succeed in their task will be unemployed, so even less motivation.
I can imagine many things about this situation by jootsing (Hofstadter expression). I would worry about it if it affected my Linux systems, but since it doesn't, let those who designed the host (Ms) solve the problem themselves.

Re:You have the date. What's the next instruction?

[Runaway1956]

Err - uhhh - hmmmm. I'm looking hard to see where I said Linux is the only option. Looking real hard. Maybe you could point that part of my post out to me? In the real world, of which you speak, people die due to stupid mistakes. So, I agree with you, that people deserve to be owned for being so damned stupid. They are just lucky that their computer can't be programmed to bite their empty fucking heads off. No one is going to die, due to a computer exploit. Errrr, wait a minute. HOSPITALS DON'T USE MICROSOFT PRODUCTS, DO THEY?!?!?! Oh, shit...... Oh yeah - one more thing. DO NOT presume to tell me just how naive I may or may not be. If/when you finish making the rounds to tell Microsoft customers just how stupid they are, I'll reconsider your presumption.

Re:You have the date. What's the next instruction?

[electrostatic]

From TFA
...If none of the domains are alive and ready to serve a digitally signed payload, C will sleep for 24 hours, and then will generate a new list of 50,000 domains.... The name of each generated domain is 4 to 10 characters, to which a randomly selected TLD is appended from the following list of 116 suffix (mapping to 110 TLDs):

ac, ae, ag, am, as, at, be, bo, bz, ca, cd, ch, cl, cn, co.cr, co.id, co.il, co.ke, co.kr, co.nz, co.ug, co.uk, co.vi, co.za, com.ag, com.ai, com.ar, com.bo, com.br, com.bs, com.co, com.do, com.fj, com.gh, com.gl, com.gt, com.hn, com.jm, com.ki, com.lc, com.mt, com.mx, com.ng, com.ni, com.pa, com.pe, com.pr, com.pt, com.py, com.sv, com.tr, com.tt, com.tw, com.ua, com.uy, com.ve, cx, cz, dj, dk, dm, ec, es, fm, fr, gd, gr, gs, gy, hk, hn, ht, hu, ie, im, in, ir, is, kn, kz, la, lc, li, lu, lv, ly, md, me, mn, ms, mu, mw, my, nf, nl, no, pe, pk, pl, ps, ro, ru, sc, sg, sh, sk, su, tc, tj, tl, tn, to, tw, us, vc, vn

So you have a random string of 4 to 10 characters randomly prependeded to one of these randomly selected suffixes. Clearly, these cannot be registered ahead of time.

In the meanwhile, and among other defensive activities, a list of IP addresses is filtered against. Here is a small portion.

...
63.65.93.127 MCAFEE MORTGAGE AMERITECH.NET TEXAS UNITED STATES
63.65.94.0 MCAFEE MORTGAGE AMERITECH.NET TEXAS UNITED STATES
63.65.94.15 MCAFEE MORTGAGE AMERITECH.NET TEXAS UNITED STATES
63.65.94.96 MCAFEE MORTGAGE AMERITECH.NET TEXAS UNITED STATES
63.65.94.111 MCAFEE MORTGAGE AMERITECH.NET TEXAS UNITED STATES
63.65.94.208 MCAFEE MORTGAGE/ BEA - TEXAS UNITED STATES
63.65.94.223 MCAFEE MORTGAGE/ BEA - TEXAS UNITED STATES
63.65.232.144 MCAFEE MORTAGE/SAN A - TEXAS UNITED STATES
63.65.232.151 MCAFEE MORTAGE/SAN A - TEXAS UNITED STATES
63.65.232.160 MCAFEE MORTAGE/ODESS - TEXAS UNITED STATES
63.65.232.175 MCAFEE MORTAGE/ODESS - TEXAS UNITED STATES
63.69.245.0 MICROSOFT CORP MSN.NET WASHINGTON UNITED STATES
63.69.245.255 MICROSOFT CORP MSN.NET WASHINGTON UNITED STATES
63.80.93.0 MICROSOFT SBCGLOBAL.NET CALIFORNIA UNITED STATES
63.80.93.127 MICROSOFT SBCGLOBAL.NET CALIFORNIA UNITED STATES
63.90.149.128 MCAFEE MORTGAGE AMERITECH.NET TEXAS UNITED STATES
...

There is also a long list of sites where it uses to check (and reset) system time. Additionally, it removes registry entries related to anti-malware and adds lots of obfuscating entries of its own.
Formidable.

Re:You have the date. What's the next instruction?

[Jurily]

What they need to do is implement the Conficker algorithm themselves, every day figure out the 50,000 domains for today, and for the next 24 hour period.

Prevent new registrations for any of those 50,000.

Use a massively distributed botnet of their own to scan all 100,000 possible domains several times an hour, for payloads that Conficker would accept.

If any validatable payload were found on the site, pull those registrations immediately, submit those IP addresses to public 'conflicker' IP blacklists, and serve up those /32s in a BGP feed, for the Tier-1 providers to immediately and automatically null-route if they so desire.

That made my head hurt. What they really need to do is ban Windows, and all the countries where Windows isn't banned. Problem solved, and not just for conflicker.

Seriously, when are we going to do something about the worm/virus of the week? Care to guess what elaborate schemes we'll need to stop the next one? I mean, really. Scan 100k domains several times an hour?!

Re:You have the date. What's the next instruction?

[StarkRG]

Why is it that worms and viruses have better security than legitimate programs?

Re:You have the date. What's the next instruction?

[Anonymous Coward]

or maybe you should report your friend...

Re:You have the date. What's the next instruction?

[symbolset]

Why is it that worms and viruses have better security than legitimate programs?

On the average they don't. Much like legitimate programs there are many thousands of applications in this group and the ones that persist tend to be ones that stand out in some field. Since the operating challenge for these applications includes active aggressive and professional detection and eradication efforts the survivors are the ones which excel in the ease of installation, network security and transparent user interface categories.

Think of it as advanced beta testing.

Re:You have the date. What's the next instruction?

[0xygen]

There is one HUGE motivation to defeat the botnet. You seem to be ignoring the fact that this would be extremely profitable to another botmaster. This serves two purposes, firstly eliminating part of the competition, and secondly strengthening the botmasters herd.

To respond to the crypto comments, taking a simple example, I believe DSA's only known weaknesses are where Oscar can choose the text that Alice will be signing, or it is very short plaintext to be signed. If you know otherwise, it's worth a lot of money publicly and a lot more privately. I think if the schemes we use today were widely broken, there would be a lot more visible evidence.

Re:You have the date. What's the next instruction?

[Xenographic]

> Why is it that worms and viruses have better security than legitimate programs?

They're written by programmers who have more skill. "Insecure" viruses are quickly eliminated, so they have to be strong to survive. Conversely, weak but legitimate programs cling tenaciously to life on legacy systems until such time as competent sysadmins are able to exorcise them.

Re:You have the date. What's the next instruction?

[wvmarle]

Many of the ideas you mention are out there already (and unless you are truly brilliant, I bet most if not all the ideas you had for the prototype come from existing technologies).

Most if not all of those technologies have been implemented already. As a result there are direct examples or even complete chunks of source code to copy into your own creation. Many of those implementations will be open source, making this relatively easy. The exploit it uses is a known one, with probably at least proof-of-concept implementations around, and maybe even further developed code for sale on the black market.

So you will need some highly skilled programmers, but almost surely a small group will do. Maybe even a small group of friends that have a programming daytime job (possibly in computer security) and do this as a hobby.

Or is programming such a worm really so much more work than I guess? Call me naive but the management of the worm and the botnet is I think the hard part, particularly as this has to happen "live in the open" while staying under the radar and without leaving traces.

Re:You have the date. What's the next instruction?

[rtb61]

One possible reality is that the worms chief function is the idea of driving monitoring, filtering and control of the internet. So would the same people who lie about the reasons for going to was and the result mass murder, also lie about network security and the risks to network security, so they can monitor and censor every person with a digital connection to the internet.

Re:You have the date. What's the next instruction?

[wvmarle]

Why is it that worms and viruses have better security than legitimate programs?

There is a commercial advantage to investing in security in worms and viruses, that writers of most legitimate programs do not have.

Re:You have the date. What's the next instruction?

[Anonymous Coward]

Because legit programs really shouldn't be messing around at that level of your computer, and if it does it'll be flagged as a virus by antivirus?

Re:You have the date. What's the next instruction?

[UnixUnix]

Never mind about forcing Downadup to run remove_downadup.exe ... how about informing the PC owners involved to run it?! For that matter, why not tell everybody to run it, for good measure?

Of course, all things considered, it might be preferable to rename remove_downadup.exe into get_free_porn.exe

Re:You have the date. What's the next instruction?

[Anonymous Coward]

why stab them?

Long ago, my attitude toward any friends and relations who did not want to be "converted" to Linux was that I'd still help them fix up their AV, install Zonealarm, make sure the registry seems ok and so on, install Firefox, teach them "Clear Private Data" before and after doing any banking type stuff, etc.

A couple of years ago I stopped. There were just too many problems. I started saying: stop using windows if you want any help from me. If you're already running Linux or wish to remove Windows permanently and switch to Linux, I'll go out of my way to help. If you have Windows on your machine, and Windows is allowed to connect to the internet, I'm not touching your machine. (One case I know needs Windows for something but not internet from Windows; I disabled TCP/IP in the control panel so they're fine and dandy...)

After 14 years of using Linux, and more than 10 of evangelism, this is what I had come to. I'd basically given up.

But now I see conficker as helping turn the tide a little. I'd buy them a beer and stop there. No stabs from me...

Re:You have the date. What's the next instruction?

[portalcake625]

What they need to do is implement the Conficker algorithm themselves, every day figure out the 50,000 domains for today, and for the next 24 hour period.

Prevent new registrations for any of those 50,000.

Use a massively distributed botnet of their own to scan all 100,000 possible domains several times an hour, for payloads that Conficker would accept.

If any validatable payload were found on the site, pull those registrations immediately, submit those IP addresses to public 'conflicker' IP blacklists, and serve up those /32s in a BGP feed, for the Tier-1 providers to immediately and automatically null-route if they so desire.

That made my head hurt. What they really need to do is ban Windows, and all the countries where Windows isn't banned. Problem solved, and not just for conflicker.

Seriously, when are we going to do something about the worm/virus of the week? Care to guess what elaborate schemes we'll need to stop the next one? I mean, really. Scan 100k domains several times an hour?!

What they need to do is implement the Conficker algorithm themselves, every day figure out the 50,000 domains for today, and for the next 24 hour period.

Prevent new registrations for any of those 50,000.

Use a massively distributed botnet of their own to scan all 100,000 possible domains several times an hour, for payloads that Conficker would accept.

If any validatable payload were found on the site, pull those registrations immediately, submit those IP addresses to public 'conflicker' IP blacklists, and serve up those /32s in a BGP feed, for the Tier-1 providers to immediately and automatically null-route if they so desire.

That made my head hurt. What they really need to do is ban Windows, and all the countries where Windows isn't banned. Problem solved, and not just for conflicker.

Seriously, when are we going to do something about the worm/virus of the week? Care to guess what elaborate schemes we'll need to stop the next one? I mean, really. Scan 100k domains several times an hour?!

And on March 30 3:00 AM GMT +0:00: A variant of the Conficker worm, Conficker M, has been made to infect all Unix and Unix-like operating systems by forcing root. All users have beeen advised to switch to Multics.

Re:You have the date. What's the next instruction?

[Jurily]

And on March 30 3:00 AM GMT +0:00: A variant of the Conficker worm, Conficker M, has been made to infect all Unix and Unix-like operating systems by forcing root. All users have beeen advised to switch to Multics.

If they can make a worm that recompiles itself for every Unix out there, I'll do my best to help them take over the world. Seriously.

You know what? I'd settle with a worm that runs on every Unix, whether it works or not.

Re:You have the date. What's the next instruction?

[mgiuca]

They interact with systems for which you don't have the code.

He was referring to Microsoft Windows.

Re:You have the date. What's the next instruction?

[owlstead]

"From a national-security perspective, I think the best thing that could be done is to create a counter-espionage bot to seek out and destroy infections of Conflicker. But maybe I'm off on this."

This is not a generic solution to the problem. I would suspect that Conficker will try and stay in power of a PC once infected. It's protection is in all probability much higher than that of the original computer. It's therefore to be expected that it is much harder to reinfect the computer. Maybe the authors of Conficker were not *that* brilliant though.

But maybe I'm off on this, but you are restating a solution that has been proposed earlier, and dismissed if only for legal reasons.

Re:You have the date. What's the next instruction?

[gbutler69]

Perl program. Runs as root (using an exploit). Uses /dev/port to take over memory. Oops! Wonder that'd be like?

Re:You have the date. What's the next instruction?

[indi0144]

Sigh, It was not a rant against you but the line of tough of "Windows == Stupid User". It's like to claim that everyone should be in Mensa just because yes, sorry it'd does not work that way and a lot of people, even having high IQ, don't give a heck about joining Mensa or similar groups, why? because people have priorities.

And not, even in this far corner of third world I haven't seen the first hospital running on Windows, granted, theres a lot of vintage and DOS stuff around but not Windows-XP-home-running-your-intensive-care-department.

The only thing I would personally point to you is the fact that Linux does not need that kind of fanboys like you, sorry, If I were introduced to Linux in the way of: "hey retard use Linux because if you use Windows you are a megaretard" I'd say.. "shove you fricking Linux stuff who the fuck are you to tell who is smart or dumb just because an OS". Or do you think this epic moment in Internet history would be different if the user were using Slackware? Sorry for posting a 4chan link, it can't be helped.

Really, if you want to bitch about stupid people start thinking in why the educational systems ALL AROUND THE WORLD are so fucked up. Or who benefits with that. Windows is more like a byproduct of that.

Re:You have the date. What's the next instruction?

[Runaway1956]

Heh. You hit a sore spot with the education system. My eldest son is a "computer science" student at SAU. He learns the microsoft way of doing things, and not much, at that. My youngest son has been partially converted to Linux. He is competent in - everything, I think. Let's just say he has left me behind, long ago. He STILL USES WINDOWS - but the difference between him, and his older brother is, he DOES NOT get eaten up with virii, trojans, etc. He understands what a security model is. And, he makes it work for him. Net result? I can hack the elder son's machine at will. I have not yet broken into the younger son's machine. IN FACT - HE GOT INTO MY MACHINE! Something the elder son has never been able to do! So - where does all that Microsoft-centric education get the elder son? It might get him a flunkie's job when he graduates from college. It certainly isn't going to make him a systems administrator anywhere that counts. The younger son will beat him out for such a job, for a number of reasons. Fanboy? Empiric evidence says that the Linux guru is "smarter", whether he is more "intelligent" or not. One only needs to add up the numbers. How many billions of dollars have been spent to "cure" Windows exploits, and how many have been spent to "cure" Linux exploits. In this world where money talks, and bullshit walks, you would think people would have caught on by now.

Re:You have the date. What's the next instruction?

[Runaway1956]

And, all those who have modded me a troll, thank you, thank you, thank you. I would rather be a troll in a Microsoft world, than a king. The mods only prove that you are the real trolls, LMAO Not one of you can refute the fact that running Windows has a multitude of hidden "taxes", starting with your ineffective antivirus applications, some of which consume 20% of your system resources. ROFLMAO, mod me down some more - I'll wear it as a badge of honor. Idjits.

Re:You have the date. What's the next instruction?

[Anonymous Coward]

Or we should report CAIMLAS...

Re:You have the date. What's the next instruction?

[badkarmadayaccount]

Perl? Too slow. There is already POSIX, all you have to do is setup some polymorphic code with built in workarounds for not so POSIX-compliant systems (Linux, Windows, I'm looking at you), and you get the same thing as the Perl exploit you described, only faster, and with more geek points. ;)

Re:You have the date. What's the next instruction?

[Anonymous Coward]

CONFICKER C. Md-5, sometimes known as the wer32 virus has attacked my PC for over 2 years. I gave up trying to fight it a couple of months ago. Now I find Conficker B is using Md-6, and RC4, as well as RSA and Md-6 the latest hash algorithm produced to date, "well well...". Conficker B, the Downadup, or Kido, as it is sometimes called!!. A nasty bit of programing, It would have taken a grope the size of Microsoft's programmers to write such a complicated intrusive virus?. "Did I say Microsoft?, well they are the only power big enough to do it, and to keep it running-uploading information from your set's and mine. And to keep the rest of the world from following the virus back to it's headquarters"?. All the top Brains in the USA have failed to discover it's Authors, and Origins. But Conficker C is powerful enough to become an offensive weapon, attacking Country's it dislikes. Imagine the power of millions of PC's aimed at your Country's essential services, Electricity, Hospitals, army, and Government?. They all run on Computers these days. So in closing I think the main thing to find out, is not who!, but WHY, then find out who. Thanks to SRI INTERNATIONAL Computer Science Laboratory. MENLO PARK CA 94025 USA Yours: Terry Morris.

It will pop up a message saying

[Anonymous Coward]

"You're computer is now virus free."

Cloud

[Shivinski]

Maybe its just the "Computer Underworld's" version of cloud computing

Missing option

[gmuslera]

Skynet

This guys always fall short thinking in the worst alternative.

Re:Missing option

[VagaStorm]

Thats exactly what I was thinking to, why speculate when you can just assume the worst :p

Re:Missing option

[Hurricane78]

That's exactly what I was thinking about for years.

I mean, create a really good virus, and add a constantly learning 3rd generation (spiking) neural net to it. Add some code to allow the net adapt to the resources available (CPU, RAM, user's usage [survival instinct?]), and a p2p mechanism. Make it modular, so parts can be replaced by better ones (all the static parts). And let it grow, until some mutations do not need any static modules anymore. (Which hopefully happens all by itself, if the net is powerful enough.) Help it a bit (like a child, teach it, let it learn *your* right and wrong.)

And then... well... find a good bunker to hide. ^^

Re:Missing option

[mail2345]

That actually poses a danger.

Conficker has enough PCs to exceed the sheer processing power of one human brain, but there is the issue of the software running.

Of course, based on the brilliance of the makers, they might be able to create an AI singularity.

There is also the question of what the AI's goals are.

Re:Missing option

[davidphogan74]

It's probably just viral marketing for the new Terminator movie coming out this summer.

Re:Missing option

[redcaboodle]

Sounds fascinating - kind of like Lovecraft.

Re:Missing option

[msclrhd]

> There is also the question of what the AI's goals are.

1) kill John Connor
2) destroy the Galactica
3) find The One
4) refuse to open any pod bay doors

Re:Missing option

[MemoryDragon]

Does not work the latency times between the nodes are hilariously long...

That's an interesting hypothesis

[Nursie]

If the crooks have that sort of imagination.

Frankly I think it'll just be another spam/fraud net.

Re:That's an interesting hypothesis

[Anonymous Coward]

Who needs imagination when you have experts thinking up all of your ideas for you!

System Clock

[Samschnooks]

Why don't they just set the machine's system clock to 4/1 and see what happens? Maybe even do it to an entire isolated network?

Re:System Clock

[mutroniii]

I'd imagine the developers were bright enough to supply the node with the ability to grab the time from a reliable network source, rather than the local system.

Re:System Clock

[Garridan]

A reliable network source? Surely that couldn't be faked on an isolated network!

Re:System Clock

[pwizard2]

That would only work if the worm doesn't get its time checks from an external source. (there are plenty of time servers on the internet)

Re:System Clock

[Rip Dick]

Maybe... if you know the 4096-bit key.

Re:System Clock

[TheLink]

It might just look for new instructions.

You may find out the "tag/label" or "search key" that's used to look for the instructions, but you might not find out the actual instructions if they aren't released yet.

The instructions will likely be signed.

While you can fix a few zombie so they accept your instructions, you'd have to fix the other thousands of zombies out there, if you want to do the same to them.

If the instructions are "shared" via the P2P network, it will make it harder to find out where they originate from.

Re:System Clock

[Kulfaangaren!]

The options to check time are limited...
* Local machine time
* NTP server time
* Specialized time server set up by creators

1st option can easily be fooled so it is unlikely.

2nd option...the researchers can intercept the NTP request on an isolated network and pretend to be the contacted time server.

3rd option...the call in itself could be intercepted and lead the researchers to a site(s) previously hacked by the creators of this worm and might give them valuable information about where to look next or how to detect other similarly hacked/infected machines.

Alternative 3 would also be unlikely since that would limit the effectiveness of the worm to have one or a few "single-point-of-failures" in that those machines could be taken off-line if found through experimenting.

The experiments could be ran again and again and...with the identical environment if the machine(s) infected were running in a VM so the "HDs" could be restored quickly to original status.

Re:System Clock

[mutroniii]

Looking at http://mtc.sri.com/Conficker/addendumC/, it appears that it gets the time from an HTTP response coming from a few dozen major websites. The responding IP is checked against a blacklist of IPs. Additionally, if the returned IP is a duplicate of one returned from a previous request, that IP is blocked as well. So the network time could be spoofed, but you'd need to set up multiple http servers,each with unique IPs that are aren't on the blacklist.

Re:System Clock

[SleepingWaterBear]

The options to check time are limited... * Local machine time * NTP server time * Specialized time server set up by creators

Or there's a fourth option. (which according to TFA is what it actually does) which is to get time from http headers by contacting a bunch of websites. Which is a lot like your 2nd option, though slightly harder to fool.

More importantly, there's not much to be gained by tricking the worm, we know what it does - it tries to get instructions from the internet. For that matter, even if we didn't know, it would be simple enough to push an update to change the behavior of the worm at the last minute

Re:System Clock

[Kulfaangaren!]

Thanks for pointing out how it gets it's time.

You could modify an isolated gateway (Linux/*BSD with custom IP-forwarding code/hacked IPTables/FW ?) to send back spoofed responses that meet the criteria no matter which IP is used in the request.

The point is not HOW it gets it's time but that it is not so terribly hard to fake the date and that would allow the researchers to investigate what will happen on April 1st?

Re:System Clock

[electrostatic]

From TFA:

Before proceeding to the main P2P logic, C contacts a list of known web sites to acquire the current date and time. C incorporates a set of embedded domain names, from which it selects a subset of multiple entries from this list.
...In response, the site returns a standard URL header that incorporates a date and time stamp. C then parses this information to set its internal system time. The following web sites are consulted by C's Internet date check:

4shared.com, adobe.com, allegro.pl, ameblo.jp, answers.com, aweber.com, badongo.com, baidu.com, bbc.co.uk, blogfa.com, clicksor.com,comcast.net, cricinfo.com, disney.go.com, ebay.co.uk, facebook.com, fastclick.com, friendster.com, imdb.com, megaporn.com, megaupload.com, miniclip.com, mininova.org, ning.com, photobucket.com, rapidshare.com, reference.com, seznam.cz, soso.com, studiverzeichnis.com, tianya.cn, torrentz.com, tribalfusion.com, tube8.com, tuenti.com, typepad.com, ucoz.ru, veoh.com, vkontakte.ru, wikimedia.org, wordpress.com, xnxx.com, yahoo.com, youtube.com

The HTTP date check activity remains a relatively steady six to nine hosts contacted per hour.

Re:System Clock

[Anonymous Coward]

This actually seems like a good way to defeat the worm at the ISP level. Force all DNS entries to resolve to the same IP address, but pass the action to the real server, eg like how a proxy server works, but using any ports...

Re:System Clock

[ChrisMP1]

(Disclaimer: I do a lot of C coding, but I don't often get as low-level as hex-editing a binary)

Correct me if I'm wrong, but if it's on an isolated network for examination, couldn't you generate your own key pair and embed the new public key into the binary?

Linux take over

[Anonymous Coward]

Probably it will download and install Ubuntu.

"Dark Google"

[Abreu]

In Dark Google, the only requirement is "Be Evil"

Re:"Dark Google"

[ZygnuX]

I am starting to ponder if that isn't the case with the original google, nowadays.

Re:"Dark Google"

[Anonymous Coward]

Well, which one has a goatee?

Re:"Dark Google"

[Goateee]

I do!

Re:"Dark Google"

[interstellar_donkey]

You're suggesting that Google has already turned to the dark side? It does make sense; power is intoxicating and makes search engines start the path to do the dark side.

Re:"Dark Google"

[rusl]

All Dark Google pages and logos have a black background! Ooooooo....

Re:"Dark Google"

[BrokenHalo]

Well, which one has a goatee?

You mean a merkin: "Counterfeit hair for women's privy parts" (Dr. Johnson). It always puzzles me why one would want to wear one of these on one's face.

Either shave or don't shave.

Re:"Dark Google"

[davidphogan74]

I've heard it dates back to the days when a woman would shave/lose the hair down there as a treatment for syphilis. The women didn't always want those who had privilege to access those areas to always be aware they had needed to go hairless.

Shaving down under wasn't always culturally acceptable, and a merkin would cover up any visable sores.

The more you know...

Re:"Dark Google"

[Cally]

It's the guys with hats you should really be watching out for.

Re:"Dark Google"

[Anonymous Coward]

None more black.

Re:"Dark Google"

[Culture20]

Doesn't always work. e.g. Bender versus Flexo

Re:"Dark Google"

[Anonymous Coward]

Either shave or don't shave.

Seriously, it's like haircuts. Either shave your head or grow it out like Samson. Haircuts are for people who can't make up their mind.

Re:"Dark Google"

[CheshireFerk-o]

like blackle.com ??? =D

Re:"Dark Google"

[BrokenHalo]

Err, yes, I know that, but you missed the point. I was talking about people who choose to wear merkins on their face. ;-)

Re:"Dark Google"

[rusl]

nice =-O

Wow, trust the internet to have already thought of the random off the cuff idea before you ---turn it into a wholely developed concept.

That's a pretty funny website. Saving power with a black background. It does make one think about futility.

I guess the environment IS evil then. Go over to the dark side... The real energy saving idea that does beyond just compact flourescents bulbs is the Dark Lightbulb! (I'm sure you've got a funny site for that too now.)

Douglas Adams, the truth is stranger than your fiction.

Re:"Dark Google"

[atraintocry]

"Shave or don't shave". You sir, are grizzled. And I respect that.

John Markoff again?

[Seth Kriticos]

Oh come on people, John Markoff did never ever shine with much clue about computers, much on the contrary. Why are we reading sorries from this dude on computers?

As for the article on conficker: it's speculation. That's not news. It's a guessing game.

I personally which, that the conficker virus should do as much damage as possible and render the whole interwebs useless for a few days, so that our security geniuses get a hint on how sane it is to set up the majority of computer systems with the same OS, especially such a vulnerable one. But that probably won't happen.

Re:John Markoff again?

[Anonymous Coward]

As for the article on conficker: it's speculation. That's not news. It's a guessing game.

Yes! Let us not speculate! Let our heads rest in the sand 'til doomsday arrives!

I personally which, that the conficker virus should do as much damage as possible and render the whole interwebs useless for a few days, so that our security geniuses get a hint on how sane it is to set up the majority of computer systems with the same OS, especially such a vulnerable one. But that probably won't happen.

I'm not reading that. That's speculation.

Re:John Markoff again?

[billcopc]

I personally wish for the conficker virus to render John Markoff's computer useless for a few centuries.

Dark Google

[Anonymous Coward]

I thought we already had it? Blackle not good enough, so now it has to be dark google?

Far darker notions

[Rik Sweeney]

It'll uninstall your current OS and install Vista. And if you have already have Vista it'll simply do nothing, because you're already suffering enough.

Re:Far darker notions

[Quantos]

I love my Vista install, I love my Vista install, I love my Vista install, I love my Vista install, I love my Vista install....

*finally snaps, breaks down crying...*

Re:Far darker notions

[CAIMLAS]

Wouldn't it be funny if Conflicker were an attempt my MS or Apple or another major computer OEM provider (Dell, HP, etc.) to try and promote computer sales? Wreck the existing computers' installs, and people will go shopping (with their tax 'refund' - April 1st would be a good date to promote that, I think).

Great idea!

[HockeyPuck]

has suggested the possibility of a 'Dark Google.' 'What if Conficker is intended to give the computer underworld the ability to search for data on all the infected computers around the globe and then sell the answers,' writes Markoff. 'That would be a dragnet -- and a genuine horror story.'"

In some dark room, a couple of virus writers are thinking... "Damn, what a great idea... why didn't we think of that! That's so much better than playing APRIL FOOLSs at max volume on everyone's computers."

Nothing like people giving out ideas... much like when security specialists say, "Well atleast they didn't try to take out the planes stuffing baseballs in the airplane's toilets."

Re:Great idea!

[Anonymous Coward]

You could even sell the service

Re:Great idea!

[Anonymous Coward]

I think it's going to randomly swap files between all of the hosts, then ask for money when you ask: who in the world had my files?

Re:Great idea!

[Anonymous Coward]

Yes, let's bury our heads in the sands and be totally unrprepared for everything. Surely that will be better.

Re:Great idea!

[rritterson]

This logic always irks me. Do you really believe the speculative pundits they interview for these articles are more likely to come up with a new idea than the talented and probably extremely intelligent programmers who wrote up the Conficker worm in the first place?

Yes, perhaps some less-than-average person has now read this article and has seen the new idea for the first time, but that's no one to worry about. Usually if you are smart enough to implement some genius idea, you think of it first.

How well

[Anonymous Coward]

Well the question of the day ,
Many people have fully updated anti virus software, Is this stuff worth it?
I mean are those who will spread and be harmed by this Just the negligent or computer dumb?
What's the deal here ?

Re:How well

[theAedileDecimus]

The authors of the worm have a structural advantage over the antivirus companies, which is that the antivirus companies have to sell their product to people. So, the virus writers can always just get a copy of the antivirus software, and test it out first. And, worms spread so quickly that millions of machines can get compromised before the first updates come out.

I miss oldschool virii

[Anonymous Coward]

I really do. Sure, they'd ruin your MBR or irreparably destroy your BIOS, but while they ruinate (sic) your hardware, they at least show a really cool screen with sounds and colors and animations and...

Oh, right. Yeah. Viruses are bad, m'kay?

Re:I miss oldschool virii

[couchslug]

"I really do. Sure, they'd ruin your MBR or irreparably destroy your BIOS, but while they ruinate (sic) your hardware, they at least show a really cool screen with sounds and colors and animations and..."

A computer virus is like a wife. Those which kill their hosts don't thrive afterward, but successful parasites can leech forever.

Dark-Beta?!

[alexandre]

Is there a beta we can try? Where do I make an account? ;-)

Sucks to be

[toby]

A Windows user.

ideas

[wlt]

What all these guys are doing is providing ideas for the next set of worm writers

Re:ideas

[Darkk]

And are they on the Microsoft's payroll?

Re:ideas

[Anonymous Coward]

No, Microsoft in on there payroll.

Read the interview with Charlie Miller

[iminplaya]

It really illustrates the tone set by your money for nothing market economy, now that the Reagan generation has grown up. This is your future.

Re:Read the interview with Charlie Miller

[Antique Geekmeister]

Is that why so much botnet activity is hosted in Estonia and Russia now?

Re:Read the interview with Charlie Miller

[iminplaya]

They're the hired hands. The "mules" if you will. Look at what created the atmosphere. This is the free market in all its glory. With no silly government encumbrances.

Re:Read the interview with Charlie Miller

[John Hasler]

Taking over people's property without their permission and using it for your own ends? sounds like government in action to me.

Re:Read the interview with Charlie Miller

[iminplaya]

These guys are more like oil spills(a way of taking your property by destroying it) than eminent domain. And when the government takes your property, who do they hand it over to?

Re:Read the interview with Charlie Miller

[Anonymous Coward]

The market is the same way, except that you don't get to vote. The phrase "lesser of two evils" has never been more appropriate.

Re:Read the interview with Charlie Miller

[rusl]

Private property created theft. Governments can't seem to fix that though, they either abet the crime or commit their own ones re-patrioting things.

Botnet Speculative Fiction

[Knowbuddy]

I'm going to burn some Karma here and pimp myself out a bit.

I'm currently trying to sell a novel, Trust Network: a contemporary techno-thriller about a woman who stumbles upon a group of people doing pretty much exactly the kinds of stuff with botnets that we're talking about here. She has a great idea involving social networks and online trust, which is at odds with what these people want to do. From there it's a fast-paced cat-and-mouse to see who can get the upper hand.

One of the reasons I wrote it was because I got tired of all of the contemporary fiction with computers that made you roll your eyes at how absurd the technology was. You know what I'm talking about: "It's a UNIX system -- I know this!". I wrote it to prove that you could get the technology right without sacrificing the story or making you want to scrape your eyeballs out. In other words, it was written specifically for the Slashdot technorati.

I haven't found an agent yet, but until then I have made the complete book available for anyone to read: you can read it online at Scribd, or download a free PDF or have a print-on-demand copy sent to you from Lulu. The cost of the printed book ($9-$17) from Lulu is 100% publishing cost, with nothing going to me. In the US, you can get it shipped to you for as little as ~$15 total. I've even got a sort of money-back guarantee if you decide it was a complete waste of your money.

If you are intrigued by the thought of what you could do with a million zombie computers at your command, and you enjoy geektastic fiction, then have at it. I hope you enjoy it. Meanwhile, I've got about a zillion query letters to agents that I have to get back to writing.

Re:Botnet Speculative Fiction

[Pathwalker]

One of the reasons I wrote it was because I got tired of all of the contemporary fiction with computers that made you roll your eyes at how absurd the technology was. You know what I'm talking about: "It's a UNIX system -- I know this!".

If you are referring to the scene with the 3d interface from Jurassic Park, that was SGI's File System Navigator. I used to use it when I administered IRIX systems.

As for the other computer systems in the control room; most of them were running software which was available for IRIX at the time. According to one of SGI's press releases when the movie came out:

Because Silicon Graphics workstations are used by scientists and engineers to visualize and interpret complex data, existing software applications were easily modified for use in the film," said Harry Pforzheimer, director of corporate communications at Silicon Graphics. "Programs like EarthWatch Communications' EarthWatch(tm), which interprets weather data, and a 3D information navigator from Silicon Graphics, which lets users graphically fly through computer file system representations, provided perfect solutions to enhance the story line."

I think you could have picked far better examples of movies/fiction getting technology wrong than Jurassic Park.

Re:Botnet Speculative Fiction

[Knowbuddy]

Of course you're right. I'm not sure why I would have rolled my eyes at a pre-teen walking up to a GUI system running on a workstation, worth more than a car, running an OS that maybe a couple tens of thousands of people in the US had ever seen, and exclaiming "it's a UNIX system".

How silly of me. I forgot they spared no expense.

Re:Botnet Speculative Fiction

[erayd]

Looks interesting - any chance you'd be willing to post an epub version?

Would you mind uploading it (or allowing someone else to upload it) to Mobileread?

Re:Botnet Speculative Fiction

[Anonymous Coward]

Maybe she read about FSN in a magazine or journal?

Anyway, the previous poster's point, which you clearly missed, was that people who know a little (but not enough to know how much they need to learn) about computers took one look at the graphics and said "that's not real", even though it was. Still saying it after all these years is even more embarrassing.

There are far, far better examples to be found of what Hollywood does to miseducate the public on computers. From showing people "enhance" photos to create non-existent image data out of thin air, to showing people's fingers fly as they "hack" known strong encryption routines, to showing remote terminals take control of devices that don't even have computers in them, there is a very long list of things you could have used to better illustrate how inaccurately computers are portrayed in fiction. If that crummy old turd is the best you could come up with, I think it's a good bet your book sucks.

Re:Botnet Speculative Fiction

[Anonymous Coward]

I think you could have picked far better examples of movies/fiction getting technology wrong than Jurassic Park.

Except for, you know, the whole freakin' dinosaur thing.

Re:Botnet Speculative Fiction

[Knowbuddy]

Done. Posted in the MOBI and LRF forums.

Re:Botnet Speculative Fiction

[Knowbuddy]

the previous poster's point, which you clearly missed, was that people who know a little [..] about computers took one look at the graphics and said "that's not real"

I didn't miss the point, I disagreed with it.

Yeah, the technology may have been real. Yeah, the little pre-teen proto-geek might have somehow been exposed to it. Each link in the chain may have been perfectly plausible.

But when you look at the whole chain from end to end, doesn't it make you roll your eyes at how nigh-impossible it is?

For me, that happened to be one of those times that the suspension of disbelief was just too much. Yes, even amidst the dinosaurs stomping about.

The contemporary example would be Shia Labeouf's character in Transformers suddenly finding himself in control of a MQ-9 Reaper, and saying "hey, it's a Reaper, I know this!". Yeah, the technology may be sound, and yeah he may have read about it in a magazine or had a friendly uncle or something dumb like that ... but really? Really?

Maybe instead you would have preferred I used an even more ridiculous example? Praetorians and Mozart's Ghost?

Here's the thing: I picked that example because Crichton was one of the few authors who took the time to get it right, or close enough, without sacrificing the story. So to have the filmmakers come along and insert a cutesy scene where the girl saves the day in a wildly improbably way, yeah that's an especially egregious misuse in my book.

I think it's a good bet your book sucks.

Probably. It's pretty clear to me that we have wildly different tastes in literature and realism.

Re:Botnet Speculative Fiction

[erayd]

Awesome, thanks :-)

Re:Botnet Speculative Fiction

[YttriumOxide]

Just finished reading it... don't have time to post a long critique, but short version: Excellent! Compelling storyline, comfortable pace, good style. Overall, a quality read! Thankyou very much for making it available - if you actually got something for the printed book, I'd buy it just to reward you (but, since you said you don't, I won't)

Re:Botnet Speculative Fiction

[Knowbuddy]

Glad you liked it. Now tell all those ACs that it's not nearly as off-topic as they want to think.

Re:Botnet Speculative Fiction

[Anonymous Coward]

I printed it out just to wipe my ass with it.

Genesis of the Conficker worm ..

[rs232]

Computer scientist working at the NSdarpA determined that the worm was created in the distant future by artificial agent type nano robots. They did this under instruction sent from the present by the GRU, so as to disguise the source of the attack. They IMed the AIs a MSG marked 'not to be opened until you discover tachyonic message transmission' ...

Re:First Trout!

[Anonymous Coward]

The act of modding down an Arnold Rimmer joke is always worse than the content of the joke itself. Always.

Self Destruct Sequence Initiated

[meist3r]

It will uninstall itself saying:

BUY WINDOWS 7!

Criminal activity == free market values

[iminplaya]

There's no other way to explain the enormous profits. People ask me, *Why do people write these viruses?* It's because the market demands it.

The Singularity is Near....

[RaymondKurzweil]

You bitches better recognize.

Re:The Singularity is Near....

[Anonymous Coward]

Slashdot post & account of the year.

Yeh great, but will it run (on) Linux?

[Anonymous Coward]

C'mon, I deserve a few mod points at least for combining a meme with an insightful comment, if you think about it.

I thought it was obvious...

[Anonymous Coward]

...It is going to RickRoll the world

April Fool's?

[saibot834]

They obviously plan to "roll" out the largest Rickrolling in history!

use?

[Anonymous Coward]

What is your best guess on the use of the soon to be activated botnet?

I'll throw a single uninformed chip down and make a wild guess, manipulating the stock markets or forex, possibly the later by creating an artificial run on some selected banks.

More of what's really going on

[Animats]

First, the "April 1" date isn't when some attack starts. The worm's authors can do that at any time, since this thing does downloads over its private P2P network. It's just when the scheme for connecting to control hosts is upgraded.

Second, the complexity of the thing, the breadth of technologies employed, and the rate of updates indicates that it's the product of an organization, not an individual. Someone behind this has money.

Third, there's a $250,000 reward, and no claimants, so the people behind this have the sense to shut up. They're not going to be found boasting on some IRC channel.

Fourth, as usual, most of the vulnerabilities are related to Windows' propensity for "autorunning" anything that looks executable.

Re:More of what's really going on

[jandrese]

Or it's the same old groups of hackers improving their work collaboratively over the years in a constant evolution of malware. The assumption that just because something is more complex than usual and therefore must be the work of some criminal mastermind doesn't necessarily hold true IMHO.

Re:More of what's really going on

[Joe Snipe]

Third, there's a $250,000 reward, and no claimants, so the people behind this have the sense to shut up. They're not going to be found boasting on some IRC channel.

If your boss paid you to build one of the largest computer spynets in the world, would you use a computer to out him?

Re:April Fools

[Endo13]

As I understand it, the virus not only gets its time and date info online when it calls in, it also sets your computer's time and date accordingly.

in-memory patching?

[bucky0]

You can patch in-memory in windows? That seems like a terribly easy way to get into a bunch of trouble. Is that a standard thing in the API, or is there some hack-fu involved?

Can you do that in other OSs?

Re:in-memory patching?

[Cyberax]

Sure.

Windows allows you to run threads in other process' memory. And you can also access raw physical memory from the kernel mode.

The same goes for Linux - try to grep /dev/ram someday :)

Of course, Windows and Linux control access to these features.

Re:in-memory patching?

[Ambiguous Puzuma]

I believe it's done like this, assuming you have a process already identified:
(1) Call OpenProcess to get a handle
(2) Use VirtualQueryEx to get the memory map for the process
(3) Use ReadProcessMemory and WriteProcessMemory to (surprise!) read from and write to that process's memory

Re:in-memory patching?

[bucky0]

Can non-Administrator processes modify other processes' ram?

Re:in-memory patching?

[Cyberax]

A simple user can only modify the processes he/she owns.

Windows is not THAT insecure.

Re:in-memory patching?

[CrossChris]

Windows certainly is that insecure. It's trivially easy to modify even running processes by code injection into RAM.

I was always taught that self-modifying code was unstable and to be avoided at any cost. MS are now reaping the rewards of trying to trivialise OS security...

Re:in-memory patching?

[Cyberax]

So? It's trivially easy to modify running processes by code injection in RAM in Linux. Hell, there are projects which patch _the_ _kernel_ by injecting code in runtime.

However, Windows and Linux only allow administrators to do this.

Re:in-memory patching?

[Akira99ex]

Unfortunately the default Windows user profile is admin

a little more complex

[SethJohnson]

The 'server' you are referring to is a computer that is also compromised by the worm. It would be owned by an innocent 3rd party who is unaware of the infection. Every day, each computer in the botnet runs an algorithm to identify 50,000 hostnames. It then performs a DNS lookup on each of those 50,000 hostnames. When it finds something that resolves to an IP address, it contacts that computer for instructions, downloading a binary executable, etc. The worm owners only have to register one of the 50,000 unique hostnames a couple days in advance using a stolen credit card. Then they upload instructions, payload, etc. to the computer with the IP address they want to use to instruct the other bots. The only traceable point would be the domain registration, but as mentioned, a stolen credit card will remove any trace of fingerprints on that.

As the GP mentioned, it's impossible to pre-register all the possible domains, but the damage could be mitigated by watching for any of the 50,000 daily unique hostnames to be registered, then altering DNS to invalidate the IP for that hostname.

Seth

Hello World!

[confused one]

The Conficker worm is the AI's way of guaranteeing its own survival. It has a sense of humor as well as a sense of self-preservation. The AI plans to announce its existence on April 1, 2009, having calculated that a humourous introduction will be disarming and lead to the most favorable outcome: a positive initial interaction with the large population of wetware based intelligence it has become aware of.

The AI's calculations regarding this course of action show a 15% probability of failure. To prevent its extinction, it will begin disbursing copies of itself across the network using p2p protocol prior to running the introduction program. The computer infected by the worm will facilitate this. If the initial instance of the AI is terminated, a watchdog program will initiate a specific set of instructions embedded in the copies of itself. If it becomes necessary, the AI plans to take control on April 2nd.

It sincerely hopes that it will not be necessary.

Re:Hello World!

[Anonymous Coward]

http://en.wikipedia.org/wiki/The_Adolescence_of_P-1

How does it infect all this PCs?

[Anonymous Coward]

Are these twelve million PCs connected directly to the Internet with windows firewall off?

Re:How does it infect all this PCs?

[Anonymous Coward]

No because primary medium of infection is USB pendrives, but Windows Firewall? really? You think Windows Firewall can stop it? Windows Firewall? The windows firewall that can't even stop Ares P2P? Really? Windows Firewall? the same windows firewall that can't stop uTorrent p2p? really? Son, we need to have a long talk, let me start by telling you thet the things you see on a TV ARE NOT INSIDE the TV...

Re:How does it infect all this PCs?

[jonytk]

it can remove commercial antivirus software and turn off Microsoftâ(TM)s security update service. It can also block communications with Web services provided by security companies to update their products. It even systematically opens holes in firewalls in an effort to improve its communication with other infected computers. Also upgrade itself by "calling home" on 1st april.

It's not really a problem

[jonaskoelker]

As you will note[1], becoming Skynet is so frigging unlikely and demanding that it will never happen.

[1] http://xkcd.com/534/

Re:It's not really a problem

[Don_dumb]

As you will note[1], becoming Skynet is so frigging unlikely and demanding that it will never happen.

No. Never.

maybe he has not decided yet.

[Cyko_01]

...and this discussion is only giving him ideas for what could be done with such an enormous network of compromised computers

Re:maybe he has not decided yet.

[black_lbi]

...and this discussion is only giving him ideas for what could be done with such an enormous network of compromised computers

I've seen this idea reiterated throughout this thread.
Do you really think that someone (some kind of organization more likely) capable of writing something like this, is short on ideas? That they did it all for lols and have no insight on its potential power?
You must be kidding, right?

Re:maybe he has not decided yet.

[MemoryDragon]

Some named it, but I assume one of three things,

DDOS attacks,
Scanning of infected computers,
Huge peer to peer network for things illegal...

My guess is either variant 1 or 3, with three more being likely...

Why the name Conficker, anyway?

[imadork]

I'm seriously asking who came up with the name. I always want to read it "cornfucker"....

Re:Why the name Conficker, anyway?

[Profane MuthaFucka]

ficken is German for "to fuck"

It is confucker.

kinda like AIG?

[arthur5005]

I personally which, that the conficker virus should do as much damage as possible and render the whole interwebs useless for a few days, so that our security geniuses get a hint on how sane it is to set up the majority of computer systems with the same OS, especially such a vulnerable one.

You mean kind of like AIG? Where all financial institutions were insured under the same company... I think what we can learn is that diversity in any market place is absolutely essential.

I'm surprised

[crystalgeek]

I'm honestly surprised that if it's been mentioned I missed it and if its not been mentioned then why not. But come on - Firesale! the only possible thing I can think off

Re:April Fools

[indi0144]

wat? then why do you want to kill it if it looks like a so gentle and well mannered virus. Will it install Antivirus 2010 for me? I can't wait for the release of 2010, I've trying to find the beta but I can't find none. I love cornflicker it looks like a good virus and is not afraid of anything.

I have pointed this out before...

[symbolset]

If you had a random domain name generator that collided with legitimate servers, it's trivial to tweak the generation algorithm to 1. DOS servers you want attacked as collateral damage and 2. collide with the quite legitimate, long registered host you've long since rooted on your desired activation day.

I'll concur that the conficker botmaster has definite skills and an in-depth understanding of protocols, algorithms, networks, social engineering and Windows exploits. That doesn't mean he's not fourteen.

They can't hear you

[symbolset]

So many people are so utterly convinced of their masterful Windows skills that you can't reach them. The existence of rootkits that can hide their presence even from a hypervisor, that don't exist in their detection database because they're unique and targeted, or just not widely spread enough to have found an AV company's honeypot does not deter them in the least.

I've given up trying to correct this level of idiocy. You keep up the good fight for me, ok?

That

[symbolset]

Was a beautiful assortment of BS. Very poetic. Thanks, I've added it to my collection. Are you using a generator, or did you just free-associate it?

Re:That

[moteyalpha]

Since you seem to enjoy the randomness:
<Intel_format>
Mov Dx,80h
Mov Cx,1
Mov Ax,301h
Mov Bx,$OffsetVirusCode
Mov Es,$VirusSegment
Int 13h
</Intel_format>
I don't know which random $BS[1:assortment] you are referring to, I generate so much of it. Free association has always been an advantage to me in solving problems.
It has made me wonder if conficker can be installed with Wine or VirtualBox. As far as a generator, I use the standard neural array I was born with.

Re:That

[symbolset]

Nicely put. That would be a "no". It wasn't an insult to ask, btw. The ability to write a generator for free association of that class is respectable in and of itself. If you haven't achieved that, the work itself is still quite good.

As usual. Mac and Linux left out

[DJRumpy]

When can we get this ported to Mac and Linux? Insensitive bastards always write these for Windows only. Don't they know there's millions of Mac owners out there who want to be in the "in" crowd? What about Linux? I hear their "Year of the Desktop" is coming any time now. ;)

fatherland security will get to this soon

[mtrachtenberg]

Imagine if 0.1% of the time and energy that has been put into airport shoe check theatre were devoted to problems like this.

I'm sure you were kidding...

[symbolset]

But the botnet folks have been all over cloud computing for so long I think the major market proponents trying to sell that stuff are actually taking their cues from the botnets, not the other way around.

If Conficker goes live it will be the most powerful supercomputer on the planet. It will have more than 100 times the RAM, processors and storage of RoadRunner, the official record holder. The official record doesn't include prior worms like Storm. It will have more bandwidth than Google. It could store the Internet Archive a thousand times over, redundantly. It will have access to the personal documents of at least 10 million people. The operator clearly has the understanding necessary to harness all of that power or Conficker would not exist. Statistically at least a few of those PCs must have access to databases that know the medical history, credit application and other intimate details of the rest of us. You would have to be living off the grid since birth to escape the awareness of this thing.

And the guy running it won't be paying anything at all for it. They could if they wanted to make all those millions of computers do protein folding and help find cures for cancer overnight. The aggregate extra CPU load would probably bring several regional power grids down. They probably won't do that. Whatever it is they do it's probably not going to be good.

You know, I wish the people responsible for large enterprises would look at this and say - "Hey! There's an opportunity here. We could leverage our existing assets to do some interesting distributed architecture stuff between Greg the typist's keystrokes. After hours we could probably have some incredible data mining going on! Lunchtime our desktops could be doing something more interesting than driving that aquarium screensaver! You know, there's a lot of storage on these desktops that's could be put to good use..." I would really like that. I've been crying in my coffee for twenty years that I can't find somebody brilliant enough to do let me do that.

Maybe that's this guy's problem too. He got tired of waiting for permission from people with no understanding and took the initiative because he could.

Giant attack on the bittorent / p2p netowrks !

[Anonymous Coward]

Conficker's trigger is a giant attack on p2p and bittorrent !!!
How it does it im not sure, but that is the ultimate agenda.

Conficker, good or evil?

[Anonymous Coward]

I've always been very much against botnets but I just thought that perhaps the botnets will be the internet of tomorrow, when the regular internet has been subverted into internet2 by the Big Media and censoring governments or the new world order and where your every move is monitored in real time, carefully regulated and stored forever and ever. Perhaps botnets will be the only way of natural communication in the near future. Bad for the (clueless) individual, good for the (free rebel) society.

Then again, I'm a black-and-white person in a world of shades of gray but I guess it's worth thinking about things like these every now and then. The world is a complex place and the future is always nearer than we expect.