Slashdot Mirror
.CA Registrar Trying To Preempt Conficker
clover kicker writes "The CBC reports that the group managing Canada's .ca internet domain is working to foil an internet worm set to attack starting April Fool's Day. 'This is the first virus that's really focused on domain names as part of propagating the virus itself,' said Byron Holland, CEO of the Canadian Internet Registration Authority, a non-profit organization that represents those who hold a .ca domain. CIRA's strategy includes pre-emptively registering and isolating previously unregistered .ca domain names that Conficker C is expected to try and generate, said a news release issued by the group. That would make those names unavailable for anyone to register in order to set up a website to host the worm's 'command and control' file. A list of the names has been predicted by security experts based on the worm's code. In addition, CIRA is investigating and monitoring activity at names on the list that have already been registered and will 'take appropriate action if suspicious activity is detected.'"
Except nobody is in the driver seat at the moment.
This is a way of trying to keep anyone from stepping in.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
Am I the only one hoping this thing turns out HUGE? It'd be interesting to see what happens.
Got your tin foil hat ready, too? :D
My wife runs MacOS and I have my Linux... I really wish I could get involved in the party. Will Cornfucker run under Wine?
It's like telling your enemy "Hey, I know where and when your going to strike"
We know it's capable to updating itself, this just gives the author an 8 day head start on writing a new pseudo random URL generator.
Anyone knows where can I take the Confiker source code? Must be enlighting!
Mother used to said If you want you find a way But mother never danced through fire shower
is all the worm pops on the screen and does. Now how much money did you spend trying to ward off this script? That will be the real joke.
jsut athnoer menagiensls ltitle psrhae for you to dcoede. Why do we wtsae our tmie dnoig tihs?
Can't somebody just upload their own code to one of said targeted sites? From what I've heard, the virus checks all sites on its list. So anyone could just upload some code to disable the virus, assuming it contacts their site first. Other than the fact that it's probably illegal to do that, even to disable the virus, why hasn't anyone tried this? Like in another country where it wouldn't be illegal? I'd imagine that no one would push for a criminal case against someone who stopped the worm...
01110000 01010111 01101110 00110011 01100100
Look, we don't hate you for what you write - it may well be true. It just has nothing to do with this story, OK? It really is offtopic. In fact I agree with a lot of what you wrote (and disagree with some twisted facts too) but I think the moderators are right modding you down to hell, and maybe banning your IP range. You are annoying people. Annoyed people don't listen. Find a forum to discuss this in a sane way and people might listen.
I saw the article today on CBC (Canada's equivalent of the BBC).
This effort may help, but given that the worm has so many other TLDs to choose from, it may not help much. Making the 110 TLDs only 109 (or even 75 if other TLD authorities do the same) will not help that much.
Moreover, there is another mechanism which is not very clear, whereby the infected nodes will contact each other via a See Peer to Peer protocl. So, once the botnet gets going, the need for the domain name (so called "Internet Rendevouz points") may diminish.
Also, the article contains some inaccuracies:
Actually, the worm author(s) are aware that the user may change the clock of the PC to avoid the worm from triggering. So they query several well known sites and check the date/time on the HTTP headers to make this defense point moot. See Internet Date Checking
It will query only 500 out of 50,000 generated domain names. See the domain generation algorithm.
I bet there will be a revision D shortly before April 1st, and the author(s) will address many of the potential defenses in revision C.
2bits.com, Inc: Drupal, WordPress, and LAMP performance tuning.
I think I've heard every lexically significant variation on the name of this damn worm by now. I have no idea what "Conficker" actually means or to what it refers, but so far on this thread people have called it "Conflicker," "Cornflicker," and best of all "Cornfucker."
I think another name for it is "Downadup," which I always read as either "Downandup" or "Download a Duplicate."
Who gets to name the worms? We know that this one employs neat tricks like code signing peer-to-peer driven software updates and that it might be used for a sort of "evil Google" that people can use to data mine financial stuff and so on. Couldn't we lobby for a more rational taxonomy, so we could call this one "Cryptographically Labyrinthine Internet-Traveling ORganized Information Stumbler?"
Incorrect... someone is most certainly in the driver seat. Botnets aren't autonomous sytems that spawn out of control. They are replicated and controlled spawned instances, nodes or bots in a net mind you, doing whatever whomever is pulling the strings would like.
Walk with Music;
Sound like this worm has some significant financial backing. Whats even more crazy is a patch has been sent out for the worm already by Microsoft and people are still having issues.
now I'd subscribe again for that. It would have to be lottery style or something mad random... way too many trolls out there with too much time on their hands.
Walk with Music;
Yeah, you know how they control this one?
BY THE MECHANISM .CA IS TRYING TO THWART YOU FUCKING RETARD.
Why the HELL did you feel qualified to comment on this?
i shit out an obama, stimulus plan and all!
plop!
As far as who I am to comment on it, well... I'm someone who's commenting on it.
Walk with Music;
'no.' Let the show begin.
It's cute that they're trying to preempt the worm, but to be effective they pretty much have to disable ALL potential domains. Miss one, and the worm will find it.
What I don't get is how people can still be surprised/impressed/scared by these things. Today's viruses have little in common with their elegant, obfuscated ancestors. Any twit can assemble a "virus" by tapping into the OS' libraries. Today's worms are essentially package managers, so anything you can do with legitimate software like emailing, flashing your BIOS or opening ports on your firewall, a virus can do the same things. It simply has to talk to its software repository, pull down the pieces it needs and proceed with its dirty deeds.
Hell, a tiny perl script could turn standard tools like Yum and Emerge into virus delivery agents. They already possess all the required functionality...
-Billco, Fnarg.com
And how does hiring ELIZA make you feel?
Can you expand on that?
Are you sure?
I know I shouldn't feed the trolls, but if these people who "analyzed" it only know what they've been able to observer or provoke it to do. I must have missed where they completely reverse engineered it and created a fix.
They figured out 1 of a myriad of its activities and service mediums let alone been able to crack one of its control channels. I'm all for fighting the good fight, but saying we understand this or have analyzed it thoroughly is naive.
Walk with Music;
Have you tried OS-X or Ubuntu? I heard they're not prone to this sort of thing.
Help stamp out iliturcy.
You are just *SO* cute? Would you like to tell me about DRM and Open Office, too?
This has to be the most comprehensive spamming I've seen on this site for a while.
Semi-automatic amateur armchair Australian philosopher; conjecture ready at any moment...
Isn't one of the root causes of all this the fact that the exploit was released into the wild? I am highly against it every time I see one of the security "researchers" releasing these holes into the public knowledge base. Had this exploit been kept quiet with Microsoft rolling out an important update that quietly patched it I believe we wouldn't be in this situation.
It's like someone announcing on a street corner that the bricks on the south wall of a bank were found to be very thin, but don't worry... we'll get to adding a little more mortar soon enough. Don't any body make use of this information though as that wouldn't be nice of you.
I understand the concept of motivating the software manufacturers to move on fixing bugs but is this really a worthwhile outcome to achieve this goal? I tend to believe if some "researchers" hadn't just kept their mouths shut and found alternate means to have this dealt with April 1 would still only be "Fool's Day".
I also suspect that some of these "information releases" are often done for ulterior motives as well. Possibly to say "look at what I found" and quite possibly to just watch the target OS/product go down vs. your alternate favourite OS/product.
I am not an expert on Conficker's exact history nor this specific exploit, but I do feel my comments above are generally accurate to many announced exploits in general.
Play me online? Well you know that I'll beat you. If I ever meet you I'll "/sbin/shutdown -h now" you. -Weird Al, kinda.
Maybe ACs should be disabled until at least 30 comments are written or something...
Quick way to get 30% Funny 70% Troll: defend Opera browser on
maybe. there has to be a happy medium somehow.
"If for any reason you're not satisfied with our service, I hate you."
Heard of decompiling? eh? THEY know EXACTLY, what it does and can do.
Well, it could be changed just as easily. .ca domain, the controller can easily avoid hitting the previously predicted names, and either avoid .ca (very easy), or generate new names.
If you already own a control server, you can also 'update' your zombies.
By telling that they will monitor the
Patents Drive Free Software as Hurricanes Drive Construction Industry
CIRA is the registrY for the .ca ccTLD, and is the manager for the entire domain name space, selling domains "wholesale" to registrARs, which sell them "retail" to the public. Come on, the CBC got it right, can't /.?
"This has to be the most comprehensive spamming I've seen on this site for a while."
I wouldn't mind so much if he/she made decent use of white space. I can't even read it without my eyes twisting up.
I reserve the write to mangle english.
Sometimes a regular poster says something that could be held against him by his company/government/stepmother. It is occasional, but the 1% of times it is used for insightfulness is worth the 99% it is used for trolls. Just browse at +1 if you are really annoyed. Don't look at it and it will go away. Slashdot used to have far more noise in the -1 realm.
The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
> Isn't one of the root causes of all this the fact that the exploit was released into the wild?
Yes and no.
In the bad old days before full disclosure, vendors would threaten security researchers. That lead to the bad guys knowing everything and being able to hack with impunity, the security researchers being considered the "bad guys" even though they weren't doing anything bad with the holes they found, and the general public being totally ignorant of all the security problems out there.
In other words, back when no one called out the vendors putting out shoddy products, all we had were shoddy products.
So the practice of not disclosing security vulnerabilities actually hurts the good guys far more than it hurts the bad guys, even if it sometimes leads to cases like this one.
You read it? you are a sadomachist
Semi-automatic amateur armchair Australian philosopher; conjecture ready at any moment...
Oh probably. Do you think they'll be able to channel an answer?
If you believe everything you read, you'd better not read. - Japanese proverb
R-I-D-I-C-U-L-O-U-S
Achille Talon
Hop!
I've registered 3 .ca domain names, and not encountered any sort of problems or difficulties. At all.
I don't know which .ca registrar you're dealing with, but the ones I've dealt with are fine.
Does it make you happy you're so strange?
This is almost as good as mad libs!
"That which does not kill us makes us stranger." -Trevor Goodchild
Why not see who registers the domains _and_ supplies downloads to existing bots?
Obviously the people who created this worm won't be stupid about it, but perhaps some clues could be gathered.
And if it gets really hard, maybe the guys from 24 or CSI can put one of their top people on it. They seem to do amazing things in figuring out multiple levels of hiding...
Why don't they just instruct the worm to upload an executable that will delete the worm and then itself? Or if the previous is no possible due to authentication built in they could cause a buffer overun in the worm. Maybe they could even use the buffer overun to delete or damage the worm so it can't run again.