Slashdot Mirror
.CA Registrar Trying To Preempt Conficker
clover kicker writes "The CBC reports that the group managing Canada's .ca internet domain is working to foil an internet worm set to attack starting April Fool's Day. 'This is the first virus that's really focused on domain names as part of propagating the virus itself,' said Byron Holland, CEO of the Canadian Internet Registration Authority, a non-profit organization that represents those who hold a .ca domain. CIRA's strategy includes pre-emptively registering and isolating previously unregistered .ca domain names that Conficker C is expected to try and generate, said a news release issued by the group. That would make those names unavailable for anyone to register in order to set up a website to host the worm's 'command and control' file. A list of the names has been predicted by security experts based on the worm's code. In addition, CIRA is investigating and monitoring activity at names on the list that have already been registered and will 'take appropriate action if suspicious activity is detected.'"
Am I the only one hoping this thing turns out HUGE? It'd be interesting to see what happens.
Got your tin foil hat ready, too? :D
My wife runs MacOS and I have my Linux... I really wish I could get involved in the party. Will Cornfucker run under Wine?
It's like telling your enemy "Hey, I know where and when your going to strike"
We know it's capable to updating itself, this just gives the author an 8 day head start on writing a new pseudo random URL generator.
Anyone knows where can I take the Confiker source code? Must be enlighting!
Mother used to said If you want you find a way But mother never danced through fire shower
is all the worm pops on the screen and does. Now how much money did you spend trying to ward off this script? That will be the real joke.
jsut athnoer menagiensls ltitle psrhae for you to dcoede. Why do we wtsae our tmie dnoig tihs?
No. Conflicker will only download/run cryptographically signed code.
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
Look, we don't hate you for what you write - it may well be true. It just has nothing to do with this story, OK? It really is offtopic. In fact I agree with a lot of what you wrote (and disagree with some twisted facts too) but I think the moderators are right modding you down to hell, and maybe banning your IP range. You are annoying people. Annoyed people don't listen. Find a forum to discuss this in a sane way and people might listen.
I saw the article today on CBC (Canada's equivalent of the BBC).
This effort may help, but given that the worm has so many other TLDs to choose from, it may not help much. Making the 110 TLDs only 109 (or even 75 if other TLD authorities do the same) will not help that much.
Moreover, there is another mechanism which is not very clear, whereby the infected nodes will contact each other via a See Peer to Peer protocl. So, once the botnet gets going, the need for the domain name (so called "Internet Rendevouz points") may diminish.
Also, the article contains some inaccuracies:
Actually, the worm author(s) are aware that the user may change the clock of the PC to avoid the worm from triggering. So they query several well known sites and check the date/time on the HTTP headers to make this defense point moot. See Internet Date Checking
It will query only 500 out of 50,000 generated domain names. See the domain generation algorithm.
I bet there will be a revision D shortly before April 1st, and the author(s) will address many of the potential defenses in revision C.
2bits.com, Inc: Drupal, WordPress, and LAMP performance tuning.
I think I've heard every lexically significant variation on the name of this damn worm by now. I have no idea what "Conficker" actually means or to what it refers, but so far on this thread people have called it "Conflicker," "Cornflicker," and best of all "Cornfucker."
I think another name for it is "Downadup," which I always read as either "Downandup" or "Download a Duplicate."
Who gets to name the worms? We know that this one employs neat tricks like code signing peer-to-peer driven software updates and that it might be used for a sort of "evil Google" that people can use to data mine financial stuff and so on. Couldn't we lobby for a more rational taxonomy, so we could call this one "Cryptographically Labyrinthine Internet-Traveling ORganized Information Stumbler?"
now I'd subscribe again for that. It would have to be lottery style or something mad random... way too many trolls out there with too much time on their hands.
Walk with Music;
It's cute that they're trying to preempt the worm, but to be effective they pretty much have to disable ALL potential domains. Miss one, and the worm will find it.
What I don't get is how people can still be surprised/impressed/scared by these things. Today's viruses have little in common with their elegant, obfuscated ancestors. Any twit can assemble a "virus" by tapping into the OS' libraries. Today's worms are essentially package managers, so anything you can do with legitimate software like emailing, flashing your BIOS or opening ports on your firewall, a virus can do the same things. It simply has to talk to its software repository, pull down the pieces it needs and proceed with its dirty deeds.
Hell, a tiny perl script could turn standard tools like Yum and Emerge into virus delivery agents. They already possess all the required functionality...
-Billco, Fnarg.com
I know I shouldn't feed the trolls, but if these people who "analyzed" it only know what they've been able to observer or provoke it to do. I must have missed where they completely reverse engineered it and created a fix.
They figured out 1 of a myriad of its activities and service mediums let alone been able to crack one of its control channels. I'm all for fighting the good fight, but saying we understand this or have analyzed it thoroughly is naive.
Walk with Music;
Isn't one of the root causes of all this the fact that the exploit was released into the wild? I am highly against it every time I see one of the security "researchers" releasing these holes into the public knowledge base. Had this exploit been kept quiet with Microsoft rolling out an important update that quietly patched it I believe we wouldn't be in this situation.
It's like someone announcing on a street corner that the bricks on the south wall of a bank were found to be very thin, but don't worry... we'll get to adding a little more mortar soon enough. Don't any body make use of this information though as that wouldn't be nice of you.
I understand the concept of motivating the software manufacturers to move on fixing bugs but is this really a worthwhile outcome to achieve this goal? I tend to believe if some "researchers" hadn't just kept their mouths shut and found alternate means to have this dealt with April 1 would still only be "Fool's Day".
I also suspect that some of these "information releases" are often done for ulterior motives as well. Possibly to say "look at what I found" and quite possibly to just watch the target OS/product go down vs. your alternate favourite OS/product.
I am not an expert on Conficker's exact history nor this specific exploit, but I do feel my comments above are generally accurate to many announced exploits in general.
Play me online? Well you know that I'll beat you. If I ever meet you I'll "/sbin/shutdown -h now" you. -Weird Al, kinda.
Maybe ACs should be disabled until at least 30 comments are written or something...
Quick way to get 30% Funny 70% Troll: defend Opera browser on
> Isn't one of the root causes of all this the fact that the exploit was released into the wild?
Yes and no.
In the bad old days before full disclosure, vendors would threaten security researchers. That lead to the bad guys knowing everything and being able to hack with impunity, the security researchers being considered the "bad guys" even though they weren't doing anything bad with the holes they found, and the general public being totally ignorant of all the security problems out there.
In other words, back when no one called out the vendors putting out shoddy products, all we had were shoddy products.
So the practice of not disclosing security vulnerabilities actually hurts the good guys far more than it hurts the bad guys, even if it sometimes leads to cases like this one.