Taming Conficker, the Easy Way

Dan Kaminsky writes "We may not know what the Conficker authors have in store for us on April 1st, but I doubt many network administrators want to find out. Maybe they don't have to: I've been working with the Honeynet Project'sTillmann Werner and Felix Leder, who have been digging into Conficker's profile on the network. What we've found is pretty cool: Conficker actually changes what Windows looks like on the network, and this change can be detected remotely, anonymously, and very, very quickly. You can literally ask a server if it's infected with Conficker, and it will give you an honest answer. Tillmann and Felix have their own proof of concept scanner, and with the help of Securosis' Rich Mogull and the multivendor Conficker Working Group, enterprise-class scanners should already be out from Tenable (Nessus), McAfee/Foundstone, nmap, ncircle, and Qualys. We figured this out on Friday, and got code put together for Monday. It's been one heck of a weekend."

Comments

Wow!

[MrNaz]

Wow. So this:

IT tech: Do you know if your workstation has a virus?
User: I don't know. It might. The other day I was typing something and something popped up I can't remember what it said but I think it had something to do with virus scanners but I can't remember and then there was this time I downloaded this thing and it said something about my computer being infected but I can't remember if I clicked it or not and then another one [etc etc etc for 20 minutes]

Which would happen once for every node on the network, would become this:

root@admin:~$ nmap 192.168.0.* -confickercheck

Nice. Seriously, nice. Now we just need to work out a way to remotely ask a computer if the printer cable is properly plugged in, and we're set.

Re:Wow!

[interested pyro]

Now we just need to work out a way to remotely ask a computer if the printer cable is properly plugged in, and we're set.

Its called getting someone else to get on their hands and knees to check it! i do it all the time! and on the worm thing, OK so you know that the comp is infected. Now how to remove it....

Re:Wow!

[Zsub]

rm -rf /*

Re:Wow!

[interested pyro]

rm -rf /*

for a sec i thought u said

rm -rf /.

lols at that....

Re:Wow!

[ivansanchez]

Now we just need to work out a way to remotely ask a computer if the printer cable is properly plugged in, and we're set.

ssh + lsusb + grep...

Re:Wow!

[fuzzyfuzzyfungus]

If only the users who leave their printers unplugged habitually used linux...

To be fair, you can do something similar in Windows; but it sure isn't the soul of wit.

Re:Wow!

[Anonymous Coward]

C:\> lsusb
Bad command or filename.
C:\>

:(

Re:Wow!

[lga]

I don't know about you, but on my network I run a centrally administered virus scanner. It seems quite a bit easier than asking every user!

Re:Wow!

[morgan_greywolf]

If only all malware was this easy to detect. Unfortunately, despite the proliferation of automatic virus scanners, "firewalls," and various other techniques, infections still occur.

The main problem is the current monoculture in desktop operating systems. No matter what you think of Microsoft, no matter what you think of Windows, you have to admit that having 90% marketshare of a single OS on desktop operating systems is the biggest part of the problem. The second biggest part of the problem was not designing network security into the OS from day one, but instead attempting to bolt it on on an OS that has always been designed to be a highly integrated one-size-fits-all solution.

Re:Wow!

[Binestar]

You'll want to exclude at least /dev and /proc from that command if you want it to complete. I actually just prefer dd for ease of destruction.

Re:Wow!

[Anonymous Coward]

"rm -rf /*" does not remove "/.conficker"

"rm -rf /." (or just "rm -rf /") does.

Re:Wow!

[drsmithy]

The second biggest part of the problem was not designing network security into the OS from day one, but instead attempting to bolt it on on an OS that has always been designed to be a highly integrated one-size-fits-all solution.

How is "network security" any more (or less) "bolted on" in Windows NT vs UNIX (or Linux) ?

What exactly do you mean by "network security" ?

Re:Wow!

[Locklin]

Somehow I think that command would selectively work on the uninfected machines, and fail on the infected ones.

Re:Wow!

[cbiltcliffe]

If you have even half-assed antivirus in a corporate environment, you'll be able to log into the admin console, and see what machines are infected.
You can also see when a machine was last in contact with the controller, so if a virus kills the A/V on a machine, it will stop contacting. Anything that's been over a week since contact automatically should be physically investigated.

Of course, you could be using Norton Internet Security 2009 on your corporate machines, which doesn't have this capability. But if you are, you're an incompetent moron, and shouldn't be trusted with a Gameboy, forget a multi-computer corporate network.

Re:Wow!

[Anonymous Coward]

Noone said that network security isn't "bolted on" in UNIX.

But there are other machines which are definately invulnerable to the attack methods used by worms like conficker (typically modifying program flow by injecting executable code and altering address pointers, so the injected code will be executed).

For example, IBM's AS/400 / iSeries 400 / eServer i5 (/ or whatever the name is today) has built-in (hardware-supported) pointer protection and separate address-stack and data-stack.
Actually, that is the reason why the CPUs are sometimes called "65-bit CPUs" instead of "64-bit CPUs" - the 65th bit is a tag flag (in memory, it's stored in the ECC area).

The details can be read in the book "The Inside Story of the IBM iSeries" by Frank G. Soltis.

What we really need are machines which can prevent viruses and/or worms BY DESIGN and IN ADVANCE, instead of reacting by means of virus scanners, patches and removal tools AFTER something went wrong.

Re:Wow!

[Pvt_Ryan]

I use Antivirus360 on my network, my last scanner was shit, the Antivirus360 free trial found loads of infections my other scanner missed..

Re:Wow!

[hesaigo999ca]

What about those worms or trojans or viruses that have built in rootkits, therefor avoid being detected by most AV programs?

Re:Wow!

[morgan_greywolf]

Noone said that network security isn't "bolted on" in UNIX.

Correct. Parent is reading something I never said.

What we really need are machines which can prevent viruses and/or worms BY DESIGN and IN ADVANCE, instead of reacting by means of virus scanners, patches and removal tools AFTER something went wrong.

Exactly. And we don't need anything nearly as complicated, baroque, or elitist as 'TPM' or 'Trusted Computing'. Simply designing-in protection from buffer overlows and code injection from the get-go will help a lot. In addition, desktop operating systems should not ever be designed in such a way that the person using the thing is always administrator. Vista almost, but not quite, solves this problem. *nix almost has this right, and is closer, but sudo is too baroque. And on any system, there should be no avenues for processes to ever escalate themselves to 'root'. That should just be designed-in from day one.

Re:Wow!

[gzipped_tar]

Assuming you are using BASH, enabling the shopt "dotglob" may be helpful if you want the * glob to expand to dot-files.

Re:Wow!

[drsmithy]

Correct. Parent is reading something I never said.

Indeed. Apologies, I had just come from reading something else making the comparison.

(I still want to know how "network security" is "bolted on", however.)

Exactly. And we don't need anything nearly as complicated, baroque, or elitist as 'TPM' or 'Trusted Computing'. Simply designing-in protection from buffer overlows and code injection from the get-go will help a lot.

TPM isn't there to prevent buffer overflows and code injection, it's there so you can be sure that a piece of signed code is what it claims to be. A big objective of TPM is to reduce exposure to trojans (which a large proportion of "worms" and "viruses" really are) by allowing the user to make a better decision as to whether or not to trust a given piece of code.

Re:Wow!

[Anonymous Coward]

Hey, you're one of those condescending Unix users.

Re:Wow!

[_Sprocket_]

Exactly. And we don't need anything nearly as complicated, baroque, or elitist as 'TPM' or 'Trusted Computing'. Simply designing-in protection from buffer overlows and code injection from the get-go will help a lot.

TPM isn't there to prevent buffer overflows and code injection, it's there so you can be sure that a piece of signed code is what it claims to be.

Again - I don't believe the OP claimed that TPM would deal with buffer overflows and code injection. That's your interpretation. What it does claim is that dealing with those would be better solutions than implementing TPM. As for what TPM does... at best, it might tell you who's key signed that code.

Re:Wow!

[drsmithy]

Again - I don't believe the OP claimed that TPM would deal with buffer overflows and code injection. That's your interpretation.

Well, given that the comment goes, in the same paragraph, from talking about TPM to talking about buffer overflows, the interpretation hardware seems unreasonable.

What it does claim is that dealing with those would be better solutions than implementing TPM.

This is a bit like saying dealing with icy roads would be a better solution than implementing airbags.

As for what TPM does... at best, it might tell you who's key signed that code.

Which is a substantial improvement over the current situation, and a useful part of defense in depth. Where's the problem ?

Re:Wow!

[cbiltcliffe]

I just had a rootkit infection on a machine I was working on for a customer this morning. They were running no A/V software...just AVG Antispyware.

Installed Avast Free, and it detected the hidden rootkit files using heuristic scans, with the realtime scanner, no less.

Is it foolproof? No, probably not. But since Avast has a managed network version, I'd have no problem installing this on a customer's business network. In fact, I have, a few times.

If the big boys can't do the same kind of detection, then they have no business being in the antivirus industry.

Re:Wow!

[Mr. Foogle]

We do have a corporate AV. It's pretty good.

Problem is that thanks to SarbOx we've broken functions down. Only a select few admins can login and do things to the AV scanner.

Re:Wow!

[drsmithy]

Well, given that the comment goes, in the same paragraph, from talking about TPM to talking about buffer overflows, the interpretation hardware seems unreasonable.

s/hardware/hardly/

Re:Wow!

[hesaigo999ca]

Avast is not the best of the best either, so I am inclined to agree that others will have this type of verification as well.

Re:Wow!

[Anonymous Coward]

Um... when you say "bolt on security"... aren't you in fact talking about the DOS versions of Windows? (3.x, 9x, ME).

As I recall, security was a HUGE concern, thus NT was born... ACL's were put into place, isolation occurs within the kernel and application space.

The issue, is and has been backwards compatibility... Anyone who had to deal with migration from 3.1 to 95 can see what *real* backwards compatibility issues looked like... we still deal with it from time to time (XP > Vista), but it's been a huge focus for a *long* time.

Unfortunately, there's no easy way to guarantee success in upgrading, thus .Net supports side-by-side versions (installed in the GAC, and in execution as of 2.0).

Many people have speculated that the best approach would be to drop compatibility requirements, but just as with the XP SP2 update (regarding the firewall), the public will display outrage when "things don't work like they used to" trying to run their Win95 game on Vista.

Re:Wow!

[blhack]

What AV scanner are you using?

I have a small network, and use ClamWin on the windows boxes. It runs a full scan nightly and emails me if it sees anything fishy.
I've been looking for a better solution, but googling seems to turn up lots of marketing cruft.

Re:Wow!

[deets101]

I use Antivirus2009, which is GREAT!!! I didn't even have to install it, it just appeared on my PC after being hit by 20 viruses my other antivirus software missed.

Re:Wow!

[_Sprocket_]

Well, given that the comment goes, in the same paragraph, from talking about TPM to talking about buffer overflows, the interpretation hardware seems unreasonable.

Except for the fact that it says we don't need one, the other would be a better approach. Nowhere was it saying they both did exactly the same thing. Context is pretty important here.

This is a bit like saying dealing with icy roads would be a better solution than implementing airbags.

OK. Sure. And there's nothing wrong with that. We're talking about dealing with an underlying problem. There's different ways of dealing with a problem. That some attack it from different angles is expected. That some angles might be better than others is also reasonable.

As for what TPM does... at best, it might tell you who's key signed that code.

Which is a substantial improvement over the current situation, and a useful part of defense in depth. Where's the problem ?

The problem is this quote:

TPM isn't there to prevent buffer overflows and code injection, it's there so you can be sure that a piece of signed code is what it claims to be.

I'm sure you don't really believe, with proper consideration, that TPM really ensures that a piece of code does what it claims to. But the reaction is to start getting in to that mindset - which is wrong. And that's not even touching on whether you can trust TPM working for or against you.

Having said that - this isn't a debate on the merits of TPM. Suffice to say that it's not the same way to attack the fundamental issue. And while it is valid in it's own right, it isn't beyond criticism.

Re:Wow!

[slapout]

"If you have even half-assed antivirus in a corporate environment..."

If you have one of those, why are you even infected with a virus in the first place?

Re:Wow!

[Anonymous Coward]

Hey, you're one of those condescending Unix users.

an unfunny cliched condescending Unix loser.

Re:Wow!

[Godji]

The -f will skip over anything that can't be done, you know.

Re:Wow!

[Jamie's Nightmare]

The main problem is the current monoculture in desktop operating systems.

That's a great argument, until you flip it over and look at the other side. Linux offers good security because it's more obscure. Then you get an instant backlash from the *nix croud.

Re:Wow!

[Anonymous Coward]

Perhaps, dumbshit, you should learn to spell the word 'you'.

Your right. Sorry, I'll be proofreading my posts from now on.

Re:Wow!

[sjames]

In a business, yes. For an ISP dealing with a bazillion different customers, no.

Re:Wow!

[dotgain]

True, but then one shouldn't be posting the command publicly, since it would depend on non-default options to work correctly. Same sort of thing as aliasing 'rm' to be something less harmful, causes lazy and sometimes dangerous habits that lead to nasty surprises on unfamiliar systems.

The whole point's moot anyway, since you'd never usually remove every file on a filesystem, might as well mkfs/newfs/format it and proceed to reuse it.

Re:Wow!

[Binestar]

The -f will skip over anything that can't be done, you know.
 
What happens when your HD node is deleted from /dev? I'll answer that for you: No more deleted files. Everything prior to it getting to /dev is gone, but the rest is left. By going directly to the device with DD you'll complete the overwrite.

Re:Wow!

[Anonymous Coward]

I knew it!!!!!!

There must have one reason for me to love this old green faced bastard!!!!!

Re:Wow!

[drsmithy]

Except for the fact that it says we don't need one, the other would be a better approach. Nowhere was it saying they both did exactly the same thing. Context is pretty important here.

But the alternatives offered do nothing to provide the same functionality as TPM. Which was my point.

OK. Sure. And there's nothing wrong with that. We're talking about dealing with an underlying problem. There's different ways of dealing with a problem. That some attack it from different angles is expected. That some angles might be better than others is also reasonable.

No. You've missed my point. The two have nothing to do with each other, because they fundamentally solve different problems, even though the solutions sometimes overlap.

I'm sure you don't really believe, with proper consideration, that TPM really ensures that a piece of code does what it claims to.

I never claimed that it did.

And that's not even touching on whether you can trust TPM working for or against you.

TPM is a tool. It can no more work "for you" or "against you" than your dishwasher.

Re:Wow!

[Shadowruni]

Ummm... maybe you don't have a choice. In REALLY large companies, you use what you're told after the Six Sigma process that determined a better product is ignored and the one that we have a deal with is choosen over all competent IT protest.

/jaded? nahhhh, I'm a realist.

Re:Wow!

[BenoitRen]

Actually, most infections today occur thanks to social engineering. The biggest liability is still what's between the keyboard and the chair.

Re:Wow!

[XMode]

Well bully for you. We run endpoint, so its totally pointless asking it anything as it doesn't know.

Re:Wow!

[rusl]

Conficker has infected *nix now?

Re:Wow!

[rusl]

Yeah, dd is fast. I was trying to zero a partition and I typed the wrong device name. Fortunately it was the root of a new test install and not something valuable. I realised my mistake in about 5 seconds but that was way too long.

Re:Wow!

[jeroen94704]

>Now we just need to work out a way to remotely
>ask a computer if the printer cable is properly
>plugged in

Or the power cable, but that might be more problematic.

Re:Wow!

[_Sprocket_]

No. You've missed my point. The two have nothing to do with each other, because they fundamentally solve different problems, even though the solutions sometimes overlap.

I can agree with that. Although I don't believe TPM is presented in that manner all the time. Often, it is touted as the solution to the very same overall issues. In this case, dealing with malware.

I'm sure you don't really believe, with proper consideration, that TPM really ensures that a piece of code does what it claims to.

I never claimed that it did.

Maybe I misunderstood when you said "it's there so you can be sure that a piece of signed code is what it claims to be."

And that's not even touching on whether you can trust TPM working for or against you.

TPM is a tool. It can no more work "for you" or "against you" than your dishwasher.

When I control the dishwasher, the tool is working for me. When someone else is controlling the dishwasher, the tool is working for them. And TPM has absolutely no resemblance to a dishwasher.

Re:Wow!

[Anonymous Coward]

For any who missed it (as parent apparently did) the byplay is a reference to a Dilbert, I spotted it at http://www.perturb.org/display/entry/462/

Re:Wow!

[Ant P.]

What happens when your HD node is deleted from /dev?

It'll disappear from the visible filesystem and have no effect whatsoever on an `rm` command that deletes it, which will happily go on to kill the rest of your directory tree.

/dev # mkdir root_disk.bak && cp -a sda* root_disk.bak && rm -rf sda*
/dev # ls sda*
ls: cannot access sda*: No such file or directory
/dev # mv root_disk.bak/sda* . && rmdir root_disk.bak/ && ls sda*
sda sda1 sda2 sda3 sda4 sda5 sda6 sda7

Re:Wow!

[badkarmadayaccount]

[root@machinegun ~/]$ killall users

Re:Wow!

[badkarmadayaccount]

Lights Out Management Card FTW!

i find it so hard

[nimbius]

to genuinely care about the hype surrounding this worm when no one knows what its destined to do, and the problem stems from a host operating system with a near two decade track record of this sort of stuff.

Re:i find it so hard

[new death barbie]

There is a virus infecting a huge number of systems and no one knows what it is destined to do.

Seems like a pretty GOOD reason to genuinely care, if you ask me.

Re:i find it so hard

[Anonymous Coward]

Hi, I'm the author of Conficker and the payload is to get a first post on slashdot. Get ready assholes.

Re:i find it so hard

[fuzzyfuzzyfungus]

While I agree that caring about the poor widdle windows users is a boring hobby, there are reasons for it.

First, most of the "what will conficker do?" possibilities have the distinct potential to be unpleasant for everybody. We are almost definitely looking at extra spam, or worse.

Second, and ultimately more important, is the fact that Joe and Jane Average's feelings about computers and the internet are defined largely by a combination of their experiences with computers at home and at work, and stories in the media about computers. If their experience is one of unrelenting danger, constant infection, and identity theft and whatnot, they'll be much more supportive of draconian policy decisions. That is Bad.

Sure, actually caring about the newbs, as they do the same stupid things over and over, gets really old really fast; but, when they visit the internet, I want them to have a good time because we are well past the point where they will just leave if they don't like it. They'll vote for a bunch of police powers and be back. Nobody wants that.

Re:i find it so hard

[FTWinston]

My own pet theory (based on nothing but speculation) is that come April 1st, nothing will happen. And then someone will wave their hand and say "hey, I made conflicker" and get rich from interviews, while the rest of us giggle at the hilarity of this massively-hyped april fool.

Re:i find it so hard

[Ralish]

to genuinely care about the hype surrounding this worm when no one knows what its destined to do, and the problem stems from a host operating system with a near two decade track record of this sort of stuff.

A few things:

1. If you have 1 million+ infected hosts, and all the bandwidth that these hosts have access to, and can use these resources to do whatever you please, you pose a serious threat to many groups with a presence on the internet and an interest in its wellbeing. Do I really need to spell it out to you why it's important to care?

2. No, the problem in this case stems from people not patching their systems when security updates are made available. Microsoft made the patch available _LONG_ before Conficker was even a problem. Microsoft released the patch on 15th October 2008. What does this tell you? It means that effectively 99%+ of infected machines are infected because they weren't patched, either due to ignorance, sloth, or a combination of.

If I never patched my Linux/BSD servers when security flaws were discovered, they'd be rooted pretty fast too. Fortunately, most of the OSS community knows that security patches are important and need to be applied, not ignored. Elements of the Windows world don't share this culture, and it needs to change, so that worms like Conficker aren't able to thrive.

Re:i find it so hard

[Anonymous Coward]

I learned my lesson the hard way about keeping things patched. The other week I ran microsoft update on my mums laptop and it "broke it" by running Genuine Advantage - Outlook kept telling her to pay some money to some company (Microsoft), and then crashing with an unrecognised opcode error. At least it didn't say it was performing some illegal activity (like microsoft error messages used to do). It would have been easier to leave it unpatched.

Re:i find it so hard

[Ralish]

In fact, having double checked my information, the security patch that fixes the vulnerability that Conficker exploits was released prior to the creation and subsequent distribution of Conficker.

So, every single computer out there with a Conficker infection due to the exploit infection route could have been secured if patched. I would bet that would make for a gigantic reduction in the size of the Conficker botnet.

Re:i find it so hard

[k.a.f.]

There is a virus infecting a huge number of systems and no one knows what it is destined to do.

Seems like a pretty GOOD reason to genuinely care, if you ask me.

Not really... we can be reasonably sure that Conficker is designed to do what the previous five generations of worms did, only more effectively: provide nodes of a botnet for hire, so criminals can send spam, threaten DDOS attacks etc. It's annoying, but the internet lives on. Why would the purpose suddenly become radically different just because the implementation has been improved?

Re:i find it so hard

[morgan_greywolf]

Hi, I'm the author of Conficker and the payload is to get a first post on slashdot.

That's it? You wrote a worm to get a first post on Slashdot? Damn. How lame are you?

Re:i find it so hard

[Anonymous Coward]

Windows NT has only existed for a little under 16 years; not quite two decades.

Re:i find it so hard

[bistromath007]

Haven't you ever played Uplink? It is in the nature of virus creators to attempt to destroy the Internet.

Re:i find it so hard

[h4rm0ny]

If this is the aim, why would it make sense for the worm to have a grand activation date, rather than just increasing the size of the botnet as fast as it can? Time is money, and if there are as many infected machines as its thought there are, then this is just wasted opportunity since it was released into the wild.

Genuine question. Maybe in its inactive state it makes it harder to trace and shutdown? But if not, it seems that if the purpose is a botnet it would be better to have it working as such from the get go.

Re:i find it so hard

[Lumpy]

Because it was created for E V I L ?

I think it's going to cause all computers to turn into a small thermonuclear bomb (that's what computers are made of, plutonium and Selenium!) and destroy the planet in the name of some stupid reason.

WE ARE ALL GOING TO DIE!!!! PLEASE START PANICKING NOW!

I'm already looting the vending machines in the lunch room and built a bunker near them with boxes of last years TPS reports, the recycling buckets make good helmets.

And they all said I over-react. Who's the fool now!

Re:i find it so hard

[merrickm]

What always confuses me about these things is how this many computers end up unpatched. Automatic updating regularly is the default behavior of Windows, isn't it? So the users must be turning it off. Why? Who knows how to stop security patches from installing who doesn't also know why not to? Are all of these Conficker infectees business computers whose network admins turned the security updates off?

Re:i find it so hard

[Dystopian Rebel]

There is a virus infecting a huge number of systems and no one knows what it is destined to do.

Sir, if everyone followed your paranoid, alarmist thinking, then we'd all be afraid of Microsoft Windows itself.

Oh wait...

Re:i find it so hard

[Lobster Quadrille]

I'll be honest, while normally the first post thing is pretty lame, writing a badass virus to do it would strike me as pretty cool and delightfully overkill.

Re:i find it so hard

[Lobster Quadrille]

Actually, it's just a conspiracy from all of us security-types. We haven't had a good global-scale emergency in a while and were getting a bit bored.

There really is no a conficker. In fact, the name itself is an anagram for "Dan Kaminsky pwns joo"

Re:i find it so hard

[Anonymous Coward]

All my MS win(xp,vista) instillations are unpatched. But then thats because I haven't booted to windows on any of these machines for over a year. I dread the day I need too.

Re:i find it so hard

[Anonymous Coward]

I don't know. Even if your computers are safe, if someone else's computers are compromised, it could end up affecting you pretty badly.

Think of your family and friends. If their lives get disrupted because of this, so will yours be, indirectly. If their computers hold any info about you, then your life could be directly disturbed. Think of what an ex of yours could have on their computers (YMMV).

On the business side, consider what could happen if your customers' systems are brought down. Depending on what you work on, you could end up just sitting on your ass, waiting until your customers fix up their stuff - not getting paid until they do.

Again, their computers might hold important financial data about you that you'd rather criminals not have access to.

And the virus might be used for something completely different, such as spam (affects us all, even if minimally), DDOS, etc.

All in all, I think there are good reasons to be worried about this, without being needlessly alarmist. Our world has become deeply interconnected and quite dependent on everybody's computers, so this could end up affecting you no matter how safe your own computers are.

Re:i find it so hard

[Anonymous Coward]

Or Microsoft fucked everyone over by not providing updates to pirate copies - ie most of China, and other Asian countries.

That said, 3rd parties are solving that - eg 360safe Antispyware allows you to download and install windows updates in China, and its slightly popular here - something like 200M downloads to date.

Re:i find it so hard

[morgan_greywolf]

delightfully overkill

By "delightfully overkill" do you mean something like installing a fully-populated IBM Z10 Enterprise Class E64 for reading e-mail, surfing the web and playing a game or two of solitaire?

Re:i find it so hard

[Tony Hoyle]

There is no 'grand activation date'. April 1st *or later* when it updates itself.. it's more likely to upgrade to conficker D than do anything else.

It's just not in the authors interest to do any damage - whilst people don't know they are infected they can participate in the botnet. If the virus makes itself obvious then all that potential revenue is destroyed.

The f-secure blog puts it best: http://www.f-secure.com/weblog/archives/00001636.html

Re:i find it so hard

[0xygen]

It is not necessarily a grand activation date.
It is just one of the (many) predefined dates where the worm switches auto-update mechanism.

It has a current auto-update mechanism, so a new payload could be handed out anyway, whether or not the April 1st code exists or not.

Re:i find it so hard

[Lobster Quadrille]

I was thinking more like using 1000lb of thermite to cut an SUV in half, but you get the idea.

Re:i find it so hard

[mrsurb]

Pirated versions of Windows end up with automatic updating turned off as a way of getting around Microsoft's Genuine Advantage validation tests.

Re:i find it so hard

[Anonymous Coward]

It's the xkcd hat guy! Quick, get him!

Re:i find it so hard

[KlaymenDK]

Only the non-pirated ones.

Re:i find it so hard

[Tony Hoyle]

That happens - There's a class of admin who won't apply MS updates unless they think it affects them directly, and sometimes not even then. They are the people who've gone beyond healthy paranoia (don't change what's working) to stupidity (don't apply critical security updates because they might break stuff).

There's also dumb firewalls/proxies that won't let the updates through.

There's no excuse for a business to be infected with conficker... if it happened here half the IT would find themselves on the street. Home users you can excuse somewhat.. they don't know how to look after their machines and may switch off updates for some reason eg. they don't want to pay for the bandwidth.

Re:i find it so hard

[cbiltcliffe]

Kind of the ultimate hack, no?

Use some n00b's computer to do your bidding and get first post on a geek tech board that said n00b doesn't even know exists, forget about has ever visited.

Yeah.....that's pretty cool.

Re:i find it so hard

[Locklin]

Joe and Jane Average's feelings about computers and the internet are defined largely by a combination of their experiences with computers at home and at work, and stories in the media about computers. If their experience is one of unrelenting danger, constant infection, and identity theft and whatnot, they'll be much more supportive of draconian policy decisions.

It also doesn't help that all the mainstream media coverage of this has called it a "computer worm/virus" (no mention of the target software), and the people they interview are more interested in fear mongering than giving any security advice at all.

Re:i find it so hard

[cbiltcliffe]

I'd say as a rough guess, that 75% of viruses/trojans/malware nowadays turn off Windows Update as part of the infection process.

Somebody gets one of these fake Facebook spams, goes to the site in question to see Amanda Whatserface doing her striptease on stage, downloads Adobe_Player11.exe, so they can see the video, and bam. They're infected.

And before you bitch about them not having up to date antivirus.....I sent this file to virustotal.com a couple of days after I first got one of these spams, and it was detected as a known virus by a grand total of zero scanners.
Two flagged it as a suspicious file, and the rest (37 or so) let it sail on through.

Somebody gets hit with one of these things, and they'll have no A/V, no Auto Updates, and probably no firewall. They won't know it, because they'll also have no Security Center Service.

Or there's the possibility that they got infected, took their machine to a big-box moron to get it fixed, and the idiot in question cleaned the virus, but didn't enable all the disabled services. So again, no firewall, no Auto Updates.

It's not all because they're turned off intentionally.

Re:i find it so hard

[L4t3r4lu5]

They turn it off because Windows Update either:

1. Popping up a bubble every 5 minutes telling you to restart your computer.
2. Popping up a windowevery 5 minutes telling you to restart your computer.
3. Restarting your computer automatically, without asking permission, and informing you afterwards.

When you've gone to make some coffee and you come back to the message "An important update required a restart of your computer." the first question you ask is "Where did my work go?" The second question is "How do I stop that happening again?"

Re:i find it so hard

[fuzzyfuzzyfungus]

In mainstream media coverage, calling something a "computer virus" is equivalent to mentioning the target software. At that technical level, there are "computers" there are "macs" and there might be, ever so occasionally, a story about the strange and incomprehensible world of "linux".

Re:i find it so hard

[Anonymous Coward]

To remind people that the improbable isn't quite the same as the impossible just yet perhaps?

Re:i find it so hard

[joelmax]

Or you could go and manually download the updates. Its not that hard really. Sure, you can't get all the updates, but any of the critical ones can be downloaded and installed manually. Really, to be honest, it isn't MS's responsibility to ensure that your illegal software works and is secure, that is your problem. MS isn't really fucking anyone over by not offering updates to pirate copies, you never paid them, so they don't give you anything. Nothing in life is free, there is always a cost of some kind. You buy a legit copy, you get updates and support; you download an illegal copy, its your own problem.

Really all those people with illegal copies should just smarten up. If you are smart enough to download and install an illegal copy of windows, you should be smart enough to manually download the updates that are critical off of the MS website without using the windows update site. People with this attitude are really frustrating because all that they do is further perpetuate the problem. In this case, all any illegal user has to do is go to http://support.microsoft.com/ and type MS08-067. Not hard, don't need to be a genius to do it, nor do you need any "L33t hax" or 3rd party groups providing it.

Re:i find it so hard

[emocomputerjock]

All that will be left is a box in Madagascar with it's ports closed.

Re:i find it so hard

[Anonymous Coward]

I was thinking about a RAID array of 1980's calculator wrist watches.

Re:i find it so hard

[Pvt_Ryan]

They won't know it, because they'll also have no Security Center Service.

So what you are saying is that these virii actually improve windows?

Re:i find it so hard

[Anonymous Coward]

Every time microsoft adds another EULA (every couple of months or so) automatic updating is put on hold until the user works out how to read and agree to the new licensing terms.

Re:i find it so hard

[imbaczek]

there are people who complain that any update they install slows down their box, so they turn off autoupdate and just reinstall when the malware starts bogging their OS. these are mostly the guys who think they know computers because they can fiddle with the control panel but know nothing about how software really works. they just assert th

Re:i find it so hard

[Anonymous Coward]

I can only hope that it was created to wipe out IE6.

Re:i find it so hard

[Anonymous Coward]

Haven't you ever played Uplink? It is in the nature of virus creators to attempt to destroy the Internet.

This. I recently replayed Uplink, and it's pretty amazing (for a game written in 1999) how many things came true.

Re:i find it so hard

[FTWinston]

Ah come on, it would be funny. I'd do it if I could be bothered getting the necessary expertise.

Getting the media in an uproar, keeping so many IT guys edgy ... and then come april 1st, nothing happens except several million people have the words "HA HA" overlaid on their display for the duration of the day.

Re:i find it so hard

[tecnico.hitos]

I think the purpose of this virus is to try to take over the world.

Re:i find it so hard

[Anonymous Coward]

My understanding is that it spreads using a variety of mechanisms, the exploit is only one of them. Most probably are due to being in patched but I don't think that should be overstated-things can spread through other forms of bad practice too including ill used sneaker net.

Re:i find it so hard

[Anonymous Coward]

Damned Madagascar. That's why you should always infect 193.251.0.0 first.

Re:i find it so hard

[blackest_k]

WGA if it wasn't for that then perhaps more people would be patched and up to date.
It would be remarkably funny if these infected machines turned on microsofts websites and perhaps a lesson learned for microsoft.

Although I understand patching microsofts unpaid user base might not sit well with microsoft, by not doing so they put their paying customers at risk.

Re:i find it so hard

[Anonymous Coward]

If you don't like the current configuration of Windows Update you should learn how to change that. There are lots of options concerning when updates are installed, how you are notified and whether it should reboot automatically.

Re:i find it so hard

[Anonymous Coward]

Really, to be honest, it isn't MS's responsibility to ensure that your illegal software works and is secure, that is your problem. MS isn't really fucking anyone over by not offering updates to pirate copies, you never paid them, so they don't give you anything.

Ho hum. The point is that everybody, including all MS's *paying* customers, suffer from the effects of the illegal installs not being patched - these PCs will be spambots (affects everybody) or launching DDos attacks (affects the attacked site and its customers even if *they* are all legal and patched). The owners of the infected machines may not even notice they are affected so they may suffer *less* than some of the legal/patched machine owners.

Re:i find it so hard

[BigDukeSix]

I don't mind the bubble so much. If I close my eyes it goes away!

Re:i find it so hard

[Ralish]

You do realise that this is completely wrong?

Microsoft distributes security updates to _ALL_ editions of Windows that are currently maintained irrespective of the legality of the license. However, if you are not running a legal license, you can only receive updates through Automatic Updates, limited purely to security updates. Use of Windows/Microsoft Update and/or the downloading of non-security updates requires a valid license. The reasoning for this is to prevent exactly what you accuse Microsoft of not doing, reducing the risk of large viral/worm outbreaks and the impact of such outbreaks on Windows users, particularly those with legal licenses. Even if you completely fail WGA validation, you still will receive security updates through Automatic Updates.

Ideally, I'd prefer MS to permit security updates through the WU/MU frontend even if an invalid license is detected. I'm not sure what error message is displayed and if it prompts for Automatic Updates to be enabled or informs the user that they can still receive security updates through AU. However, the point remains that MS still permits a legal avenue of obtaining such updates, despite running an invalid license, at THEIR cost of distributing such updates.

There is no excuse for not being patched.

Re:i find it so hard

[geekboy642]

This is much like the "linux uses a command line, so it's better. I don't care if you don't want to learn arcane syntax".

Windows is hard to configure correctly. If you don't know the magic registry line, or which utility buried in the system folders to use, there's no way in hell you can make the fine-grained adjustment not to automatically restart. On the other hand, turning off system updates entirely is easy. I'd count the clicks if I had a windows box available, but I guarantee it's not that many.

Re:i find it so hard

[RiotingPacifist]

If I never patched my Linux/BSD servers when security flaws were discovered, they'd be rooted pretty fast too.

But with many(most?) linux/bsd distributions once installed you only get security patches, with windows if you want a secure box you also get hit with whatever usability changes/bugfixes they choose to push through the update channels. Additionally all distros i use take special care to not mess up your configuration files without warning you first, i don't think windows does you that courtesy either.

Re:i find it so hard

[Thoughts from Englan]

I think the purpose of this virus is to try to take over the world.

No problem then - Pinky will find some way to screw it up

Re:i find it so hard

[Anonymous Coward]

On the other hand, turning off system updates entirely is easy.

Yes, you go to Control Panel, Automatic Updates and click "Turn off Automatic Updates". Alternatively, you could click "Download updates for me, but let me choose when to install them", which is on the same dialog.

This is not a UI discovery problem.

Re:i find it so hard

[Archangel Michael]

Obviously it will be run by PENGUINS!

Re:i find it so hard

[Anonymous Coward]

That, or on occasion it happens that a windows-update stops the machine from booting. That was what pushed me over the edge and made me move from XP to Ubuntu. (Though I have to admit I turned off automatic updates in Ubuntu as well)

Re:i find it so hard

[An ominous Cow art]

There is no such thing as overkill, if it results in one fewer SUV on the road.

Re:i find it so hard

[Anonymous Coward]

Automatic updating regularly is the default behavior of Windows, isn't it?

Automatic updating is the default behaviour *now*. It wasn't always so. Once upon a time you had to manually visit a website to get updates. It's entirely possible for a person not to do this, and so not get whatever service pack made automatic updates default behaviour.

I'm not suggesting that this scenario is the cause of the current conficker situation, I'm just saying that relying on auto updates being turned on is not a sound way to prevent it.

Re:i find it so hard

[cbiltcliffe]

Well, it'll remove the nag screens, which could be considered an improvement.

But I'm not sure the method is the best way to go about that....

Re:i find it so hard

[joelmax]

Very very true, and a good point. The thing is though, even the illegal users can take the time to get these critical updates and install them rather easily (And that is my point). Sloth and ignorance isn't an excuse. The only illegal users that I really do feel bad for are the ones that have the illegal copies because someone else installed it for them. They, on average do not know how a computer works, and are being made vulnerable by the people who installed the software (That young whippersnapper grandson that is oh so handy with the computer... you know the one, usually they are more dangerous than knowledgable). Its the people who are out there installing xp illegally, disabling updates, not maintaining their systems that make this potential issue so bad. Not MS (Wow, I never thought I would be saying that). MS put the fix out there, anyone can download it without need of passing WGA certification, so even all the kiddies with their hacked xp install could be protected. Hell, there are even wga and activation cracks out there for xp that allow windows updates to get through, so if they are going to take the time to pirate, why not do it right??

Personally, with whatever comes down the pipe on this one, be it a DDOS, SPAM, etc.... for once, I wont blame MS.. I'll blame the people with unpatched (And easily patchable) illegal installs for not taking the time to manually download the update, simply shrugging the shoulders and saying, "If I get something, I'll wipe" is an apathetic and lazy approach.

Re:i find it so hard

[kheldan]

They'll vote for a bunch of police powers and be back.

The sad irony here is that all the "policy decisions" and "police powers" on the planet aren't going to stop something like this from happening. It's the very fact that we have a global interconnected network of general-purpose computers that facilitates this phenomenon, and trying to stay ahead of the bad guys is a perpetual, daunting, and impossible game; the only way to 100% ensure that any given computer is completely safe from infection is to completely disconnect it from everything else and never ever connect any mass storage devices or media that doesn't come from 100% trusted sources (which is almost nothing).

Re:i find it so hard

[blackest_k]

you are probably 100% right that you can still get security updates through AU but it appears that theres a lot of PC's with automatic updates turned off or there wouldn't be such a large problem.

Joe User, legal or not, doesn't want some automated process going through his details, after all it could get him in trouble.

The reality of the policy doesn't matter since WGA started, it's the perception, thats kept a lot of people away from windows updates.

Even people with genuine licensed windows quite often have genuine not legal copies of office and although windows is legal for them they still won't touch the microsoft website in case they detect the illegal install of office.

Has activation and license verification done anything effective to reduce the number of pirated installs?

Re:i find it so hard

[h4rm0ny]

Well whether the "grand activation date" is determined by settings in the code or by a hidden author releasing the new payload, the case is the same - it isn't doing anything yet but at some date will be turned on, whatever behaviour "on" turns out to be. So the question remains that if the purpose is something like DOS or spam and the network is already huge, which it is, why are they squandering the useful lifetime of this virus?

Re:i find it so hard

[zap345]

Exactly. I don't use the internet like I used to. Has the threats out their changed my usage of, and the amount of time I spend on the internet? You bet. I got better things to spend time on. My wife just recently downloaded a simple scrip that deployed SHuer on her PC. Then my PC says "an object is trying to access LSass.dll but has not been granted those rights." Great, spend loads of time to remove the infections, or reinstall windows and spend loads of time getting it back to the way it was. Time to give Ubuntu another chance?

Re:i find it so hard

[Anonymous Coward]

That's the option that keeps popping up the little balloon letting me know I need to install updates. Unless, of course, I'm being a good little user and not doing my everyday work and browsing under Administrator in which case I never find out. Unless unless, I've gone into the group policy editor and performed the arcane registry hax required to let non-admin users be notified of updates waiting to be installed.

Re:i find it so hard

[Anonymous Coward]

Sure you need advanced knowledge to configure the advanced stuff. That is not a problem as long as the default setting is sane.

I am not 100% sure about that but imho the default setting is either to schedule updates at 3 am or install them at shutdown.

And there is another point you miss: documentation. Just compare the documentation of FreeBSD and Linux. It is astonishing how much less information Linux has to offer while having so much more publicity and manpower. Just search for "configure automatic update" on Google and you find some nice step by step guides.

So we have:
sane defaults - check
customizability - check
documentation - check

Re:i find it so hard

[indi0144]

Nah people don't mind having a drive with 80% fragmentation. Thats all I've seen on PC's with WGA bitching loudly every 15 minutes. Oh and you can't logon after some period of time.

Re:i find it so hard

[Anonymous Coward]

except of course that's not true. a patched machine can still be infected. take a few moments to read about the multiple infection vectors.

Re:i find it so hard

[Anonymous Coward]

5 Clicks
Right Click My Computer > Click Properties
Click Automatic Updates > Click Turn off Automatic Updates
Click OK or Apply

However there is an option sitting right there that can let you stop the auto restart or schedule it for a better time like 4:20AM

Re:i find it so hard

[Anonymous Coward]

He'll need every one of those computers to get it, too

Re:i find it so hard

[Anonymous Coward]

While I agree that caring about the poor widdle windows users is a boring hobby, there are reasons for it.

First, most of the "what will conficker do?" possibilities have the distinct potential to be unpleasant for everybody. We are almost definitely looking at extra spam, or worse.

Second, and ultimately more important, is the fact that Joe and Jane Average's feelings about computers and the internet are defined largely by a combination of their experiences with computers at home and at work, and stories in the media about computers. If their experience is one of unrelenting danger, constant infection, and identity theft and whatnot, they'll be much more supportive of draconian policy decisions. That is Bad.

Sure, actually caring about the newbs, as they do the same stupid things over and over, gets really old really fast; but, when they visit the internet, I want them to have a good time because we are well past the point where they will just leave if they don't like it. They'll vote for a bunch of police powers and be back. Nobody wants that.

Too late.
I already favor execution as a way of cleaning up the INTERNET MESS.
Implimented by the UN with all countries cooperating the problem will be solved.

Next up the terror threat from relgious fanatics...

Re:i find it so hard

[rdnetto]

Actually, the no of clicks to disable automatic updates is the same as the no required to configure it to ask for permission before installing them.
But I do agree that it is hard to configure some stuff in Windows, compared to Linux where everything is in an obscure .conf file somewhere...~

Re:i find it so hard

[EZway15]

Does your ISP have a role to play here?

Re:i find it so hard

[Anonymous Coward]

I know a lot of people here whom are using pirated windows, and they all disable updates because updates often break pirated windows (or are perceived to do so).
[I use Linux btw]

Am i doing it wrong?

[arndawg]

"You can literally ask a server if it's infected with Conficker, and it will give you an honest answer." I asked and got no answer? Is there a specific language? I tried both english and norwegian.

Re:Am i doing it wrong?

[Anonymous Coward]

I keep yelling at the computer but it just won't answer!

Re:Am i doing it wrong?

[Anonymous Coward]

Use the mouse. It's quaint but it works. A Scottish accent may be helpful as well. ;)

Re:Am i doing it wrong?

[pjt33]

So how do you use a mouse with a Scottish accent? Curious minds are dying to know.

Re:Am i doing it wrong?

[tecnico.hitos]

Huh? Should I click morse code in a scottish accent?

I thought typing esperanto in binary would be work

Re:Am i doing it wrong?

[Yosho]

So how do you use a mouse with a Scottish accent?

Well, first, you've got to get it drunk...

Re:Am i doing it wrong?

[Anonymous Coward]

Ask Scotty, he's a miracle worker.

Re:Am i doing it wrong?

[VinB]

So how do you use a mouse with a Scottish accent? Curious minds are dying to know. Sounds kinky. Then again, if the mouse is of consenting age, it's all good fun I suppose.

Re:Am i doing it wrong?

[Anonymous Coward]

Computer...Computer? Hello, computer. /Scotty

Re:Am i doing it wrong?

[ThrowAwaySociety]

So how do you use a mouse with a Scottish accent? Curious minds are dying to know.

http://www.youtube.com/watch?v=wzRziK-kZtQ

Just drop your geek card in the slot by the door as you leave.

Re:Am i doing it wrong?

[L4t3r4lu5]

I hate to be a pedant, but it was the keyboard which worked. The mouse obviously couldn't understand the dialect.

Much like the rest of the English speaking world, really.

Re:Am i doing it wrong?

[dkleinsc]

That's easy:
1. Add a speaker to your mouse (Probably would need to be a USB mouse).
2. Write a driver to allow you to tell the mouse to play a clip.
3. Tell your driver to play Scotty quotes.
4. Use the mouse as usual.

Re:Am i doing it wrong?

[Anonymous Coward]

So how do you use a mouse with a Scottish accent?

Ya cunt due et mon . . .

Re:Am i doing it wrong?

[maxume]

You hear that?

Re:Am i doing it wrong?

[Dachannien]

I asked and got no answer? Is there a specific language? I tried both english and norwegian.

Everyone knows that servers speak Swedish.

And by Swedish, I mean, b0rk b0rk b0rk!

Re:Am i doing it wrong?

[Anonymous Coward]

Star Trek IV: The Voyage Home (1986) :
http://us.imdb.com/title/tt0092007/

Re:It just amazes me

[Computershack]

I've often wondered why Microsoft just doesn't implement some sort of security in Windows like other OS's have. It might prevent this kind of thing.

You mean like patching the flaw MONTHS before Conficker was released?

What having something like an application which could scan for it and remove it? You could call it "Malicious Software Removal Tool" and get it to run when automatic updates are done which would be handy. You could also allow users to run it themselves if they wanted by, say, clicking on Start, Run and typing in mrt...

Oh wait...

Oh please confess...

[geekmux]

My own pet theory (based on nothing but speculation) is that come April 1st, nothing will happen. And then someone will wave their hand and say "hey, I made conflicker" and get rich from interviews, while the rest of us giggle at the hilarity of this massively-hyped april fool.

Oh please let that "someone" stand up in the cube next to me. I could use some of that MS reward money right about now...

Oh, and it's gonna be kind of hard to get rich from interviews while occupying a cell in Gitmo. No, I doubt I'm overreacting here, in this day and age, this is an "act of terrorism".

Re:Oh please confess...

[Razalhague]

Everything's an "act of terrorism" these days.

Re:Oh please confess...

[Pvt_Ryan]

I just passed gas and that WAS an act of terrorism..

Re:Oh please confess...

[crashumbc]

Everything's an "act of terrorism" these days.

it's scary how true that is.

Re:Oh please confess...

[againjj]

Including, say, failing to fully guarantee all deposits of a bank. Thus, that foreign government is planning action that will harm the economic interests of the citizens of your country. (Iceland/UK respectively, in case you missed the news.)

Potential problem

[Shrike82]

We figured this out on Friday, and got code put together for Monday.

And with the ability to be remotely updated, Conficker will be immune to this by Tuesday.

Re:Potential problem

[OeLeWaPpErKe]

+1 Dance, monkeys, dance !

Re:Potential problem

[Anonymous Coward]

Now we know who wrote it - Solomon Grundy.

So...

[ericrost]

So where's the article detailing what was in the summary. NONE of the links has any details on what the summary claims. There's simply the "proof of concept scanner" but no info on any of the linked blogs about it, no info on the major sites linked about it....

Very crappy post, editors!

Re:So...

[Anonymous Coward]

The scanner works fine on my SLES 11 box, but fail all over the place on Windows. Very disappointed to see there is no Nessus plugin as yes, this should have been held back until there was some coordination. Smacks of "look what i made".

Re:So...

[Zocalo]

From Dan Kaminsky's site, immediately under the bit that looks like the Slashot story funnily enough, so I'm guessing it got dropped to save space on the Slashdot front page:

The technical details are not complicated -- Conficker, in all its variants, makes NetpwPathCanonicalize() work quite a bit differently than either the unpatched or the patched MS08-067 version -- but I'll let Tillmann and Felix describe this in full in their "Know Your Enemy" paper, due out any day now with all sorts of interesting observations about this annoying piece of code. (We didn't think it made sense to hold up the scanner while finishing up a few final edits on the paper.)

Re:So...

[martins99]

How do you actually do the scan with nmap? Is there an updated NSE script available?

Re:So...

[Tony Hoyle]

If that's the case, then it's not a remote detection tool rather something locally. Surely there are plenty of other ways to see you're infected eg. you haven't run windows update in over 6 months is a good sign.

Re:So...

[ericrost]

So we have an unsubstantiated sentence by "Dan Kaminsky"? Who doesn't happen to be one of the researchers, so how does he know what he knows? That's usually the standard in "journalism", quote sources otherwise I can write a lot of stuff that's just talking out of my ass.

Re:So...

[Anonymous Coward]

And since when a proof-of-concept python algorithm doesn't count as "info" nor "details" on ./ ? You must be new here ...

Re:So...

[Effugas]

I actually worked with the researchers on this. (This is Dan.)

Re:So...

[Jaysyn]

Hi Dan. Love your apps when I have to use (or fix) Windows. Thanks!

Re:So...

[cbuhler]

Looking for the same thing. insecure.org has some info, but not a word on how to do the scan.

Re:So...

[Sancho]

Looks to me like you just use the smb checker script. If you have the latest source from SVN, omething like this should work:

nmap -sS --script smb-check-vulns.nse -p 139,445 -v -d -P0 -oA outputfilename hostornetworktoscan

Re:So...

[RebootKid]

At least I'm not the only one trying to find this, and failing. My google-fu is weak this morning, apparently.

Re:So...

[iago-vL]

Hey guys,

I'm the author of that script, and that's exactly right. I posted a full explanation on my blog.

Re:So...

[wiedzmin]

Be VERY careful running it on your network, this is from the NMAP smb-check-vulns.nse script description:

WARNING: These checks are dangerous, and are very likely to bring down a server. These should not be run in a production environment unless you (and, more importantly, the business) understand the risks!

As a system administrator, performing these kinds of checks is crucial, because a lot more damage can be done by a worm or a hacker using this vulnerability than by a scanner. Penetration testers, on the other hand, might not want to use this script -- crashing services is not generally a good way of sneaking through a network.

If you set the script parameter 'unsafe', then scripts will run that are almost (or totally) guaranteed to crash a vulnerable system; do NOT specify unsafe in a production environment! And that isn't to say that non-unsafe scripts will not crash a system, they're just less likely to.

MS08-067 -- Checks if a host is vulnerable to MS08-067, a Windows RPC vulnerability that can allow remote code execution. Checking for MS08-067 is very dangerous, as the check is likely to crash systems. On a fairly wide scan conducted by Brandon Enright, we determined that on average, a vulnerable system is more likely to crash than to survive the check. Out of 82 vulnerable systems, 52 crashed.

Re:So...

[Sancho]

Nice job on the script, then! We've been making use of it for a while to search for ms08-067 vulnerable computers on the network.

Re:So...

[iago-vL]

Glad to hear it! When I wrote the ms08-067 script, I was surprised to see it posted around the Internet -- I wrote it as a demo of what Nmap can do, not as a production-grade scanner, and I guess it ended up being more useful than the other scripts that I've put *far* more work into :)

Re:So...

[iago-vL]

That's correct. I added a 'safe' parameter last night, since the Connficker check is safe, and have been advocating its use in all my posts (you'll see "script-args=safe=1" in everything). Watch out for that.

And for what it's worth, even if 'safe' is missing, it's only going to crash stuff that isn't patched for MS08-067.

Re:So...

[arootbeer]

So we have an unsubstantiated sentence by "Dan Kaminsky"? Who doesn't happen to be one of the researchers, so how does he know what he knows? That's usually the standard in "journalism", quote sources otherwise I can write a lot of stuff that's just talking out of my ass.

I actually worked with the researchers on this. (This is Dan.)

While I don't specifically doubt the veracity of your post, the irony of it (in context with the GP) greatly amuses me :)

Progress Marches On

[bistromath007]

People once laughed at the ideas of flight, going to the moon, splitting the atom, and electronic computing itself.

Now we have another accomplishment to add to that list: the evil bit. Science conquers all.

Saa-Wheet!

[KaeloDest]

For real, even tho I do not use windows (except for virtualized) I am glad to see real benefits of solid research and quick implementation.

I for one am glad to see that not all of the hard work is being done by the attack squad.

Hug a programmer. Hug one today.

Re:It just amazes me

[magbottle]

Hook, line and sinker. That's what trolls are for.

No actually, the fact that the supposed cure for the disease, or rather remote diagnostic, takes advantage of the fact that Windows by default lets such probes detect _anything_.

I don't get it ...

[Slayer]

The most common infection vector is because people run executables from untrusted sources. And now Tillmann and Felix expect us to download a scanner and run it on our systems ?

Next time someone recommends GTA for driving schools ....

Re:I don't get it ...

[arndawg]

The most common infection vector is because people run executables from untrusted sources. And now Tillmann and Felix expect us to download a scanner and run it on our systems ?

Next time someone recommends GTA for driving schools ....

Don't worry. I'm sure norton will warn you if it does anything bad. KTHX

Re:I don't get it ...

[Pvt_Ryan]

And they kindly provide the code in plain text for you to read!

Re:I don't get it ...

[Ant P.]

If you won't run executables from untrusted sources, how did you get far enough to complain about it on a website?

-1 Whoosh

[Don_dumb]

Hi, I'm the author of Conficker and the payload is to get a first post on slashdot.

That's it? You wrote a worm to get a first post on Slashdot? Damn. How lame are you?

You took that seriously. How lame are you?

Re:-1 Whoosh

[morgan_greywolf]

You took my post seriously, so how lame am I?

Guess my punchline wasn't snappy enough... :(

Re:-1 Whoosh

[L4t3r4lu5]

*Bzzzzzzt!*

The comment system is temporarily disabled while we resolve this revolving door bug. Apologies for any inconvenience.

Re:-1 Whoosh

[Don_dumb]

Apologies.
I did wonder but I couldn't see anything facetious about the post so concluded it was serious.

But not in Germany or UK?

[AliasMarlowe]

Which would happen once for every node on the network, would become this:
root@admin:~$ nmap 192.168.0.* -confickercheck

But isn't possession of "hacker tools" such as nmap legally questionable in the UK and Germany?
http://it.slashdot.org/article.pl?sid=07/08/13/0218246&tid=172
http://yro.slashdot.org/article.pl?sid=08/01/03/2056223
So if you use nmap to clean your network, you may be open to criminal charges.

Re:But not in Germany or UK?

[L4t3r4lu5]

Other "hacker tools":

• ping
• tracert
• net
• netstat

Forget nmap; Windows is just one big hacker suite.

Re:But not in Germany or UK?

[smallfries]

Not in the UK, according to the articles that you linked to. The prosecution have to show that you intended to use the tool to commit a crime - possession is not enough. Did you actually read the links that you posted?

Re:But not in Germany or UK?

[AliasMarlowe]

Not in the UK, according to the articles that you linked to. The prosecution have to show that you intended to use the tool to commit a crime - possession is not enough. Did you actually read the links that you posted?

Yes, I did. According to the linked article, if you distribute a "hacker tool" that somebody else then uses for an illegal purpose, you're on the hook under UK law. Even if you commit no crime with it.

Re:But not in Germany or UK?

[blueg3]

So, did you then confuse possession and distribution? I still don't see how possession of nmap, neither committing a crime nor intending to, is illegal under that reading.

Re:But not in Germany or UK?

[Builder]

IIRC the actual standard has been reduced to 'could be useful to commit a crime'.

Several people in this country currently have criminal convictions for possessing certain books because they 'may be useful to someone planning a terrorist attack'

Not WERE planning attack. Not were part of a group of known terrorists with known events behind them. Just 'may be useful to someone planning a terrorist attack'.

Trust the law in this country? Hell no!

Re:But not in Germany or UK?

[Simetrical]

IIRC the actual standard has been reduced to 'could be useful to commit a crime'.

I know this is Slashdot, but can you do any better than "IIRC"? Any actual, you know, sources, instead of generic accusations probably grounded in suspicion of everything the government does? A computer "could be useful to commit a crime"; there is no possible way that's an official standard used for conviction in Britain or any other free country. There are going to be a lot more caveats. (Whether people are arrested illegitimately, without regard for whether they've actually broken the law, is a separate question from what the law itself says.)

Re:But not in Germany or UK?

[drinkypoo]

Someone I know was personally investigated by the local police as possible dope growers (some years ago, when it was still entirely illegal in the state of California, where all this transpired) because they were known to possess shovels. Not a joke. The police came and inspected the bamboo grove that apparently triggered the inspection... This is not a third-hand story, either. Or even second-hand, to me :)

Re:But not in Germany or UK?

[smallfries]

Ok so you did read it. And I'll assume that you are aware of what you wrote the first time. And I'll assume that you read my response. The only possible logical conclusions are either a) you don't know the different between possession and distribution (thanks blueg3), or b) you are an idiot. I'm not as generous as blueg3, I think you lack the intellectual faculties to post on slashdot. It's a low bar, but by god you've hit it.

I'm going to try though, and see if you could understand with a little coaching, and help with the big words. You claimed:

But isn't possession of "hacker tools" such as nmap legally questionable in the UK and Germany?

Quite straightforward. If we ignore the claim about Germany, which may be correct, you have explicitly claimed that possession of "hacker tools" can be dodgy under uk law. You've reinforced this claim with:

So if you use nmap to clean your network, you may be open to criminal charges.

Note, this is identical to the first claim - that possession of "hack tools" is legally iffy in the uk. As this this claim is wrong, and it's explained to be wrong in the links that you provided, I have pointed out to you:

The prosecution have to show that you intended to use the tool to commit a crime - possession is not enough.

Ok, you claimed possession is legally iffy. I've explained that it is not, according to your own sources. Now, here is where you failed the slashdot iq test:

According to the linked article, if you distribute a "hacker tool" that somebody else then uses for an illegal purpose, you're on the hook under UK law.

A completely different claim. So it doesn't back up your original claim - this is an interesting property of brand new claims that you would do well to memorise. As it is generally understood by a small partially retarded child that you can't win an argument by insisting that something completely irrelevant is true - I would beg you to seek the help of an older bigger child to read your posts before you submit them. And when necessary, to be the one responsible for battering you with the clue stick until you understand.

Re:But not in Germany or UK?

[smallfries]

Do you have a link for this? It sounds interesting as that was the original standard that caused the debate / argument from the security industry in the first place.

Re:But not in Germany or UK?

[icannotthinkofaname]

From reading this section of the thread, it's as illegal as having a camera and a small child in the same house. It's perfectly alright; the potential for illegal stuff just happens to be there.

Re:But not in Germany or UK?

[Anonymous Coward]

Doesn't everyone get arrested for posessing kitchen knives? I'm assuming they're using some other criteria, like could be useful to commit a crime AND has no other known purpose for which the person can claim they have it for...

Re:But not in Germany or UK?

[Anonymous Coward]

...but wait, isn't a computer a "hacker tool"?

Re:But not in Germany or UK?

[Plutonite]

It would be funny if the GP was the insightful one and you were the arrogant nitpicker who doesn't get it, eh?

He is saying that your having a tool like nmap is possibly dangerous, because something like distribution of said tool (which is downright horrible of course, way to go UK) can get you in trouble. In the digital world, as you well know, free distribution can occur with a copy and paste command. So he is saying that by having the tool, you are a copy and paste command away from being in trouble with Big Brother, and he may be right. Also note that if you have malware or a badly configured filesharing program, you don't even need to copy paste to be a criminal.

Be nice. It's good karma.

Re:But not in Germany or UK?

[smallfries]

It would be funny, yes, life is like that.

Your interpretation of what he wrote / intended those words to mean is very generous, but raises an interesting point. And because you are capable of forming a valid argument without help I won't respond completely like an arrogant nitpicker :)

It is entirely correct that possession is required before distribution can occur. I'm sure the RIAA would argue differently, especially in the case of sitting in a torrent swarm, but I'll stick to current legislative fact. So yes, possession is dangerous in the sense that once you are in possession of X, you can then choose to distribute X.

This argument can be split into two parts; is possession dangerous if it can lead to something dangerous, and can distribution occur without intent (as in your malware example). For the first point breathing oxygen would be a counter-example, in real-life, and the links that the GGP provided would be a legal counter-example. In that the guidelines for the interpretation of the law indicate that possession by itself is insufficient grounds, and that distribution must occur. For the second point I'll just mention that in the uk distribution must be intentional - you cannot be charged of a distribution offense without the prosecution showing that you engaged in distribution wilfully.

I'm not sure how the wilfull aspect translates into other jurisdictions, ie in America you may be boned regardless. This is where things get interesting - we've introduced some laws recently that are stupid, but there is a large body of precedent that shows that you should be ok. Also we tend to interpret our laws as necessary (according to the common sense of the judge & jury) rather than attempting to apply a strict literal interpretation. Recent abuses of the new anti-terror legislation show that this approach can and does break down.

I would say that being nice is worthy in its own right, karma be damned. But when someone is stupid enough to try and switch their argument rather than admit that their own sources prove them wrong it does require a bit of a verbal slapdown.

Re:But not in Germany or UK?

[Plutonite]

Now you're talking.

..you cannot be charged of a distribution offense without the prosecution showing that you engaged in distribution wilfully.

Welcome to the new world, where you and the machine are almost one. There is no way the prosecution can prove your intent, because everything you do to the machine can be replicated by intelligent software. The government has to both have complete disregard for your machine's privacy and your own privacy, possibly even your own mind, to give a meaningful verdict, hence my reference to Big Brother. The GP was right that the laws are therefore draconian and very stupid, in a free society.

In the case of physical harm, I understand that you have waived your privacy rights and the government can do what they want. But to have a file on your computer being possible grounds for your freedom and privacy to be confiscated.. that's just silly.

You are right about being nice. I just added the karma bit to motivate you in case you didn't think that way. I like Playing God on the internet, when I'm bored ;)

Re:But not in Germany or UK?

[Anonymous Coward]

Except that in the UK, the words "distribution" and "copying " are legally interchangeable in IT law. So if you copy that tool from, say, your install CD to your hard drive when you install your OS, then you have "distributed" it.

But thanks for being an obnoxious, condescending asstunnel.

Re:But not in Germany or UK?

[smallfries]

There is no way the prosecution can prove your intent, because everything you do to the machine can be replicated by intelligent software.

That's the way that I would see it, because as a computer geek it seems natural that would be the way it works. But the world is full of people who are not computer geeks. Two of my lawyer geek friends have berated me on this point many times.

In the end the fudging of intent between man and machine is irrelevant. The case will be tried by a person and it will come down to whether or not they believe you. Kind of like throwing the legal system back a 1000 years. Busted using nmap to look for hosts to add to a botnet (ie the one case that they would want to cover) - fine, as there is no distribution, but screwed on pre-existing law. Busted using nmap to scan your own network - fine. Busted in a hypothetical case where nmap is distributed by malware on our machine - hope you get a smart court that understands the distinction.

Don't me wrong - the security tools law was unnecessary and draconian. We already have enough laws to handle what we think of as computer crimes - there was no hole for this to patch in the law. This was a simple case of "we'll get them for something".

Re:But not in Germany or UK?

[smallfries]

No. You are completely wrong, and not willing to answer using your account I see.

Citation please.

The problem...

[EddyPearson]

1. Conficker updates

2. Security researchers scrabble to understand latest Conficker code.

3. Success!

4. Researchers release the info, in detail.

5. Researchers warm themselves in the radiant heat of their own brilliance. Community applauds.

5. Conficker authors read this publically available infomation, learn from their mistakes and fix the problems.

6. Go to 1.

And this circlejerk of will continue until the researchers involved learn put their egos aside and actually do something useful with the information.

Re:The problem...

[Anonymous Coward]

1. Conficker updates 2. Security researchers scrabble to understand latest Conficker code. 3. Success! 4. Researchers release the info, in detail. ...

You're obviously missing something. Where's the profit?

Re:The problem...

[NoCowardsHere]

Until researchers "do something useful"? You mean like, uh, release information to antivirus software developers who in turn release tools to detect and remove the virus? Oh, wait, they already did that. What else do you expect the researchers to do? Personally go door to door, offer to come in and check your system for you? If a million people are still infected because they're too stupid to take advantage of any of the tools that (thanks to the researchers) are available to help them, there's not much else the researchers can do about that. They may be smart, but they're not magical.

Re:The problem...

[silent_artichoke]

Forget the profit, I'm waiting for the ???!

Re:The problem...

[againjj]

At the end. Except this is an infinite loop....

Re:-2 Whoosh

[Anonymous Coward]

Hi, I'm the author of Conficker and the payload is to get a first post on slashdot.

That's it? You wrote a worm to get a first post on Slashdot? Damn. How lame are you?

You took that seriously. How lame are you?

You took that seriously. How lame are you?

McAfee Stinger for Conficker

[jquest]

McAfee Stinger for Conficker located at: http://vil.nai.com/vil/averttools.aspx

or other way..

[orange47]

you could tell all people to try and open this web page: http://www.clamav.net/ or ping it. (also many other security sites, see list here http://mtc.sri.com/Conficker/addendumC/index.html#dns-prevention ) If they can't then ConfickerC is probably blocking them. I'm not sure this would work for cached domains, though.

Re:or other way..

[tsalmark]

So, now, either it's slashdotted or ConfickerC is probably blocking them.

Hmmm

[ipc0nfig]

The following comment might be potentially stupid, but why not just move the computer clock forward to April 1st, and see what Conficker does. If it uses a internet time server to verify date, then just have the DNS for internet time server point to an internal time server. No?

Re:Hmmm

[cdrudge]

For the same reason that a bomb technician doesn't reset the timer to zero just to see what the bomb does. Sure it may be a dud and do nothing, or it may be huge and blow up in their face.

Re:Hmmm

[declain]

Well, Conficker queries well known sites and checks the date on the HTTP headers. You can't just redirect DNS to "move the clock forward".

Re:Hmmm

[Anonymous Coward]

They know what it's going to do. It's going to download an "update". And since no one (except the conficker author) has seen the update, no one knows what the update will contain.

Re:Hmmm

[Alioth]

Sure you can. And add a transparent proxy to change the headers to the false, moved-forward time.

Re:Hmmm

[Anonymous Coward]

That's what sandboxes are for.

Re:Hmmm

[ndixon]

ipc0nfig: ...why not just move the computer clock forward to April 1st, and see what Conficker does.

cdrudge:

For the same reason that a bomb technician doesn't reset the timer to zero just to see what the bomb does. Sure it may be a dud and do nothing, or it may be huge and blow up in their face.

I think ipc0nfig has a fair point - you could run an date-adjusted infected machine in a VM, isolated inside a virtual network, and monitor any disk/network activity.

Of course, you might not know what'll really happen unless you let it phone home, and even then you might not see what will happen on April 1st; but it might give more clues about which external addresses to block.

Re:Hmmm

[Talla]

The following comment might be potentially stupid, but why not just move the computer clock forward to April 1st, and see what Conficker does.

In that sense we already know what will happen. Computers infected with Conficker will get a new update. The problem is, it uses a routine which generates 50 000 different host names, many of which are legitimate, and tries to download updates from each of them. The Conficker owner will have updates ready on some of those servers, so what we don't know is what that update contains. We can probably be sure it will contain a fix for the part that makes it detectable remotely, though.

Re:Hmmm

[Shrike82]

This was my understanding too. If it were as simple as changing a date to "set Conficker off" then they'd just be able to isolate the virus code and see what instructions are supposed to be executed when it actually "explodes" and runs the mailicious part.

The problem stems from the fact that the malicious part is supposedly going to be downloaded from a remote location, then run, on April 1st, and since Conficker is extremely successful at obfuscating the precise domain that it will access on this date, no-one can even tell where it'll be looking, let alone what'll be there when it finds it. Here's hoping it be a huge April Fool's joke, and that the "mailicious" code will just pop up a message along the lines of "STOP OPENING UNKNOWN E-MAIL ATTACHMENTS YOU MORON. IF YOU WANT PORN THEN GET A TORRENT CLIENT"

Window HOWTO

[Dynamoo]

1. Download and install Python 2.6.1: http://www.python.org/ftp/python/2.6.1/python-2.6.1.msi
2. Download Impacket from http://oss.coresecurity.com/repo/Impacket-stable.zip (or maybe http://pypi.zestsoftware.nl/impacket/ or some other mirror)
3. Download the scanner from http://iv.cs.uni-bonn.de/uploads/media/scs.zip
4. Unpack Impacket into a folder, then install Impacket from a command line with c:\python26\python setup.py install
5. Run the scanner with the command c:\python26\python scs.py [start_ip] [end_ip]

(Hat tip to an AC comment at El Reg). Just a warning - it runs like a dog. I found that a passive Honeypot like Honeybot works well and is easier to install.

Re:Window HOWTO

[morcego]

Has anyone manage to find an infect machine this way ? All I get is "No resp.".

Since I'm a bit paranoid, my first reaction is that the tool is not working. Trusting ALL networks I scanned (about 2000 computers, including several notebooks) are not infected is just not in my nature.

Re:Window HOWTO

[rigmort]

Thanks for the help getting this working! The original story was totally worthless.

Re:Window HOWTO

[prograde]

The scanner needs to connect to port 445 of the target - if it's blocked by a firewall, you'll get a "No resp.". (BTW - links in the GP will also help you getting the scanner running under Linux - I just had to install Impacket and run the scanner)

Re:Window HOWTO

[morcego]

I actually installed both Impacket and Crypto, just to get rid of that warning.

In any case, I'm running this on LANs, so there are no firewalls on the way. I'm not randomly scanning people on the internet. And yes, I am authorized to do this kind of thing on these networks.

Re:Window HOWTO

[ChienAndalu]

On linux you can use

easy_install impacket

to install impacket if it isn't in your repository (you need the setuptools package for python however)

Re:Window HOWTO

[TheCybernator]

Can I get an Scanner.EXE instead?

Re:Window HOWTO

[Anonymous Coward]

So does "No resp.: 1.2.3.4/445tcp" mean it didn't work or that the PC is clean ?

Re:Window HOWTO

[merchant_x]

check and make sure the built in Windows firewall on the hosts you are trying to check is not blocking the request.

Re:Window HOWTO

[duffer_dave]

How do you get scs.py to read from an input file? thanks!

Re:Window HOWTO

[morcego]

I finally managed to find some infected hosts on one of the networks. Weird enough, I'm feeling much better now, knowing I can trust the results I've got on the others.

Looks like the tool works nicely, as advertised.

Re:Window HOWTO

[doglikegroove]

Is anybody getting any responses like this: Error running NetPathCanonicalize an if so, how would you interpret it?

Re:Window HOWTO

[KingPin27]

This is all good if you happen to have a *NIX box on your network. I have to try with a windows box and have troubles finding Crypto

Re:Window HOWTO

[morcego]

http://www.amk.ca/python/code/crypto.html

Re:Window HOWTO

[doglikegroove]

As it turns out, we has rolled out Symantec Endpoint Protection to a few boxes, which causes this response.

Re:Window HOWTO

[Anonymous Coward]

and the problem was...?

why isn't this the standard method for all scans?

[Lord Bitman]

Why isn't this the standard method for /all/ virus scanning? Remote scans are the only method which has ever seemed sane to me.. why would you run software to detect if the software you're running has been compromised? That's why I don't run virus scanners: it's pointless.

Give me a program that I can run on a "known good" system (for example, a system which boots off write-once media) and which monitors the local network for suspicious activity. I'll run that one.

Re:why isn't this the standard method for all scan

[smallfries]

Because most viruses do not change the network behaviour of a host. Because most viruses are not visible from outside a host. Because this is a very rare case of a worm that actually changes the fingerprint of a host.

mod parent up

[mewsenews]

I have no mod points, but the links in the actual story have zero information on actually running a scan. I'm scanning my office network right now solely because of this comment.

60 minutes segment

[British]

I thought it was funny, one of the newscasters on 60 minutes said she just got "owned". It's funny since this is the same show Andy "I'm out of touch with reality" Rooney is on.

Re:60 minutes segment

[Anonymous Coward]

I wonder... how much of that segment was really about Conficker, and how much was just alarmist bullcrap? I mean, according to them Conficker or other malware is lurking on any number of popular websites. It's as if all of them got some code injected into them (JavaScript? ActiveX exploits? Flash?) that forces the client browser to download a worm. Then, to really drive the point home, they equate this stuff with Neo-Nazi Russians. It almost reeks of that Anonymous story from Fox News.

Re:It just amazes me

[richlv]

seriously ? it is named "Malicious Software Removal Tool" ? so we could call it... "ms removal tool".
that's the best name of software coming from microsoft in a long time.

Running scs.py

[macbuzz01]

FWIW:

This works great on machines that don't have windows firewall active. If windows firewall is active, you get a "no response" from the script.

Whack-a-Mole?

[jshark]

Now that the authors of Conficker know that their infected systems have a different signature on the network, what's to stop them from just plugging that particular hole and picking a new date?

Cinco de Mayo anybody?

Re:Whack-a-Mole?

[Anonymous Coward]

Because the Conficker C won't do anything until April 1st.

That means, it can't update itself until then. Conficker B or B++ could theoritically update straight to a D variant, but the authors have made Conficker C wait (No outgoing connections) until April 1st, giving all of us 2 days to scramble and quarantine infected machines via the signature. It is likely that the hole WILL be patched in a future version of conficker.

Un-realistically, I see the best method of getting rid of Conficker is using the P2P method, and breaking the code-signing algorithm, and replacing an update with a self-destruct mechanism that gets rid of the virus.

Re:It just amazes me

[scrib]

I tried that.

"You must be logged on as a member of the Administrators group to run the tool."

A "user" can't run the MRT or apply automatic updates, you have to log in as an "administrator." If you regularly log in as a "user" you won't even be notified by Windows that there are updates available! This is why just about everyone who uses Windows logs in as administrator all the time. I think THAT is one of the most important security holes.

Better, yes, but no solution for PEBKAC

[Mathinker]

What we really need are machines which can prevent viruses and/or worms BY DESIGN and IN ADVANCE, instead of reacting by means of virus scanners, patches and removal tools AFTER something went wrong.

As long as you let give the user freedom to install and run what he wants, you cannot possibly prevent him from running/installing malicious code which can take over as many functions as the user himself has (i.e., if he can send email, so can the code, etc.)

why so many systems aren't patched

[girlintraining]

It's quite elementary, really: Windows Update sucks. Okay, that probably needs an explanation.

Would you rather:
a) Run Windows Update so Microsoft has backdoor access to update/patch/install software at random, as well as auditing your system for "compliance" and sending you a legal nastygram if you are caught running a "pirate" copy of Windows? Note: The detection algorithm for "Windows Genuine Authentication" has passed numerous false negatives and disabled people's computers before who purchased legitimate copies, -or-
b) Not update, download a software firewall, run a bunch of anti-malware scanners, and use Firefox, -or-
c) Do nothing, because "there's nothing important on my computer anyway."

Microsoft went through a lot of effort to make sure there were tons of unpatched systems out there when they started throwing up "windows genuine" everywhere, and having the average user jump through so many hoops. Then there's the two hour process of installing Service Pack 3. Who wants to waste two hours on a ginormous OS update when they can play WoW some more? And god help you if one of a thousand failure conditions crops up and it dies, telling you to reinstall the entire OS. The average Windows users is caught between knowing their systems are vulnerable and playing a rat race that requires knowledge and process they don't understand to keep their systems secure.

Big surprise when they choose the devil they know.

Re:why so many systems aren't patched

[Anonymous Coward]

You are exactly correct. Where I work we had a bunch of Dell laptops with Windows XP Pro that WGA proclaimed as not genuine. It turns out that a bunch of Dell's activation codes were stolen in China so WGM sees them as stolen. Neither Dell or Microsoft would do anything to help with the problem. We ended up buying new Win XP licenses for all of them.

Unfortunately I can't retaliate against Microsoft because they are a monopoly, but I promise to never buy another Dell laptop until hell freezes over.

Re:why so many systems aren't patched

[Anonymous Coward]

Your troll post is incomplete. Please mention DRM atleast 2 times and monopoly atleast 5 times. Also replace all your S's with $'s.

You cant just win the internets with that level of trolling. Buckle up...

Re:why so many systems aren't patched

[drinkypoo]

c) Do nothing, because "there's nothing important on my computer anyway."

Most people will do nothing, and therefore get automatic updates. Nothing to see here (i.e. in your comment), please move along.

The worst thing about updating Windows is how slow XP gets when you install SP3. Could someone please go forth and prove that was done to kill XP and sell more Vista, so that we can start a class-action suit against Microsoft? It would be a nice birthday present. :P

Re:why so many systems aren't patched

[Capt.DrumkenBum]

You forgot:
d) Install Linux and never worry about M$ crapware again.

Re:why so many systems aren't patched

[groslyunderpaid]

Should I assume that was hyperbole? SP3 takes like 30 minutes on even a crap machine... Newer machines can do it in like 10.

Re:why so many systems aren't patched

[argent]

Most people will do nothing, and therefore get automatic updates.

Unless they're one of the groups that get false positives from WGA, and don't buy new copies of Windows because they don't consider it's their fault that Microsoft messed up.

Re:why so many systems aren't patched

[dbIII]

Ok, so you have a fast link and a fast machine. For a 2GHz single core machine in a suburban office with standard ADSL it takes well over an hour.

Re:why so many systems aren't patched

[bratwiz]

Nah, he got that right too-- they just haven't gotten around to declaring 2010 to be 1984 so they can save some bucks by not having to buy new calendars.

Hmmm...

[GogglesPisano]

Interesting. The site is legit, but.... you would think McAfee would provide these links from a page on their main mcafee.com domain, instead of vil.nai.com (although whois confirms that McAfee does indeed own this domain).

Also, I find it disturbing that McAfee doesn't provide a SSL certificate for this page to confirm the site's identity. Seems to me that this page would be a high-profile target for hijacking, especially considering that most people will blindly download and run the executables that it contains.

Re:Hmmm...

[txsable]

You haven't been paying attention to the AV vendors for long have you? in 1997 McAfee merged with Network General and became Network Associates (nai.com) which also sold Sniffer. Then, in April 2004, McAfee became McAfee again when NAI tried to sell off the Sniffer product/Network General component (which was purchased by NetScout in November 2004). McAfee continued using the nai.com domain until June 30th of 2004, when archive.org shows nai.com redirecting to mcafee.com for the first time. vil.nai.com has been the Network Associates/McAfee Virus Information Library (and now the more generic "Threat Library") since at least 1999. (Incidentally, the "top 10 virus threats" in Oct 1999 included "Laroux", "Melissa" and "Happy99". My, how far we've come....)

Reply from Conficker authors

[Matt Perry]

"Thanks Dan! We'll be sure to patch this problem in the next Conficker update."

I hope they bring the whole shit down.

[Anonymous Coward]

10 million computers infected. Self destruct.

Re:It just amazes me

[SatanClauz]

dont admin windows much do you? you're right, you cant MANUALLY run updates, but the auto updates sure as hell get applied! wait... checking any of my 150 windows boxes running as user full time... yep! sure do!

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:rm -rf /* fix Requires Windows and Cygwin

[Zero__Kelvin]

"With Cygwin, / != C:\ ... let me know how it goes."

Sure! It goes like this (excerpts from the Cygwin FAQ):

The Cygwin Setup program will prompt you for a "root" directory. The default is C:\cygwin, but you can change it . [Emphasis added]

... and ...

In the past, there had been genuine bugs that would cause problems for people who installed in C:\, but we believe those are gone now.

So as you can see, it would have gone fine for me if I was foolish enough to use Windows in the first place ;-)

Re:rm -rf /* fix Requires Windows and Cygwin

[nabsltd]

With Cygwin, / != C:\ ... let me know how it goes.

It works pretty much the same once the rm command works its way down to /cygdrive.

Re:It just amazes me

[Anonymous Coward]

Automatic updates runs as a system service under the local system account so your computer will automatically receive and install automatic updates even if your login has only restricted rights.

Re:It just amazes me

[Anonymous Coward]

Unless you turn on this option in your group policy:

Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update -> Allow non-administrators to receive update notifications.

Set it to enabled and then even your limited users will be able to see that they have updates to install.

steps to implement scs for MS-Windows admins

[angryredfrog]

for Windows server admins who aren't experienced Python users, I put together this quick overview of steps to use scs on a Windows network. http://bobsfieldnotes.blogspot.com/

Preventing infection

[Rashdot]

Could infection be prevented on a clean machine, by just creating the conficker mutexes when starting a machine, before the virus gets a chance? All you'd need is a small tool that would start as early as possible during boot.

This same tool could also be used as a simple test for infection. If the mutexes are already there, it means the machine is infected.

Re:It just amazes me

[MiniMike]

No, the name 'ms removal tool' was already taken. It can be found on many linux install discs.

Re:-2 Whoosh

[Anonymous Coward]

Hi, I'm the author of Conficker and the payload is to get a first post on slashdot.

That's it? You wrote a worm to get a first post on Slashdot? Damn. How lame are you?

You took that seriously. How lame are you?

You took that seriously. How lame are you?

You took that seriously. How lame are you?

Re:It just amazes me

[gemada]

if you don't run your system as a local admin there is very little chance that you can get a virus like conflicker. Removing admin rights from users will prevent 99% of spyware and viruses.

Reminds me of banning aluminum foil...

[Ungrounded Lightning]

Back in the '60s and '70s, when the current "drug war" was getting its start, some municipalities passed "narcotics paraphernalia" laws banning possession of anything that "could be used" for preparing or consuming controlled substances.

Aluminum foil was used to improvise "pipe screens" by lining a pipe bowl or a hole in a toilet paper roll and poking small holes in it with a pin. So these laws ended up banning aluminum foil. (Don't recall if this eventually got them struck down ...)

Re:It just amazes me

[Anonymous Coward]

Don't run that tool! It tells you it's Malicious right in its name!

Re:McAfee Stinger for Conficker V. scanner.py

[skillrod]

Maybe I'm doing it wrong. For me, this tool is not so quick and easy.

The scanner.py is not giving me hits against infected machines. The only way I get hits is to scan using Stinger from safe mode (safe mode is needed to delete the files).

For the record, of my workstations 90% plus were patched. It was a few workstations that were missed plus a weak password on the rest that got us in trouble.

You can search "conficker" on picasa to seen the screenshots of the scanner.py failing to detect anything on an infected machine. Also, there is no firewall running on this PC.

This reminds me of the Michelangelo Virus

[PCMeister]

While technology has certainly changed and the consequences have increased due to a company's online presence, or an individual for that matter, the hype surrounding Conficker reminds me of the infamous Michelangelo Virus doing its deed on March 6. A quick google search revealed an archived memo sent out at Stanford. I'll paste it here as not to /. their webservers unnecessarily; how kind of me. lol!

-- Stanford memo 03/01/1993 --
"NEWS RELEASE

03/01/93

CONTACT: Stanford University News Service (415) 723-****

Michelangelo virus due to strike again March 6

STANFORD -- Employees who use an IBM PC, PS/2 or compatible computer should be aware that there is a small chance their computers have been infected with an infamous computer virus.

The "Michelangelo" virus, which is an especially destructive strain, may erase parts of a user's hard drive. This can happen every March 6, which is the famous artist's birthday, according to security officials in the Stanford Data Center.

The computer must be turned on sometime March 6 for the virus to do any damage. Since March 6 falls on a Saturday this year, the risk of any damage is relatively low, according to Bill Bauriedel, the Data Center's security chief.

However, he said, it is simply good practice to run an anti-virus program periodically to check for the presence of one or more viruses. Michelangelo is only one of more than 700 identified viruses that can infect a computer.

"Even though you may not have the Michelangelo virus, your computer may be infected with something else," Bauriedel said. "While probably not as dangerous as Michelangelo, these other viruses should be disinfected as well - once disinfected, they can't spread from your machine to someone else's machine."

Staffers and faculty who have a Forsythe account and use Samson can download an antivirus program called F-PROT. For instructions on how to perform the download, issue these two commands:

USE WYL.GB.SEC.FPROT and PRINT.

Users without a Forsythe account can exchange a blank floppy for the antivirus program either at the consulting office on the second floor of Sweet Hall or at the Information Security Office in Spruce Hall, room F19.

For more information on matters of computer security, contact ******* at 723-****.

930301Arc3381.html"

Nmap 4.85BETA5 just released

[fv]

I'm happy to report that we've just released Nmap 4.85BETA5 with Conficker detection so you can do that scan! The actual recommended command is:

nmap -PN -T4 -p139,445 -n -v --script=smb-check-vulns --script-args safe=1 [targetnetworks]

For more details, see the announcement at http://insecure.org.
-Fyodor

Whew! Dodged THAT bullet at least!

[rts008]

Well, I have to give him credit for not 'begging the question'.(could not help myself, sorry) ;-)

Hope this helps!

[rts008]

The last comparison/shootout/review of home/personal use AV software I heard about was touting NOD32 as top dog, with Avast Home and AVG Free as second and third, respectively.*
I do not know if NOD32 has a free for personal use version or not, but both of the others are free for personal use.(both also have paid for business versions that are more net capable)
Have also heard good things about BitDefender.

I have used both Avast and AVG(but not NOD32), and use one of the two on the rare occasion I work on friend's or family's computers. They both have worked well for all.

*This was about a year-year and a half ago. Find a reputable writeup(anantech, tom's hardware, etc. for more current info) and check them out.

update: A quick google check shows BitDefender to be in the top three ranking wherever I check, and NOD32 stays in the top six, with both of the others being in the top ten. BitDefender and NOD32 have free trials, but will set you back $25-40 USD to keep after the trial, AVG and Avast both still have free home versions.

Re:It just amazes me

[Techman83]

I was under the impression that AU could raise the privileges of a Non-Admin user? I noticed the option on the N-lite install I was playing with last night.

Set the date forward to April 1st and see?

[DJRikki]

Set the date forward to April 1st and see what happens with an infected machine with a packet sniffer? If it goes out to the net to check remote time servers packet sniff to see where its looking and forge answers?

Re:It just amazes me

[Anonymous Coward]

Notification of updates for normal users can be set up via group policies.

That they by default are not informed is the failure. If they were informed, . . .

Stupid question

[Anonymous Coward]

Because I am lazy and dont feel like digging through the scripts what is posted if a box is found with conficker on it? I got all cleans anyone find any infected?