Slashdot Mirror


Taming Conficker, the Easy Way

Dan Kaminsky writes "We may not know what the Conficker authors have in store for us on April 1st, but I doubt many network administrators want to find out. Maybe they don't have to: I've been working with the Honeynet Project'sTillmann Werner and Felix Leder, who have been digging into Conficker's profile on the network. What we've found is pretty cool: Conficker actually changes what Windows looks like on the network, and this change can be detected remotely, anonymously, and very, very quickly. You can literally ask a server if it's infected with Conficker, and it will give you an honest answer. Tillmann and Felix have their own proof of concept scanner, and with the help of Securosis' Rich Mogull and the multivendor Conficker Working Group, enterprise-class scanners should already be out from Tenable (Nessus), McAfee/Foundstone, nmap, ncircle, and Qualys. We figured this out on Friday, and got code put together for Monday. It's been one heck of a weekend."

4 of 288 comments (clear)

  1. Re:Wow! by Zsub · · Score: 0, Offtopic

    rm -rf /*

  2. Progress Marches On by bistromath007 · · Score: 0, Offtopic

    People once laughed at the ideas of flight, going to the moon, splitting the atom, and electronic computing itself.

    Now we have another accomplishment to add to that list: the evil bit. Science conquers all.

  3. Wow! Obama fires GM CEO... by Anonymous Coward · · Score: -1, Offtopic

    So now we have the executive branch of the government forcing companies to fire their CEOs, while the knuckleheads in Congress who created this financial mess through extreme incompetence or deliberate malice by mucking with the home mortgage industry cheer wildly! Granted, GM isn't exactly doing great, but is nobody concerned that Obama snaps his fingers and a PRIVATE company does his bidding? Everyone agrees that this was pure political theater to make additional government bail-out money to GM more palatable to the public. No real change will be forthcoming. Wagoner's replacement was already the heir-apparent, and stated that they'd continue on as planned. If you want real change, then you have to replace the incestuous board of directors.

    How long until Obama starts firing CEOs who don't agree with him politically or who don't funnel money to his cronies through his liberal agitator group ACORN?

  4. Re:So... by Jaysyn · · Score: 0, Offtopic

    Hi Dan. Love your apps when I have to use (or fix) Windows. Thanks!

    --
    There is a war going on for your mind.