Diagnose Conficker With Web-Based Eye Chart

thomsomc writes "Joe Stewart from the Conficker Working Group has created an eye chart that allows for online identification of Conficker B and C infections. Using basic knowledge of the blacklisting that Conficker employs to avoid attempting to infect IPs that belong to popular Anti-Virus and security firms (including Microsoft), the group whipped up this very simple test to see if you can load content from the various pages. If you can see all of the images, you're more than likely Conficker-free. According to Honeynet, 'This detection method should be more reliable than network scanning based tests. Happy scanning!'" Related: Tech Fragments notes in passing that nothing much seems to have come of conficker's dreaded April 1 deadline.

Comments

Jon Stewart?

[ender1598]

Am I the only one that read it as Jon Stewart and then spent a few minutes trying to figure out the joke on the page?

Re:Jon Stewart?

[Spazztastic]

How can the first post be modded Redundant when he says something that is not a meme or a common sentiment?

Because someone with mod points is either trolling or doesn't understand the meaning of the word. Just another flaw in the system.

Re:Jon Stewart?

[RevRagnarok]

Just another flaw in the system.

Come and see the flaws inherent in the system! Help! Help! I'm being modded down!

Re:Jon Stewart?

[moxley]

This perfectly illustrates one of the unspoken rules of Slashdot culture:

*If the sole point of your post is to either complain, call a moderation unfair, or ask for an explanation about a moderation, be prepared for your post to be modded in exactly the same way.*

It's really a wonderful cultural practice, and is preparing interworldnettubez denizens everywhere for what they can expect when asking similar questions of real world "moderators" like cops and politicians.

Let's all keep up the good work!

 

sweet

[rbrausse]

a nice, easy, reliable way to detect a conficker infection.

great!

Re:sweet

[ShieldW0lf]

a nice, easy, reliable way to detect a conficker infection.

As long as it doesn't get slashdotted... that might cause a new panic :P

Re:sweet

[RiotingPacifist]

i panicked for a sec, im on linux but thanks to virgin media the bottom two images didn't load. thankfully the chart said: any other combo = shite internet!

Re:sweet

[imemyself]

Assuming you don't use a transparent proxy, then you would still get false negatives. The "eye chart" test won't work with proxies, not because of caching, but because with a non-transparent proxy Conficker wouldn't see that your computers are actually communicating with the security people's IP ranges.

Re:sweet

[Chabil Ha']

The chart or the virus?

Re:sweet

[moose_hp]

The reason there are logos there is to test that your browser can actually display images before you start panicking that you don't see the logos from the anti-virus. They are also good to compare download times in case that your Internet connection is just slow at that time.

I copied to source code into an Apache server here, changed the logos on the lower row to point to images on the respective sites (instead of local images) and downloaded the "description" images. Works like a charm, we already found an infected laptop.

Re:sweet

[Matt Perry]

shite internet!

Just be glad you aren't using Sunni internet.

I see a dog.

[memorycardfull]

Dog with head split in half.

Re:I see a dog.

[interkin3tic]

Funny, I see a penguin, a blowfish, the devil, and some boring corporate logos. No dogs. You must have Confiker R variant (Rorschach variant)

Re:I see a dog.

[agnosticanarch]

I was going to explain it, but I got caught up looking at the pretty butterfly.

Lynx support?

[MrEricSir]

Come on, it doesn't work in Lynx? I want my money back.

Re:Lynx support?

[MBCook]

Works here.

You must be infected.

If Conficker was designed by a security guru...

[Khopesh]

Because there is so much money to be made by botnets these days, it has moved from a "look what I can do" feat to a real business in its own right (legality aside). It is widely assumed that Conficker is among the first of a new breed of very carefully produced viruses and worms, written by professional developers who are paid quite well for their computer security and anti-anti-virus skills.

This class of developer knows exactly how the anti-virus companies work. It should have been expected by the Conficker designers that their virus would be examined in isolated networks. The designers would therefore be able to take advantage of that (it's easy enough to detect -- no word from the master servers, no ability to further infect, etc), and that's what we saw yesterday. Planned panic for no reason. At this point, most people think Conficker is either no serious threat, or an April Fools' Day prank. These people could be very wrong.

With the pressure off, infected machines are now able to go about their intended business, which could be sending spam, using distributed computing, farming user data, coordinated attacks of one type or another, or merely a conspiracy to protect computers from infections (a virally spreading anti-virus utility that you can't detect, stop, or remove? ingenious!).

The merits of a secret anti-virus product are more down-to-earth than you might think; most high-end zombie masters write their viruses so that they can't be detected by users and so that they are the sole "pwners" of the system -- competition is bad in this field. What you end up with is zombie masters who are suddenly interested in maintaining your computer for you - virus-free (save their virus), clean, efficient. If this zombie master is your federal government, merely reserving the right to use ("draft") your system as a "minute man" for emergencies where your computing power or attacking capabilities are needed, that might be a fair "tax."

Re:If Conficker was designed by a security guru...

[Anonymous Coward]

No, they didn't plan on misleading the public about April 1st. Even the real(not PR driven) security researches didn't think anything bad would happen. The public and news sites were just using it as an excuse to make a fuss again.

Conficker has already had a few of these dates, April 1st is just the date it starts actively looking for any future updates to the worm. As long as everything is going well so far, they won't update it.

Slashdotted scare

[interkin3tic]

Clicked on the link, page unavaliable. A reload did work.

Should be in the summary: If the page doesn't load at all, that doesn't mean you're infected, that means "Poor Internet connection?" If the page loads but some of the images don't, THAT is a positive.

Thank god

[diablovision]

Whew, I haven't had that much relief since I accidentally ate that whole jar of exlax....

Re:Very nice & interesting technique

[bhtooefr]

My HOSTS file uses data from reputable sources like STOPBADWARE.ORG

Sucks when / is blocked, now, isn't it? :)

Slashdotted

[56]

Looks like it's slashdotted... or my ubuntu machine has Conficker!

Mirror

[Anonymous Coward]

Conficker Eye Chart

Conficker Eye Chart

How to interpret:

If you see this above:It probably means this:

= Normal/Not Infected by Conficker (or using proxy)
= Possibly Infected by Conficker (C variant or greater)
= Possibly Infected by Conficker A/B variant
= Image loading turned off in browser?
Any other combination= Poor Internet connection?

Explanation:

Conficker (aka Downadup, Kido) is known to block access to over 100 anti-virus and security websites.

If you are blocked from loading the remote images in the first row of the top table above (AV/security sites) but not blocked from loading the remote images in the second row (websites of alternative operating systems) then your Windows PC may be infected by Conficker (or some other malicious software).

If you can see all six images in both rows of the top table, you are either not infected by Conficker, or you may be using a proxy server, in which case you will not be able to use this test to make an accurate determination, since Conficker will be unable to block you from viewing the AV/security sites.

F-Secure and the F-Secure Logo are trademarks of F-Secure Corporation.

SecureWorks and the SecureWorks Logo are registered trademarks of SecureWorks Inc.

Trend Micro and the T-Ball logo are trademarks or registered trademarks of Trend Micro Inc.

Re:Mirror

[Onymous Coward]

Ha.

Anyway, the page is a clever idea.

Here's another interpretation to add to the list: Some of the sites that the page pulls images from are Slashdotted.

Oh shit

[atomicthumbs]

I can't see the chart at all! Shit shit shit!

Pick your punchline

[Comboman]

Am I the only one that read it as Jon Stewart and then spent a few minutes trying to figure out the joke on the page?

Pick your "Daily Show"-style punchline for this story:

• If we can diagnose computer viruses with an eye-chart, does that mean McAffee can tell me if I need glasses?
• Users of dual-boot computers should consult the bifocal eye-chart.
• Your mother was right! If your computer visits those nasty virus-infected pron sites, you WILL go blind.

How long before they ruin this test

[aarenz]

All they have to do is fake the images on their servers and this test is toast. Give them another 4 hours to create a work around.

Oops

[Wilson_6500]

Considering how quickly and effectively we managed to slashdot this helpful site, It's pretty obvious that we are the worms.

Another option for the eye chart

[fava]

And if you can see the top row and not the bottom one it means you work at Microsoft.

Re:How long before...

[moose_hp]

Then we (it's open source after all!) modify the test to use iframes (ewwww... but useful in this situations) to actually load the full pages, once Conficker gets updated so it allows the pages, we move to actually downloading the patches with a message like "if the file doesn't download, you're probably infected", by the time Conficker gets good enought to actually allow the patches but modifing them on the fly so they are not useful (just random noise with the same size and filename), then we're screwed.

Maybe I shouldn't give them ideas. I bet the author of Confickr reads slashdot.