Slashdot Mirror
Using Conficker's Tricks To Root Out Infections
iago-vL writes "Despite having their domain blacklisted by Conficker, the folks at Nmap have released version 4.85BETA8, which promises better detection of the Conficker worm. How? By talking to it on its own peer-to-peer network! By sending encrypted messages to a suspect host, the tools will get Conficker.C and higher to reveal itself. This curious case of using Conficker's own tricks to find it is similar to the last method that we discussed. More information from the author is available, as well as a download for the new release (or, if you're a Conficker refugee, try a mirror instead)."
that thinks Conficker is actually really cool? I mean, damage aside, it's pretty darn impressive.
What if Conficker D changes its 'protocol' and marks every computer that sends an 'old message' as either a host that needs updating or a nmapping attacker/next victim?
Easiest way to detect if you're infected: see if you can reach nmap.org
From TFA:
To scan you network quickly for Conficker infections before the next variant breaks this new techinque, we recommend this command: nmap -p139,445 --script p2p-conficker,smb-os-discovery,smb-check-vulns --script-args checkconficker=1,safe=1 -T4 [target networks]
Now forgive me but people like my parents (running Windows 98 until last year, now on XP) with no idea about security, no anti-virus scanner (despite my lectures over the phone) and no idea what the symptoms of a virus, worm or other malware, are not going to find this information, nor know what to do with it if they did.
Computing professionals might have little trouble detecting and removing Conficker, or are safe in the knowledge that they were protected before its release, but we'll still have to deal with the consequences of a botnet comprised of infected computers belonging to people with little or no technical computer knowledge.
You can advertise in this sig from as little as £99.99 a month!
http://interviews.slashdot.org/comments.pl?sid=63874&cid=5938151
Shake his nads?
Doesn't this sound like a temporary measure
You say that like you think there's an alternative. There isn't.
The viral ecology is an real ecology, where like all ecologies nothing is stable and everything is temporary.
What this demonstrates, though, is that there are inherent limits to viral capabilities, because with added capability there is added vulnerability. This is true for OS's but it is equally true for viruses (yes, that is a correct English plural, ok?)
So as virus programs get more complex and capable, they will generally also become more open to detection via exploitation of exactly those additional capabilities.
Blasphemy is a human right. Blasphemophobia kills.
To scan you network quickly for Conficker infections before the next variant breaks this new techinque[sic], we recommend this command:
nmap -p139,445 --script p2p-conficker,smb-os-discovery,smb-check-vulns --script-args checkconficker=1,safe=1 -T4 [target networks]
If you have time for a slower but more comprehensive scan, use this instead:
nmap --script p2p-conficker,smb-os-discovery,smb-check-vulns -p- --script-args checkall=1,safe=1 -T4 [target networks]
"I have downloaded hundreds and hundreds of records, why would I care if somebody downloads ours?" Robin Pecknold
Did you ever stop to think that maybe the original poster isn't from an English speaking country (e.g. America).
Comment removed based on user account deletion
What? I thought every country spoke English. But then again I am just a dumb American.
"But this one goes to 11!"
Isn't the guy who created nmap active on slashdot? (fyodor or something like that?)
Ubuntu is an African word meaning 'I can't configure Debian'
it doesn't land you in jail, or has the potential prospect of landing you in jail. If there is even the possibility of going to jail, then for me, it doesn't pay. There's already enough to worry about aside from dropping the soap...
Offtopic: Due to the rather poor showing many Americans make posting with poor spelling and grammar, its somewhat understandable that one might assume a posting with poor spelling and/or grammer comes from a native English-like language speaker...
Ontopic: Malware sucks. People who write malware and release it into the real world suck. I don't admire them any more than I would admire the perpetrators of a successful act of terrorism resulting in mass murder. A brilliant individual who chooses to use his/her skills to destroy society rather than build it up deserves scorn, not admiration. Destruction is rather easy. Construction is difficult. In a similar vein, I don't salute the use of malware to prove security vulnerabilities any more than I would clap for some bonehead who throws a rock through my window to show how easy it is to break into my house.
[citation needed]
anyway, imho, if it did happen, the kids fault for:
1) being a dick
2) running an unsecured computer while pretending to know about computers
IranAir Flight 655 never forget!
Viruses which only accept RSA-signed commands can be made more and more capable while being far less vulnerable.
Your reductionism is overdone.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
to kick Conficker's ass like in Terminator:SCC we have John Henry to fight Skynet...
This just made me think: what if the conficker authors came forward to press charges under the DMCA for reverse engineering their code? Would they have a legal case against the white hats?
Curious Yellow here we come...
Emerald Astrology
I have discovered that almost all of the computers infected with Conficker apparently come with a sticker on the front for ready identification. It has a flag shape divided into red, green, blue and yellow quarters. If you have this flag sticker you might be at risk!
Help stamp out iliturcy.