Slashdot Mirror
After 1 Year, Conficker Infects 7M Computers
alphadogg writes "The Conficker worm has passed a dubious milestone. It has now infected more than 7 million computers, security experts estimate. On Thursday, researchers at the volunteer-run Shadowserver Foundation logged computers from more than 7 million unique IP addresses, all infected by the known variants of Conficker. They have been able to keep track of Conficker infections by cracking the algorithm the worm uses to look for instructions on the Internet and placing their own 'sinkhole' servers on the Internet domains it is programmed to visit. Conficker has several ways of receiving instructions, so the bad guys have still been able to control PCs, but the sinkhole servers give researchers a good idea how many machines are infected."
Gratz
Is there a way for the researchers to use the sinkhole to clean the worm?
Maybe they can inject instructions to the worm so it shutsdown but not before it spreads the "fix" to other computers? So along counting the number of PC's infected they also help in cleaning the worm. Impossible?
Slashdot. Unreadable news to annoy nerds. - wonkey_monkey
Are these researchers doing anything about it? Have they handed the IP lists with timestamps over to the appropriate ISPs or corporate network administrators so that the infected systems can be dealt with? Did they even put up a page where you can check yourself or your network?
Merely counting the infected is nothing but mental masturbation. Even the lame government census has moved beyond simply counting.
or
If they were to take control of a botnet to shut it down, they would be potentially liable for damages. IANAL, but being liable is not a good thing.
Everyone should read the original page, particularly the Introduction and section explaining how to interpret their population numbers.
Here's a relevant quote:
"The daily numbers should represent the potential maximum level of the infection, but in previous test cases usually prove to be much less than that maximum. So, take the range of 25% to 75% of the values that we display as the possible infection population and you will be close to the real value."
So the people actually providing these numbers are really saying that the current number of infections is likely to be between 1,750,000 and 5,250,000.
Al Gore should have listened to me and never invented the Internet. The fool!
Its name should be Legion by now.
Conficker broke 7 Million Infections...
Microsoft just released Windows 7...
Has anyone ever seen Conficker and Windows 7 in the same room together?
XP is going out of support. It's time to upgrade right away!
Help stamp out iliturcy.
congratulations conficker!!! let's throw a party for our obediently waiting for the operator-to-hit-the-big-red-button-soldier-overlords
Figure out how to trace a significant percentage of those IPs to their IP blocks to their ISPs. Notify the ISPs. Start a coalition among them to shut off infected customers with a message explaining why and how to fix. Start an advertising campaign to get public support for this and help pressure ISPs to join even though it is not in their short-term self-interest; sell it to them as good PR at this point. Ask them to send a coupon to customers who disinfect, with prorated hours to reimburse the customer for time spent disconnected due to the infection; 90% will never collect on it anyway. Again, pitch this as good PR. Ask them to do this again for the next major infection, again for good PR. (As far as I'm concerned, big companies can crow to the rafters about all their good deeds, as long as they actually do them.)
It's pretty hard to kill this off with tech, but policy might work.
It's rare that you're presented with a knob whose only two positions are Make History and Flee Your Glorious Destiny.
PHJEaR
I hate my linux box for not letting me have this shiny thingy. It is a new trend - 7mil users and growing. I want one too!!!
I know I'm a terrible person for thinking this, but I was really curious about the chaos that was to ensue once Conficker's creators brought the hammer down.
*sigh*
Alright, so hell is that way, right? --->
// file: mice.h
#include "frickin_lasers.h"
If they are basing 7 million PCs on 7 million unique ips, then surely there are likely many more than 7 million pcs infected, as each ip will represent one home router that is broadcasting to all the pcs in that home. And if one is infected, id say its fairly likely that all the rest are infected too, so id multiply that 7 million by the average number of pcs in a household.
A computer worm that spreads through low security networks, memory sticks, and PCs without the latest security updates is posing a growing threat to users blitheringly stupid enough to still think Windows is not ridiculously and unfixably insecure by design.
Despite many years’ warnings that Microsoft regards security as a marketing problem and has only ever done the absolute minimum it can get away with, millions of users who click on any rubbish they see in the hope of pictures of female tennis stars having wardrobe malfunctions still fail to believe that taking Windows out on the Internet is like standing bent over in the street in downtown Gomorrah, naked, arse greased up and carrying a flashing neon sign saying “COME AND GET IT.”
Microsoft cannot believe people have not applied the patch for the problem, just because they keep trying to use Windows Genuine Advantage to break legally-bought systems. “Don’t they trust us?” asked marketing marketer Steve Ballmer.
Millions of smug Mac users and the four hundred smug Linux users pointed and laughed, having long given up trying to convince their Windows-using friends to see sense. “There’s a reason the Unix system on Mac OS X is called Darwin,” said appallingly smug Mac user Arty Phagge.
“It can’t be stupid if everyone else runs it,” said Windows user Joe Beleaguered, who had lost all his email, business files, MP3s and porn again. “Macs cost more than Windows PCs.”
“Yes,” said Phagge. “Yes, they do.”
Ubuntu Linux developer Hiram Nerdboy frantically tried to get our attention about something or other, but we can’t say we care.
http://rocknerd.co.uk
heh, they have more installations than every Linux distro combined. ;)
(and no, installing a new distro every month doesn't count to the Linux total guys, sorry ;) )
Requiem
A good set of these computers which are infected are going to be on dial-up connections, and they might have been offline at the time, also another large set are going to be behind firewalls and what-not which are supposed to prevent whatever on earth the firewalls were originally for, so even though only 7m unique IPs connected, a lot more didn't get the chance. There are probably a lot of 'offline' conficker-infected PCs out there. :) Let's hope that it starts using itself as one large cloud-computing system and acts as a tracker to replace TPB.
and *when* will it upgrade it's host computers to linux? Surely it wants to become stronger. :)
Don't forget that if you have a proxy (and you probably do at work), the eye chart is bogus. The proxy will cache successful hits from a clean computer within your network. :(
However, if you hit F5 (or Ctrl+F5) to refresh, your browser will send out a no-cache request in the HTTP header, which most proxies I've tried it on respect, and thus they go to fetch a new copy of the page. That's right: hitting F5 is not the same as a browser simply requesting the page a second time.