Slashdot Mirror
After 1 Year, Conficker Infects 7M Computers
alphadogg writes "The Conficker worm has passed a dubious milestone. It has now infected more than 7 million computers, security experts estimate. On Thursday, researchers at the volunteer-run Shadowserver Foundation logged computers from more than 7 million unique IP addresses, all infected by the known variants of Conficker. They have been able to keep track of Conficker infections by cracking the algorithm the worm uses to look for instructions on the Internet and placing their own 'sinkhole' servers on the Internet domains it is programmed to visit. Conficker has several ways of receiving instructions, so the bad guys have still been able to control PCs, but the sinkhole servers give researchers a good idea how many machines are infected."
Gratz
Is there a way for the researchers to use the sinkhole to clean the worm?
Maybe they can inject instructions to the worm so it shutsdown but not before it spreads the "fix" to other computers? So along counting the number of PC's infected they also help in cleaning the worm. Impossible?
Slashdot. Unreadable news to annoy nerds. - wonkey_monkey
Are these researchers doing anything about it? Have they handed the IP lists with timestamps over to the appropriate ISPs or corporate network administrators so that the infected systems can be dealt with? Did they even put up a page where you can check yourself or your network?
Merely counting the infected is nothing but mental masturbation. Even the lame government census has moved beyond simply counting.
or
Everyone should read the original page, particularly the Introduction and section explaining how to interpret their population numbers.
Here's a relevant quote:
"The daily numbers should represent the potential maximum level of the infection, but in previous test cases usually prove to be much less than that maximum. So, take the range of 25% to 75% of the values that we display as the possible infection population and you will be close to the real value."
So the people actually providing these numbers are really saying that the current number of infections is likely to be between 1,750,000 and 5,250,000.
Damages schmamages. It's only money. Just get someone who hasn't got any money to front the operation and damages wont mean a thing.
Some of my favourite people are from th US; Vonnegut, Chomsky, Bill Hicks.
Except jail time.
Its name should be Legion by now.
Conficker broke 7 Million Infections...
Microsoft just released Windows 7...
Has anyone ever seen Conficker and Windows 7 in the same room together?
Figure out how to trace a significant percentage of those IPs to their IP blocks to their ISPs. Notify the ISPs. Start a coalition among them to shut off infected customers with a message explaining why and how to fix. Start an advertising campaign to get public support for this and help pressure ISPs to join even though it is not in their short-term self-interest; sell it to them as good PR at this point. Ask them to send a coupon to customers who disinfect, with prorated hours to reimburse the customer for time spent disconnected due to the infection; 90% will never collect on it anyway. Again, pitch this as good PR. Ask them to do this again for the next major infection, again for good PR. (As far as I'm concerned, big companies can crow to the rafters about all their good deeds, as long as they actually do them.)
It's pretty hard to kill this off with tech, but policy might work.
It's rare that you're presented with a knob whose only two positions are Make History and Flee Your Glorious Destiny.
Second time? Citation needed, seriously.
Apart from self-contained data loss bugs that corrupt single files or bork their own data, the only difference between them is the identity of the data affected--deleting your user folder is no more or less "destructive" than deleting the Program Files folder or the System32 folder or any other combination of important data.
More to the point, you have a short and selective memory. On the Windows side, the number of data loss bugs in the Microsoft KB is staggering--many of which far more easily triggered than the Snow Leopard bug (which PC World was unable to reproduce). There have been plenty of famous and significant data loss bugs in Windows' history, like the Windows 98SE shutdown bug, the Windows 2000 ATA bug, and even the Windows XP bug that ate the user data folders, quite similar to the Snow Leopard bug: http://www.v3.co.uk/vnunet/news/2116562/winxp-bug-ate.
How about the similar data loss bug in the Linux kernel a few years ago: http://news.cnet.com/2100-1001-976427.html. A simple Google search will reveal several more, before and since, in the kernel and in distribution packages.
Then there's the infamous Mozilla bug that wiped out the entire Program Files directory on Windows: http://www.mozillazine.org/talkback.html?article=4264
It's not just user-level software development, either. Just look at Intel's repeated data loss bugs in their SSDs.
All the big names have let a bug like this slip at one time or another. It's unfortunate, but inevitable.
I know I'm a terrible person for thinking this, but I was really curious about the chaos that was to ensue once Conficker's creators brought the hammer down.
*sigh*
Alright, so hell is that way, right? --->
// file: mice.h
#include "frickin_lasers.h"
A computer worm that spreads through low security networks, memory sticks, and PCs without the latest security updates is posing a growing threat to users blitheringly stupid enough to still think Windows is not ridiculously and unfixably insecure by design.
Despite many years’ warnings that Microsoft regards security as a marketing problem and has only ever done the absolute minimum it can get away with, millions of users who click on any rubbish they see in the hope of pictures of female tennis stars having wardrobe malfunctions still fail to believe that taking Windows out on the Internet is like standing bent over in the street in downtown Gomorrah, naked, arse greased up and carrying a flashing neon sign saying “COME AND GET IT.”
Microsoft cannot believe people have not applied the patch for the problem, just because they keep trying to use Windows Genuine Advantage to break legally-bought systems. “Don’t they trust us?” asked marketing marketer Steve Ballmer.
Millions of smug Mac users and the four hundred smug Linux users pointed and laughed, having long given up trying to convince their Windows-using friends to see sense. “There’s a reason the Unix system on Mac OS X is called Darwin,” said appallingly smug Mac user Arty Phagge.
“It can’t be stupid if everyone else runs it,” said Windows user Joe Beleaguered, who had lost all his email, business files, MP3s and porn again. “Macs cost more than Windows PCs.”
“Yes,” said Phagge. “Yes, they do.”
Ubuntu Linux developer Hiram Nerdboy frantically tried to get our attention about something or other, but we can’t say we care.
http://rocknerd.co.uk
A good set of these computers which are infected are going to be on dial-up connections, and they might have been offline at the time, also another large set are going to be behind firewalls and what-not which are supposed to prevent whatever on earth the firewalls were originally for, so even though only 7m unique IPs connected, a lot more didn't get the chance. There are probably a lot of 'offline' conficker-infected PCs out there. :) Let's hope that it starts using itself as one large cloud-computing system and acts as a tracker to replace TPB.
and *when* will it upgrade it's host computers to linux? Surely it wants to become stronger. :)