Slashdot Mirror

← Back to Stories (view on slashdot.org)

After 1 Year, Conficker Infects 7M Computers

Posted by Soulskill on from the happy-anniversary-now-run-an-antivirus dept.

alphadogg writes "The Conficker worm has passed a dubious milestone. It has now infected more than 7 million computers, security experts estimate. On Thursday, researchers at the volunteer-run Shadowserver Foundation logged computers from more than 7 million unique IP addresses, all infected by the known variants of Conficker. They have been able to keep track of Conficker infections by cracking the algorithm the worm uses to look for instructions on the Internet and placing their own 'sinkhole' servers on the Internet domains it is programmed to visit. Conficker has several ways of receiving instructions, so the bad guys have still been able to control PCs, but the sinkhole servers give researchers a good idea how many machines are infected."

18 of 95 comments (clear)

  1. Ding! by Mazda6s · · Score: 5, Funny

    Gratz

  2. Re:Cleaning job by Anonymous Coward · · Score: 5, Informative

    Maybe they can inject instructions to the worm so it shutsdown but not before it spreads the "fix" to other computers?

    Conficker is notable because it isn't a total piece of script kiddie crap. It uses asymmetric crypto to only accept instructions from the creator. It also patches the hole on the way in, so you couldn't even reinfect Conficked boxes with a cleaner.

  3. I'm safe! by dword · · Score: 4, Funny
    I've read that Antivirus 2009 removes conflicker, so I have installed it. Now I have to get rid of the other viruses I'm getting warnings about and for that I only need
    • Cyber Security
    • Alpha Antivirus
    • Braviax
    • Windows Police Pro
    • Antivirus Pro 2010
    • PC Antispyware 2010
    • FraudTool.MalwareProtector.d
    • Winshield2009.com
    • Green AV
    • Windows Protection Suite
    • Total Security 2009
    • Windows System Suite
    • Antivirus BEST
    • System Security
    • Personal Antivirus
    • System Security 2009
    • Malware Doctor
    • Antivirus System Pro
    • WinPC Defender
    • Anti-Virus-1
    • Spyware Guard 2008
    • System Guard 2009
    • Antivirus 2010
    • Antivirus Pro 2009
    • Antivirus 360
    • MS Antispyware 2009

    or

    • A Unix-based operating system (such as OS X or Ubuntu)
    1. Re:I'm safe! by maxume · · Score: 4, Insightful

      It's too bad there isn't a tiresome mod.

      --
      Nerd rage is the funniest rage.
    2. Re:I'm safe! by thePowerOfGrayskull · · Score: 3, Informative

      Argue all you want, but you can't deny that such malware is a whole lot less likely to download and install itself on a Unix-based system.

    3. Re:I'm safe! by dword · · Score: 4, Informative

      Half the things you listed are malware themselves.
      Half? They're ALL malware (except for the last one, of course ;)

      Signed,
      Proud and happy user of Windows 7, OS X and Ubuntu

    4. Re:I'm safe! by buchner.johannes · · Score: 4, Funny

      because its ./configure script fails

      --
      NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
  4. Not really 7m at all by Yobgod+Ababua · · Score: 5, Informative

    Everyone should read the original page, particularly the Introduction and section explaining how to interpret their population numbers.
    Here's a relevant quote:

    "The daily numbers should represent the potential maximum level of the infection, but in previous test cases usually prove to be much less than that maximum. So, take the range of 25% to 75% of the values that we display as the possible infection population and you will be close to the real value."

    So the people actually providing these numbers are really saying that the current number of infections is likely to be between 1,750,000 and 5,250,000.

    1. Re:Not really 7m at all by ColdWetDog · · Score: 3, Funny

      So the people actually providing these numbers are really saying that the current number of infections is likely to be between 1,750,000 and 5,250,000.

      Thanks, I feel so much better now.

      --
      Faster! Faster! Faster would be better!
  5. Re:Cleaning job by migla · · Score: 3, Funny

    I don't know if that was an episode of SG1, but you sig does remind me of Agatha Christie.

    --
    Some of my favourite people are from th US; Vonnegut, Chomsky, Bill Hicks.
  6. Re:Cleaning job by migla · · Score: 3, Informative

    That would depend on whether the authors chose encryption that could be decrypted in a billion years with the combined computing power of today or if they chose some smaller number or a larger one.

    --
    Some of my favourite people are from th US; Vonnegut, Chomsky, Bill Hicks.
  7. Re:Research = do not touch. by maharb · · Score: 4, Informative

    Except jail time.

  8. Re:Cleaning job by icebike · · Score: 5, Informative

    Is there a way for the researchers to use the sinkhole to clean the worm?
     

    Probably not.

    But YOU CAN HELP:

    Just Click the the CornFlicker Eye Chart to test your machine:

    http://www.confickerworkinggroup.org/infection_test/cfeyechart.html

    You can read about it in the link posted in TFA.

    --
    Sig Battery depleted. Reverting to safe mode.
  9. Hmm by Anonymous Coward · · Score: 5, Funny

    Conficker broke 7 Million Infections...
    Microsoft just released Windows 7...

    Has anyone ever seen Conficker and Windows 7 in the same room together?

  10. Re:Action not words! by thePowerOfGrayskull · · Score: 3, Informative

    ? Did they even put up a page where you can check yourself or your network?

    Yes

  11. Re:Cleaning job by dangitman · · Score: 4, Funny

    Probably not.
    But YOU CAN HELP:
    Just Click the the CornFlicker Eye Chart to test your machine:

    Do you think I'm some kind of patsy? I'm not getting suckered into your virus propagation scam!

    --
    ... and then they built the supercollider.
  12. Re:Good point by Anonymous Coward · · Score: 4, Insightful

    Second time? Citation needed, seriously.

    Apart from self-contained data loss bugs that corrupt single files or bork their own data, the only difference between them is the identity of the data affected--deleting your user folder is no more or less "destructive" than deleting the Program Files folder or the System32 folder or any other combination of important data.

    More to the point, you have a short and selective memory. On the Windows side, the number of data loss bugs in the Microsoft KB is staggering--many of which far more easily triggered than the Snow Leopard bug (which PC World was unable to reproduce). There have been plenty of famous and significant data loss bugs in Windows' history, like the Windows 98SE shutdown bug, the Windows 2000 ATA bug, and even the Windows XP bug that ate the user data folders, quite similar to the Snow Leopard bug: http://www.v3.co.uk/vnunet/news/2116562/winxp-bug-ate.

    How about the similar data loss bug in the Linux kernel a few years ago: http://news.cnet.com/2100-1001-976427.html. A simple Google search will reveal several more, before and since, in the kernel and in distribution packages.

    Then there's the infamous Mozilla bug that wiped out the entire Program Files directory on Windows: http://www.mozillazine.org/talkback.html?article=4264

    It's not just user-level software development, either. Just look at Intel's repeated data loss bugs in their SSDs.

    All the big names have let a bug like this slip at one time or another. It's unfortunate, but inevitable.

  13. So disappointing by ndogg · · Score: 4, Interesting

    I know I'm a terrible person for thinking this, but I was really curious about the chaos that was to ensue once Conficker's creators brought the hammer down.

    *sigh*

    Alright, so hell is that way, right? --->

    --
    // file: mice.h
    #include "frickin_lasers.h"