Slashdot Mirror
Was Conficker Stuxnet's Trojan?
Rambo Tribble writes "Reuters has published a provocative article describing the findings of cyberwarfare expert John Bumgarner, a former Army intelligence officer. His contention is that Conficker identified targets, then opened the door for Stuxnet. 'His analysis challenges a common belief that Conficker was built by an Eastern European criminal gang to engage in financial fraud. The worm's latent state had been a mystery for some time. It appears never to have been activated in the computers it infected, and security experts have speculated that the program was abandoned by those who created it because they feared getting caught after Conficker was subjected to intense media scrutiny. If confirmed, Bumgarner's work could deepen understanding of how Stuxnet's commanders ran the cyber operation that last year sabotaged an underground facility at Natanz, where Iranian scientists are enriching uranium using thousands of gas centrifuges.'"
No current operating system is immune to exploits. An accurate statement would be 'I use apple because their low population in the wild makes them unpopular targets for malware authors to write exploits for'.
"I will trust Google to 'do no evil' until the founders no longer run it." Hello Alphabet.
This thread is like a Santa Ana whoosh.
It also seems possible that whoever wrote Stuxnet had pulled apart one or more pre-existing worms out there and decided to commandeer one, or at least collect intelligence from it. I mean, if someone has already done a bunch of dirty work for you, and you can piggy back on it "safely", then you have an effective vector for fast initial deployment.
Program Intellivision!
If this was released by the US government, could infections in the government of other countries be considered an act of war? After all it is theft of resources and corruption of data.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
I'm doubting this story.
Admittingly, the following two clues as to who the author(s) of Conficker are, are circumstantial, but i would like to offer them to you guys for consideration since this behavior from Conficker has been observed and documented -
1.
"Once Conficker [A] infects a system, it includes a keyboard layout check, via the GetKeyboardLayout API, to determine whether the victim is currently using the Ukrainian keyboard layout. If so, [A] will exit without infecting the system. This suicide exit scheme has been observed in other malware-related software, such as Baka Software's Antivirus XP Trojan installer."
The suggestion is that Conficker's author(s) were trying to avoid violating the local laws of their native country. Presumably Ukraine (who's laws concerning computer crime seem to have several loopholes).
Source
2.
In a honeynet, there was a connection observed of the [B] variant of Conficker using variant [A]'s protocol to take over a machine already infected with Variant [A]... so it was Conficker trying to replace variant [A] with Variant [B]. For several reasons (located in the source link below), it is suggested the packet captured was an instance of Conficker testing it's own robust nature to not be taken over by another author or virus.
The significance of this is the "hybrid" packet described above came from an address owned by, again, Baka Software in the Ukraine.
Source
I use apple because their low population in the wild makes them unpopular targets for malware authors to write exploits for.
So, what's Linux' excuse, considering vast numbers of it installed on servers and numerous other devices power the web?
Hint: fragility makes Win* the preferred target, not popularity.
"Tongue tied and twisted, just an Earth bound misfit
They sent it down to us via the SETI radio astronomy antennas. From there it spread using the SETI@home grid. The aliens became alarmed when Werner von Braun started playing with rockets, and started on a long term program to thwart what they saw as an effort from us to plaster them with rockets. The Voyager and Galileo probes were actually built to scout out potential targets of alien weapons of mass cosmic destruction. When briefed about our program, the alien Supreme Leader cursed at the German scientist, and his plans, and his meddling kids, and called him a "fucker." The label with the aliens stuck, so they named their worm "Con-Ficker", "ficker" being German for "fucker" and "con" meaning "against." "Con-ficker", "Against-fucker" . . . Aliens pissed off at German Earthlings rocketry tom-foolery . . . write a virus to control us . . . send it down to the SETI folks, who are foolish enough to be looking for aliens anyway . . . or maybe clever enough to spot alien targets.
It all falls into place if you really think about it.
Probably.
At least my wacky speculation is as plausible as that from anyone else. And mine is definitely wackier. Lasts longer. Tastes better.
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
Like the saying goes: If builders built buildings the way that programmers wrote programs ...
Shitty saying. There's another (paraphrased): Crap programmers can write crap programs in any language.
Still another: An idea is not responsible for those who hold it. Just because Bill Gates had no idea what he was doing, doesn't mean all programmers have no idea what they're doing. Sweeping generalizations are *always* wrong.
Some (many?) crap programmers have created many deplorable situations. Happily, I'm one of the guys who gets called in to clean up their messes. When I leave, the problem's solved, never to return. They're left with one less unmaintainable mess.
May dmr's ghost haunt you to your grave, and beyond. >:-(
"Tongue tied and twisted, just an Earth bound misfit
Bad comparison. Much better one would be "arsonist".
And arsonists did destroy entire portions of the cities when successful before we perfected fire fighting and started building less buildings out of wood and worked on improved fire safety of said buildings.