|
Vendaval -> RE: Conficker Worm Due to Hit April 1st (3/31/2009 3:26:27 PM)
|
Thanks for the warning, poen kitten. There is more about Conflicker here on Slate -
"The Worm That Ate the Web"
The latest version of Conficker isn't the first bot to plague the Internet, but it may be the smartest and most sophisticated. And it starts phoning home Wednesday.
By Farhad Manjoo
Posted Monday, March 30, 2009, at 5:20 PM ET
"Much of the media coverage surrounding Conficker has centered on its go-live date, April Fool's Day. But that's something of a red herring; it's unlikely that anything will blow up on the first. The date is significant only to the latest version of Conficker, which is set to go to the Web and check a huge list of sites for files put out by the worm's creators that will instruct the botnet what to do next. But previous versions of Conficker, which are much more common than the latest variant, have been looking for those files for months now. April Fool's Day will only become Conficker Day if its creators chose that day to upload the worm's new instructions.
It's the update files that will determine Conficker's next course of action. At the moment, that's a complete mystery. Even if Conficker amounts to nothing, though, its rise suggests a key vulnerability in the infrastructure of the Internet. By harnessing millions of computers that can be turned to any possible caper, a band of hackers has created a truly dastardly weapon. The big question now is what they'll do with it.
Conficker is far from the Internet's first serious malware attack. But it is perhaps the most well-thought-out and technically cunning ever to hit it big. The word worm conjures up something ugly, inelegant, even dumb. Conficker is anything but—it's the Bugatti of worms, every element exquisitely crafted to advance a single goal: in this case, total control of your machine. To read the security reports documenting Conficker's technical details is to be at once astonished and impressed by its professor Moriarty-type planning. The C variant, for instance, includes a subroutine that claws back at any efforts to remove it. It disables Windows services that patch your machine, prevents your computer from loading up into "safe mode" (a key way to fight nasty malware), and continually scans for and shuts down any security programs that might pose a threat—including the most commonly used Conficker-removal programs. (I'm still confident my machine's free of Conficker because my anti-virus program was able to complete its search; if you notice your program shut down almost immediately after it starts, you may have a problem.)"
http://www.slate.com/id/2214970/
|
|
|
|
