Jump to content

Conficker

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by 195.243.113.249 (talk) at 10:18, 10 February 2010 (→‎Name). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Conficker
Alias
TypeComputer worm
SubtypeComputer virus
ClassificationUnknown

Conficker, also known as Downup, Downadup and Kido, is a computer worm targeting the Microsoft Windows operating system that was first detected in November 2008.[1] It uses flaws in Windows software to co-opt machines and link them into a virtual computer that can be commanded remotely by its authors. Conficker has since spread rapidly into what is now believed to be the largest computer worm infection since the 2003 SQL Slammer,[2] with more than seven million government, business and home computers in over 200 countries, now under its control. The worm has been unusually difficult to counter because of its combined use of many advanced malware techniques.[3]

History

Name

The origin of the name Conficker is thought to be a portmanteau of the English term "configure" and the German word Ficker, which means "fucker."[4][5] On the other hand, Microsoft analyst Joshua Phillips described the name as a rearrangement of portions of the domain name trafficconverter.biz,[6] which was used by early versions of Conficker to download updates.

Discovery

The first variant of Conficker, discovered in early November 2008, propagated through the Internet by exploiting a vulnerability in a network service (MS08-067) on Windows 2000, Windows XP, Windows Vista, Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2 Beta.[7] While Windows 7 may have been affected by this vulnerability, the Windows 7 Beta was not publicly available until January 2009. Although Microsoft released an emergency out-of-band patch on October 23, 2008 to close the vulnerability,[8] a large number of Windows PCs (estimated at 30%) remained unpatched as late as January 2009.[9] A second variant of the worm, discovered in December 2008, added the ability to propagate over LANs through removable media and network shares.[10] Researchers believe that these were decisive factors in allowing the worm to propagate quickly: by January 2009, the estimated number of infected computers ranged from almost 9 million[11][12][13] to 15 million.[14] Antivirus software vendor Panda Security reported that of the 2 million computers analyzed through ActiveScan, around 115,000 (6%) were infected with Conficker.[15]

Recent estimates of the number of infected computers have been more notably difficult because of changes in the propagation and update strategy of recent variants of the worm.[16]

Impact in Europe

Intramar, the French Navy computer network, was infected with Conficker on 15 January 2009. The network was subsequently quarantined, forcing aircraft at several airbases to be grounded because their flight plans could not be downloaded.[17]

The United Kingdom Ministry of Defence reported that some of its major systems and desktops were infected. The worm has spread across administrative offices, NavyStar/N* desktops aboard various Royal Navy warships and Royal Navy submarines, and hospitals across the city of Sheffield reported infection of over 800 computers.[18][19]

On 2 February 2009, the Bundeswehr, the unified armed forces of the Federal Republic of Germany reported that about one hundred of their computers were infected.[20]

An infection of Manchester City Council's IT system caused an estimated £1.5m worth of disruption in February 2009. Bosses have since banned the use of memory sticks and disabled USB drives; this is how the infection was believed to have occurred.[21]

A memo from the British Director of Parliamentary ICT informed the users of the House of Commons on 24 March 2009 that it had been infected with the worm. The memo, which was subsequently leaked, called for users to avoid connecting any unauthorized equipment to the network.[22]

The worm infected Greater Manchester Police's computer system in January 2010, quickly spreading through the system. It lead to the force's computer network being disconnected from the Police National Computer and officers having to contact other forces to run checks on vehicles and people.[23]

Operation

Although almost all of the advanced malware techniques used by Conficker have seen past use or are well-known to researchers, the worm's combined use of so many has made it unusually difficult to eradicate.[24] The worm's unknown authors are also believed to be tracking anti-malware efforts from network operators and law enforcement and have regularly released new variants to close the worm's own vulnerabilities.[25][26]

Five variants of the Conficker worm are known and have been dubbed Conficker A, B, C, D and E. They were discovered 21 November 2008, 29 December 2008, 20 February 2009, 4 March 2009 and 7 April 2009, respectively.[27][28]

Variant Detection date Infection vectors Update propagation Self-defense End action
Conficker A 2008-11-21
  • NetBIOS
    • Exploits MS08-067 vulnerability in Server service[26]
  • HTTP pull
    • Downloads from trafficconverter.biz
    • Downloads daily from any of 250 pseudorandom domains over 5 TLDs[29]

None

  • Updates self to Conficker B, C or D[30]
Conficker B 2008-12-29
  • NetBIOS
    • Exploits MS08-067 vulnerability in Server service[26]
    • Dictionary attack on ADMIN$ shares[31]
  • Removable media
    • Creates DLL-based AutoRun trojan on attached removable drives[10]
  • HTTP pull
    • Downloads daily from any of 250 pseudorandom domains over 8 TLDs[29]
  • NetBIOS push
    • Patches MS08-067 to open reinfection backdoor in Server service[32][33]
  • Blocks DNS lookups
  • Disables AutoUpdate
  • Updates self to Conficker C or D[30]
Conficker C 2009-02-20
  • NetBIOS
    • Exploits MS08-067 vulnerability in Server service[26]
    • Dictionary attack on ADMIN$ shares[31]
  • Removable media
    • Creates DLL-based AutoRun trojan on attached removable drives[10]
  • HTTP pull
    • Downloads daily from any of 250 pseudorandom domains over 8 TLDs[29]
  • NetBIOS push
    • Patches MS08-067 to open reinfection backdoor in Server service[32][33]
    • Creates named pipe to receive URL from remote host, then downloads from URL
  • Blocks DNS lookups
  • Disables AutoUpdate
  • Updates self to Conficker D[30]
Conficker D 2009-03-04 None
  • HTTP pull
    • Downloads daily from any 500 of 50000 pseudorandom domains over 110 TLDs[29]
  • P2P push/pull
    • Uses custom protocol to scan for infected peers via UDP, then transfer via TCP[34]
  • Blocks DNS lookups[35]
    • Does an in-memory patch of DNSAPI.DLL to block lookups of anti-malware related web sites[35]
  • Disables Safe Mode[35]
  • Disables AutoUpdate
  • Kills anti-malware
    • Scans for and terminates processes with names of anti-malware, patch or diagnostic utilities at one-second intervals[36]
  • Downloads and installs Conficker E[30]
Conficker E 2009-04-07
  • NetBIOS
    • Exploits MS08-067 vulnerability in Server service[37]
  • NetBIOS push
    • Patches MS08-067 to open reinfection backdoor in Server service
  • P2P push/pull
    • Uses custom protocol to scan for infected peers via UDP, then transfer via TCP[34]
  • Blocks DNS lookups
  • Disables AutoUpdate
  • Kills anti-malware
    • Scans for and terminates processes with names of anti-malware, patch or diagnostic utilities at one-second intervals[38]
  • Updates local copy of Conficker C to Conficker D[39]
  • Downloads and installs malware payload:
  • Removes self on 3 May 2009 (but leaves remaining copy of Conficker D)[41]

From Microsoft

As of 13 February 2009, Microsoft is offering a $USD250,000 reward for information leading to the arrest and conviction of the individuals behind the creation and/or distribution of Conficker.[42] Working group members stated at the 2009 Black Hat Briefings that Ukraine is the probable origin of the worm, but declined to reveal further technical discoveries about the worm's internals to avoid tipping off its authors.[43]

From registries

ICANN has sought preemptive barring of domain transfers and registrations from all TLD registries affected by the worm's domain generator. Those which have taken action include:

  • On 13 March 2009, NIC Chile, the .cl ccTLD registry, blocked all the domain names informed by the Conficker Working Group and reviewed a hundred already registered from the worm list.[44]
  • On 24 March 2009, CIRA, the Canadian Internet Registration Authority, locked all previously-unregistered .ca domain names expected to be generated by the worm over the next 12 months.[45]
  • On 27 March 2009, NIC-Panama, the .pa ccTLD registry, blocked all the domain names informed by the Conficker Working Group.[46]
  • On 30 March 2009, SWITCH, the Swiss ccTLD registry, announced it was "taking action to protect internet addresses with the endings .ch and .li from the Conficker computer worm."[47]
  • On 31 March 2009, NASK, the Polish ccTLD registry, locked over 7,000 .pl domains expected to be generated by the worm over the following five weeks. NASK has also warned that worm traffic may unintentionally inflict a DDoS attack to legitimate domains which happen to be in the generated set.[48]
  • On 2 April 2009, Island Networks, the ccTLD registry for Guernsey and Jersey, confirmed after investigations and liaison with the IANA that no .gg or .je names were in the set of names generated by the worm.

By mid-April all domain names generated by Conficker A had been successfully locked or preemptively registered by April 2009, rendering its update mechanism ineffective.[49]

Removal and detection

Microsoft has released a removal guide for the worm, and recommends using the current release of its Windows Malicious Software Removal Tool[50] to remove the worm, then applying the patch to prevent re-infection.[51]

Third-parties

Third-party anti-virus software vendors McAfee,[52] Panda Security,[53] BitDefender,[54] ESET,[55] F-Secure,[56] Symantec,[57] Sophos,[58] Kaspersky Lab[59] and Trend Micro[60] have released detection updates to their products and claim to be able to remove the worm.

Automated remote detection

On 27 March 2009, Felix Leder and Tillmann Werner from the Honeynet Project discovered that Conficker-infected hosts have a detectable signature when scanned remotely.[33] The peer-to-peer command protocol used by variants D and E of the worm has since been partially reverse-engineered, allowing researchers to imitate the worm network's command packets and positively identify infected computers en-masse.[61][62]

Signature updates for a number of network scanning applications are now available including NMap[63] and Nessus.[64]

It can also be detected in passive mode by sniffing broadcast domains for repeating ARP requests.

US CERT

The United States Computer Emergency Readiness Team (US-CERT) recommends disabling AutoRun to prevent Variant B of the worm from spreading through removable media. Prior to the release of Microsoft knowledgebase article KB967715,[65] US-CERT described Microsoft's guidelines on disabling Autorun as being "not fully effective" and provided a workaround for disabling it more effectively.[66] US-CERT has also made a network-based tool for detecting Conficker-infected hosts available to federal and state agencies.[67]

See also

Wikinews has related news:

References

  1. ^ Protect yourself from the Conficker computer worm, Microsoft, 2009-04-09, retrieved 2009-04-28
  2. ^ Markoff, John (2009-01-22). "Worm Infects Millions of Computers Worldwide". New York Times. Retrieved 2009-04-23.{{cite news}}: CS1 maint: date and year (link)
  3. ^ "Defying Experts, Rogue Computer Code Still Lurks". New York Times. 2009-08-26. Retrieved 2009-08-27.
  4. ^ Grigonis, Richard (2009-02-13), Microsoft's US$5 million Reward for the Conficker Worm Creators, IP Communications, retrieved 2009-04-01
  5. ^ Ficker in dict.cc English-German Dictionary;
    ^ Ficker in bab.la/ German-English Dictionary;
    ^ Ficker in pons German-English Dictionary.
  6. ^ Phillips, Joshua, Malware Protection Center - Entry: Worm:Win32/Conficker.A, Microsoft, retrieved 2009-04-01
  7. ^ Leffall, Jabulani (2009-01-15). "Conficker worm still wreaking havoc on Windows systems". Government Computer News. Retrieved 2009-03-29.
  8. ^ Microsoft Security Bulletin MS08-067 – Critical; Vulnerability in Server Service Could Allow Remote Code Execution (958644), Microsoft Corporation, retrieved 2009-04-15
  9. ^ Leyden, John (2009-01-19), Three in 10 Windows PCs still vulnerable to Conficker exploit, The Register, retrieved 2009-01-20
  10. ^ a b c Nahorney, Ben; Park, John (2009-03-13), "Propagation by AutoPlay", The Downadup Codex (PDF), Symantec, p. 32, retrieved 2009-04-01
  11. ^ "Clock ticking on worm attack code". BBC News Online. BBC. 2009-01-20. Retrieved 2009-01-16.
  12. ^ Sullivan, Sean (2009-01-16). "Preemptive Blocklist and More Downadup Numbers". F-Secure. Retrieved 2009-01-16.
  13. ^ Neild, Barry (2009-01-16), Downadup Worm exposes millions of PCs to hijack, CNN, retrieved 2009-01-18
  14. ^ Virus strikes 15 million PCs, UPI, 2009-01-26, retrieved 2009-03-25
  15. ^ "Six percent of computers scanned by Panda Security are infected by the Conficker worm". Panda Security. 2009-01-21. Retrieved 2009-01-21.
  16. ^ McMillan, Robert (2009-04-15), "Experts bicker over Conficker numbers", Techworld, IDG, retrieved 2009-04-23
  17. ^ Willsher, Kim (2009-02-07), French fighter planes grounded by computer worm, The Daily Telegraph, retrieved 2009-04-01
  18. ^ Williams, Chris (2009-01-20), MoD networks still malware-plagued after two weeks, The Register, retrieved 2009-01-20
  19. ^ Williams, Chris (2009-01-20), Conficker seizes city's hospital network, The Register, retrieved 2009-01-20
  20. ^ Conficker-Wurm infiziert hunderte Bundeswehr-Rechner (in German), PC Professionell, 2009-02-16, retrieved 2009-04-01
  21. ^ Leyden, John (1 July 2009). "Conficker left Manchester unable to issue traffic tickets". The Register.
  22. ^ Leyden, John (2009-03-27), Leaked memo says Conficker pwns Parliament, The Register, retrieved 2009-03-29
  23. ^ "Conficker virus hits Manchester Police computers". BBC News. 2 February 2010. Retrieved 2 February 2010.
  24. ^ Nahorney, Ben; Park, John (2009-03-13), "Propagation by AutoPlay", The Downadup Codex (PDF), Symantec, p. 2, retrieved 2009-04-01
  25. ^ Markoff, John (2009-03-19), Computer Experts Unite to Hunt Worm, New York Times, retrieved 2009-03-29
  26. ^ a b c d Porras, Phillip; Saidi, Hassen; Yegneswaran, Vinod (2009-03-19), An Analysis of Conficker, SRI International, retrieved 2009-03-29
  27. ^ Tiu, Vincent (2009-03-27), Microsoft Malware Protection Center: Information about Worm:Win32/Conficker.D, Microsoft, retrieved 2009-03-30
  28. ^ Macalintal, Ivan; Cepe, Joseph; Ferguson, Paul (2009-04-07), DOWNAD/Conficker Watch: New Variant in The Mix?, Trend Micro, retrieved 2009-04-07
  29. ^ a b c d Park, John (2009-03-27), W32.Downadup.C Pseudo-Random Domain Name Generation, Symantec, retrieved 2009-04-01
  30. ^ a b c d Nahorney, Ben (2009-04-21). "Connecting The Dots: Downadup/Conficker Variants". Symantec. Retrieved 2009-04-25.
  31. ^ a b Chien, Eric (2009-02-18), Downadup: Locking Itself Out, Symantec, retrieved 2009-04-03
  32. ^ a b Chien, Eric (2009-01-19), Downadup: Peer-to-Peer Payload Distribution, Symantec, retrieved 2009-04-01
  33. ^ a b c Leder, Felix; Werner, Tillmann (2009-04-07), Know Your Enemy: Containing Conficker (PDF), HoneyNet Project, retrieved 2009-04-13
  34. ^ a b W32.Downadup.C Bolsters P2P, Symantec, 2009-03-20, retrieved 2009-04-01
  35. ^ a b c Leung, Ka Chun; Kiernan, Sean (2009-04-06), W32.Downadup.C Technical Details, retrieved 2009-04-10
  36. ^ Porras, Phillip; Saidi, Hassen; Yegneswaran, Vinod (2009-03-19), An Analysis of Conficker C (draft), SRI International, retrieved 2009-03-29
  37. ^ a b Fitzgerald, Patrick (2009-04-09), W32.Downadup.E—Back to Basics, Symantec, retrieved 2009-04-10
  38. ^ Putnam, Aaron, Virus Encyclopedia: Worm:Win32/Conficker.E, Microsoft, retrieved 2009-04-18
  39. ^ Nahorney, Ben; Park, John (2009-04-21), "Connecting The Dots: Downadup/Conficker Variants", The Downadup Codex (PDF) (2.0 ed.), Symantec, p. 47, retrieved 2009-06-19
  40. ^ Keizer, Gregg (2009-04-09), Conficker cashes in, installs spam bots and scareware, Computerworld, retrieved 2009-04-10
  41. ^ Leung, Kachun; Liu, Yana; Kiernan, Sean (2009-04-10), W32.Downadup.E Technical Details, Symantec, retrieved 2009-04-10
  42. ^ Microsoft Collaborates With Industry to Disrupt Conficker Worm (Microsoft offers $250,000 reward for Conficker arrest and conviction.), Microsoft, 2009-02-12, retrieved 2009-09-22
  43. ^ Greene, Tim (2009-07-31), Conficker talk sanitized at Black Hat to protect investigation, Network World, retrieved 2009-12-28
  44. ^ NIC Chile participa en esfuerzo mundial en contra del gusano Conficker (in Spanish), NIC Chile, 2009-03-31, retrieved 2009-03-31
  45. ^ CIRA working with international partners to counter Conficker C, CIRA, 2009-03-24, retrieved 2009-03-31
  46. ^ NIC-Panama colabora en esfuerzo mundial en contra del Gusano Conficker. (in Spanish), NIC-Panama, 2009-03-27, retrieved 2009-03-27
  47. ^ D'Alessandro, Marco (2009-03-30), SWITCH taking action to protect against the Conficker computer worm, SWITCH, retrieved 2009-04-01
  48. ^ Bartosiewicz, Andrzej (2009-03-31), Jak działa Conficker? (in Polish), Webhosting.pl, retrieved 2009-03-31
  49. ^ Maniscalchi, Jago (2009-06-07), Conficker.A DNS Rendezvous Analysis, Digital Threat, retrieved 2009-06-26
  50. ^ Malicious Software Removal Tool, Microsoft, 2005-01-11, retrieved 2009-03-29
  51. ^ Protect yourself from the Conficker computer worm, Microsoft, 2009-03-27, retrieved 2009-03-30
  52. ^ "Protecting yourself from the Conficker worm". McAfee. Retrieved 2009-07-29.
  53. ^ "Win32/Conficker.C". Threat Encyclopedia. Panda Security. Retrieved 2009-03-29.
  54. ^ Radu, Daniel; Cimpoesu, Mihai, Win32.Worm.Downadup.Gen, BitDefender, retrieved 2009-04-01
  55. ^ "Win32/Conficker.AA". Threat Encyclopaedia. ESET. Retrieved 2009-03-29.
  56. ^ "Worm:W32/Downadup.AL". F-Secure. Retrieved 2009-03-30.
  57. ^ "W32.Downadup - Removal". Symantec. 2008-11-24. Retrieved 2009-03-29.
  58. ^ "Conficker Removal Tool". Sophos. 2009-01-16. Retrieved 2009-03-29.
  59. ^ "How to remove network worm Net-Worm.Win32.Kido". Kaspersky Lab. 2009-03-20. Retrieved 2009-03-29.
  60. ^ "WORM_DOWNAD.E". Trend Labs. 2009-04-11. Retrieved 2009-05-05.
  61. ^ Bowes, Ron (2009-04-21), Scanning for Conficker’s peer to peer, SkullSecurity, retrieved 2009-04-25
  62. ^ W32.Downadup P2P Scanner Script for Nmap, Symantec, 2009-04-22, retrieved 2009-04-25
  63. ^ Bowes, Ronald (2009-03-30), Scanning for Conficker with Nmap, SkullSecurity, retrieved 2009-03-31
  64. ^ Asadoorian, Paul (2009-04-01), Updated Conficker Detection Plugin Released, Tenable Security, retrieved 2009-04-02
  65. ^ "How to disable the Autorun functionality in Windows". Microsoft. 2009-03-27. Retrieved 2009-04-15.
  66. ^ Technical Cyber Security Alert TA09-020A: Microsoft Windows Does Not Disable AutoRun Properly, US-CERT, 2009-01-29, retrieved 2009-02-16
  67. ^ DHS Releases Conficker/Downadup Computer Worm Detection Tool, Department of Homeland Security, 2009-03-30, retrieved 2009-04-01
Retrieved from "https://en.wikipedia.org/w/index.php?title=Conficker&oldid=343126299"