Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

General Discussion

Conficker update. - Page 1

Conficker update.

Posted by: Wild MissingNo. appeared
Date: 2009-04-09 16:16:39
Okay, it's been a while since I last checked the Google News, and they have some more news about the bugger. I know others are no doubt getting fed up but I just want to keep others aware about this worm.

Researchers say Conficker is all about the money

The Conficker worm that has infected millions of Windows-based computers will likely be used to send spam and steal data much like one of the nastiest botnets on the Internet does, researchers said on Thursday after finding links between the two worms.

A week after failing to do anything but snore, the much hyped Conficker worm was roused from its slumber on Wednesday, with infected computers transmitting updates via peer-to-peer and dropping a mystery payload onto PCs. Researchers suspect that the payload program may be a keystroke logger, a spam generator, or both.

Conficker now also tries to connect to MySpace.com, MSN.com, eBay.com, CNN.com, and AOL.com as a way to test that the computer has Internet connectivity, deletes all traces of itself in the host machine, and is set to shut down some functionality on May 3.

In addition, Conficker reaches out to a domain that is known to be infected by a worm called Waledac and downloads an encrypted file. Researchers are analyzing that code and the program that is dropped directly onto infected machines by other infected machines to find out exactly what is in it. And they suspect that Conficker and Waledac are coming from the same people.

"I'm pretty certain the same people are behind both of them," said Paul Ferguson, an advanced threats researcher for Trend Micro. "Conficker has got their (Waledac creators') fingerprints all over it."

Computers infected with Waledac comprise what Ferguson called the "most pernicious spamming botnet on the Internet." Waledac spreads via a malicious Web link or an e-mail, typically a fake Christmas greeting or Valentine's Day message, or with a subject line related to the inauguration of President Obama. It generates spam and steals data, like passwords, from infected computers.

Ferguson said he believes Eastern Europeans are behind the Waledac worm. He suspects they created the Storm botnet to try different payloads and business models and that Waledac resulted from that. Ferguson speculates that they may be putting their lessons learned from earlier efforts into practice with Conficker.

"There is empirical evidence that these guys are a for-hire, for-profit criminal operation on the Internet and that Conficker is nothing more than part of that organization's best efforts to monetize their efforts on the Internet," Ferguson said.

Vincent Weafer, vice president of Symantec Security Response, confirmed the Waledac connection with Conficker, but wouldn't speculate on who exactly might be spreading the worms. The fact that Conficker now downloads a Waledac file "reconfirms our belief that ultimately this is a large botnet designed to make money," he said. "It's the first example of how these guys are trying to leverage this botnet for profit."

As for the May 3 expiration date in the latest Conficker code, Weafer said it appears to be trying to shut down code related to the first variant of Conficker, Conficker.A, which generated more noise on the Internet than later versions did.

Symantec researchers are calling the latest Conficker code that is circulating a new variant of the worm and have dubbed it Downadup.E, with Downadup being another name for Conficker.

The worm spreads via a hole in Windows that Microsoft patched in October, as well as through removable storage devices and network shares with weak passwords. The worm disables security software and blocks access to security Web sites.

To check if your computer is infected you can use this Conficker Eye Chart or this site at the University of Bonn. There is also a Conficker removal guide on CNET's Download.com site.

People are being urged to be careful in their quest for Conficker removal tools. Marshale8e6 has found spam that takes advantage of the hype over the Conficker worm to scare people into installing fake antivirus software. The e-mail messages claim to be from Microsoft security departments and provide a link to a Web page that does a fake computer scan and prompts the visitor to buy antivirus software that typically does nothing but install malware on the computer.

Also, using search engines to try to find Conficker removal tools is maybe not the best idea. Trend Micro has found that Google searches using terms related to Conficker bring up results that include links to malware. They recommend going directly to the site of a trusted security vendor to get software instead of doing general searches.

Meanwhile, Conficker also has inspired a copycat worm. Neeris, an IRC bot that spreads itself by sending links through MSN Messenger, has been active for a few years, but a new variant has emerged that borrows some behavior from Conficker, such as exploiting the same hole in Windows that Conficker does and spreading via removable storage devices, Microsoft said.

Re: Conficker update.

Posted by: fivex
Date: 2009-04-09 17:05:11
Waledac. Ugh. Waldac is more destructive than Conficker, but isn't as widespread.

Re: Conficker update.

Posted by: Wild MissingNo. appeared
Date: 2009-04-09 17:09:33
I've not heard of Waldac. I've been reading about Conficker on Wikipeida, and there's more than one Conficker now. They say there's:

Conficker.A, Conficker.B, Conficker.C, Conficker.D, Conficker E.

I was reading about here from here. http://en.wikipedia.org/wiki/Conficker

And it seems avast! can now find this worm too, under the name of, Win32:Confi, yet the dream I had, it was called, Win32:Conficker. Weird.

Re: Conficker update.

Posted by: fivex
Date: 2009-04-09 17:15:59
Waldac is older than Conficker.

Re: Conficker update.

Posted by: Wild MissingNo. appeared
Date: 2009-04-09 17:18:05
That might explain it. MSBlast, I am aware of as one of my friends was infected with it a long time ago.

Re: Conficker update.

Posted by: xparasite9
Date: 2009-04-09 17:49:16
These viruses are lies. they do nothing
These viruses are lies. they do nothing
These viruses are lies. they do nothing
These viruses are lies. they do nothing

Re: Conficker update.

Posted by: Wild MissingNo. appeared
Date: 2009-04-09 17:53:22
Don't spam, please. I was reading about another news article about Conficker. Here's what it said.:


Conficker Causes Rise in Hoax Security Software
A rise in rogue security software programs on the web is partly down to the publicity of the Conficker virus, says Microsoft.

In its Security Intelligence Report, which is produced every six months and charts the biggest threats to PC users, Microsoft said that hoax security software is on the rise and looks set to continue.

Ed Gibson from Microsoft explained that while Conficker making the news is a good thing because it allows the company to urge PC users to install security updates to protect themselves, it has also allowed cyber criminals to piggy back on the threat, offering hoax security software to cautious web users.

"Cyber criminals charge a subscription for this software, so not only does the consumer remain unprotected but the criminal also has their credit card details, leaving the consumer open to further attacks," said Gibson.

The report also highlighted that while consumers have successfully installed security updates to patch application and OS vulnerabilities, many businesses have yet to roll-out the updates to staff, ensuring they have been hit hard by Conficker and other viruses, the Ministry of Defence being one such victim.

"We needed businesses to understand the serious nature of rolling-out application as well as OS updates to all of their staff in a bid to avoid becoming victims," said Cliff Evans.

Here's another one, I was reading about.

Is Conficker Finally History?
s it time to put Conficker in the history books? Is Conficker really a dud? The truth is, nobody knows. Conficker gained so much attention in part because of the sheer number of computers it was able to infect. But nobody knows for sure what Conficker can accomplish. However, at the time of this writing no Conficker-related catastrophes have surfaced and some think the threat never will. So as attention shifts away from Conficker, it's important to know where we stand against the world's most famous piece of malware.

How big is the Conficker threat?

The general consensus seems to be that approximately 3 million computers are infected on any given day. The number 15 million gets thrown around a lot as well, but that number includes computers that were infected and then scrubbed clean of the malware. Keep in mind that the actual number of infected computers is also very hard to ascertain since security experts can only count infected Internet protocol (IP) addresses and not individual computers, according to Roel Schouwenberg, a security expert with Kaspersky labs. Since an entire company could be behind one IP, the number of infected devices remains a bit of a mystery.

The Vietnamese security company Bkis says approximately 2.2 million computers are currently infected with Conficker A and B, and about 1.2 million computers carry Conficker C, the latest version of the worm, according to reports. The Conficker C number is the most worrisome since that is the version that can most effectively update itself through p2p networking with no need to phone home for an update.

The world's biggest problem areas for Conficker infections are in Asia, Eastern Europe and South America, although there seems to be some disagreement on which countries are the hardest hit.

How important is Microsoft's Conficker Patch and who can get it?

Does Microsoft have the power to stop Conficker dead in its tracks? Common sense seems to say yes, because if everybody had Microsoft's Conficker patch the problem would be solved, right? Not so, says Schouwenberg. Even though Conficker-infected regions contain a high amount of computers with pirated Windows software, the blame should not be placed at Microsoft's feet.

Microsoft allows both pirate and genuine Windows users to download critical security updates. However, most pirate users have Windows' automatic updates turned off to avoid Microsoft's piracy detection tool. Pirate users could get the software from Microsoft's download center, but it's unknown how many users are actually doing that.

Another problem, Schouwenberg says, is that Internet service providers in problem regions are not as security conscious as they are in the United States. If the ISPs are not actively monitoring security on their networks and blocking the necessary ports that Conficker can sneak onto, then unpatched computers remain at risk.

But the Conficker patch and port blocking are not cure-alls. According to Schouwenburg, the security patch is most effective against Conficker A, but since Conficker has three main flavors (A, B and C), patches are not the only answer. As always, the best defense is to make sure your antivirus programs are up to date and to do a full security scan regularly. If you're worried that you might be infected, the Conficker Working Group has a simple test that can help.

If you are a pirate Windows user, you have amnesty for critical downloads so get the Conficker patch as soon as possible. Remember, we may be forgetting about the worm, but Conficker's authors still have the capability to inflict harm. Whether that will happen is anybody's guess, but making sure your computer is secure is always the best policy.

Re: Conficker update.

Posted by: fivex
Date: 2009-04-09 18:17:51
Here's  a trend micro article


DOWNAD/Conficker Watch: New Variant in The Mix?

Days after the April 1st activation date of Conficker, nothing interesting was seen so far in our Downad/Conficker monitoring system except the continuous checking of dates and times via Internet sites, checking of updates via HTTP, and the increasing P2P communications from the Conficker peer nodes.

Well that was until last night when we saw a new file (119,296 bytes) in the Windows Temp folder. Checking on the file properties reveals that the file was created exactly on April 7, 2009 at 07:41:21.

Checking also on traffic captures show that there was no HTTP download that occurred somewhere around that time frame, which was from April 7, 2009 at 07:40:00 up to April 7, 2009 at 07:42:00. However, we noticed a huge encrypted TCP response (134,880 bytes) from a known Conficker P2P IP node (verified by other independent sources), which was hosted somewhere in Korea.

The size of the encrypted TCP blob pretty much matches the size of the binary that got created in the aforementioned folder. There are some additional bytes, which could be the headers and keys that Conficker/Downadup has been known to use.

Trend now detects this new Conficker variant as WORM_DOWNAD.E. Some interesting things (well at least in our perspective) found are:

(Un)Trigger Date ? May 3, 2009, it will stop running
Runs using a random file name and random service name
Deletes this dropped component afterwards
Propagates via MS08-067 to external IPs if Internet is available, if no connections, uses local IPs
Opens port 5114, and serves as an HTTP server by broadcasting via SSDP request
Connects to the following sites:
Myspace.com
msn.com
ebay.com
cnn.com
aol.com
It also does not leave a trace of itself in the host machine. It runs and deletes all traces, no files, no registries etc.

Another interesting thing we also noticed was that the Downad/Conficker box was trying to access a known Waledac domain (goodnewsdigital(dot)com) and download yet another encrypted file. This coincidentally happened just after the creation of the new Downad/Conficker binary described below (07:41:23):



The domain currently resolves to an IP address that is hosting a known Waledac ploy in HTML to download print.exe, which has been verified to be a new Waledac binary.

Two things can be summed up from the events that transpired:

As expected, the P2P communications of the Downad/Conficker botnet may have just been used to serve an update, and not via HTTP. The Conficker/Downad P2P communications is now running in full swing!
Conficker-Waledac connection? Possible, but we still have to dig deeper into this?
Research and collaboration is currently ongoing in our own labs, as well as within the Conficker Working Group, and will update this blog post for new findings.

Thanks to Joseph Cepe and Paul Ferguson for working on additional information for this entry.




UPDATE: 10:50 PDT, 9 April 2009:

Having followed the activities of Eastern European online cyber crime for several years, there is one thing we are certain about ? these criminals are motivated by one thing: money.

How was Downad/Conficker helping them meet their goals? It wasn?t. A very large botnet of compromised computers doesn?t make money if it justs ?sits there? doing nothing.

So now we saw ? as described above ? that the Downad/Conficker botnet has awakened, and perhaps their desire to monetizing their efforts is becoming more clear.

In the latest activity, we see infected Downad.KK/Conficker.C nodes pulling down new Waledac binaries (perhaps for spamming, as Waledac has been known to do)from a fast-flux domain infrastructure, but also now it is also installing Fake/Rogue AntiVirus  (AV) malware, too.

As we have seen, the ongoing Rogue AV efforts by this criminal organization has been widespread, pernicious, unabated, and obviously profitable.

Stay tuned ? this situation is still unravelling.

- Paul Ferguson, Trend Micro Threat Reasearch

Re: Conficker update.

Posted by: Wild MissingNo. appeared
Date: 2009-04-09 18:21:55
Shit, this is getting crazy. The only problem is, I use MSN.com. I did get an odd message/email, from them about changing MSN's something. I hope it wasn't Conficker, doing that because I went to the link to find out more about having to change MSN email addresses, when I've had to change my email 7 times due to spam emails, and junk. Well, I've not seen anything disabled on my laptop so far.

Re: Conficker update.

Posted by: fivex
Date: 2009-04-09 18:22:35
COuld be waledac, could be some random spam.

Re: Conficker update.

Posted by: Wild MissingNo. appeared
Date: 2009-04-09 18:24:41
Shit. I have a messanger log, just a second, I'll post what came up. Here's my chat log, of yesterdays message.

Messenger Plus! Chat Log
Session Start: 08 April 2009

* Mutou Yami (samamutouyami@hotmail.com)
* Windows Live(TM) Messenger Service Staff (messenger@microsoft.com)

(00:29) Windows Live(TM): Important service announcement: As part of a recent system enhancement, we need you to change your e-mail address to continue signing in to the Windows Live(TM) Messenger Service.

To ensure that your access is not blocked and to learn more, go to http://support.microsoft.com/gp/Messenger/en
(00:29) Mutou Yami has changed his/her name to "Mutou Yami"
(00:29) Mutou Yami has signed-in (Busy)

Re: Conficker update.

Posted by: fivex
Date: 2009-04-09 18:27:24
That's legit.

Re: Conficker update.

Posted by: Wild MissingNo. appeared
Date: 2009-04-09 18:28:16
What? I didn't get that. I'm staying with my current address, as it's the only MSN account I have that I use.

Re: Conficker update.

Posted by: fivex
Date: 2009-04-09 18:30:56

What? I didn't get that. I'm staying with my current address, as it's the only MSN account I have that I use.
Well, read this:
http://support.microsoft.com/gp/Messenger/en

Re: Conficker update.

Posted by: Wild MissingNo. appeared
Date: 2009-04-09 18:34:42
I read it yesterday, and with my bad memory I no doubt forgot. I can get to my Inbox just fine, and the main page.