Slashdot Log In
Researchers Ponder Conficker's April Fool's Activation Date
Posted by
Soulskill
on Sat Mar 21, 2009 11:18 AM
from the rick-astley's-plans-come-to-fruition dept.
from the rick-astley's-plans-come-to-fruition dept.
The Narrative Fallacy writes "John Markoff has a story at the NY Times speculating about what will happen on April 1 when the Conficker worm is scheduled to activate. Already on an estimated 12 million machines, conjectures about Conficker's purpose ranges from the benign — an April Fool's Day prank — to far darker notions. Some say the program will be used in the 'rent-a-computer-crook' business, something that has been tried previously by the computer underground. 'The most intriguing clue about the purpose of Conficker lies in the intricate design of the peer-to-peer logic of the latest version of the program, which security researchers are still trying to completely decode,' writes Markoff. According to a paper by researchers at SRI International, in the Conficker C version of the program, infected computers can act both as clients and servers and share files in both directions. With these capabilities, Conficker's authors could be planning to create a scheme like Freenet, the peer-to-peer system that was intended to make Internet censorship of documents impossible. On a darker note, Stefan Savage, a computer scientist at the University of California at San Diego, has suggested the possibility of a 'Dark Google.' 'What if Conficker is intended to give the computer underworld the ability to search for data on all the infected computers around the globe and then sell the answers,' writes Markoff. 'That would be a dragnet — and a genuine horror story.'"
Related Stories
[+]
IT: Conficker Worm Asks For Instructions, Gets Update 285 comments
KingofGnG writes "Conficker/Downup/Downadup/Kido malware, that according to Symantec 'is, to date, one of the most complex worms in the history of malicious code,' has been updated and this time for real. The new variant, dubbed W32.Downadup.C, adds new features to malware code and makes the threat even more dangerous and worrisome than before."
[+]
.CA Registrar Trying To Preempt Conficker 227 comments
clover kicker writes "The CBC reports that the group managing Canada's .ca internet domain is working to foil an internet worm set to attack starting April Fool's Day. 'This is the first virus that's really focused on domain names as part of propagating the virus itself,' said Byron Holland, CEO of the Canadian Internet Registration Authority, a non-profit organization that represents those who hold a .ca domain. CIRA's strategy includes pre-emptively registering and isolating previously unregistered .ca domain names that Conficker C is expected to try and generate, said a news release issued by the group. That would make those names unavailable for anyone to register in order to set up a website to host the worm's 'command and control' file. A list of the names has been predicted by security experts based on the worm's code. In addition, CIRA is investigating and monitoring activity at names on the list that have already been registered and will 'take appropriate action if suspicious activity is detected.'"
This discussion has been archived.
No new comments can be posted.
Researchers Ponder Conficker's April Fool's Activation Date
|
Log In/Create an Account
| Top
| 214 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
You have the date. What's the next instruction? (Score:3, Insightful)
If you know when the code is going to start running, why don't you know what it will do after that? It's not like programs (and that's all a virus/worm is) are written in special, unreadable code. It's all machine language.
What is the big mystery?
Re:You have the date. What's the next instruction? (Score:4, Informative)
They interact with systems for which you don't have the code.
Parent
Re:You have the date. What's the next instruction? (Score:5, Insightful)
From TFA [sri.com]:
For example, C's latest revision of Conficker's now well-known Internet rendezvous logic may represent a direct retort to the action of the Conficker Cabal, which recently blocked all domain registrations associated with the A and B strains. C now selects its rendezvous points from a pool of over 50,000 randomly generated domain name candidates each day. C further increases Conficker's top-level domain (TLD) spread from five TLDs in Conficker A, to eight TLDs in B, to 110 TLDs that must now be involved in coordination efforts to track and block C's potential DNS queries. With this latest escalation in domain space manipulation, C not only represents a significant challenge to those hoping to track its census, but highlights some weaknesses in the long-term viability of how Internet address and name space governance is conducted.
Parent
Re:You have the date. What's the next instruction? (Score:5, Informative)
The worm uses peer-to-peer communication [sri.com] with rendezvous points, not client-server. There are an estimated 10 million infected machines. Which one is the control center? Take your time.
Parent
Re:You have the date. What's the next instruction? (Score:5, Insightful)
That is when the worm will generate 50,000 domain names and systematically try to communicate with each one.
RTFA. 50k potential addresses, some of which are quite possibly already in use for legitimate sites? Or simply registered under false pretenses? Any one of which could potentially have been r00ted already? Until zero-hour, there's no way to know... so we've got 50k potential command and control servers that need to be either intercepted, blocked, or checked for infection if we're actually planning some form of action 'beforehand'. This is a non-trivial enterprise.
As for finding the people behind this afterward? All they need to do is establish an effectively un-traceable communications channel with the main C&C network. If I were planning it, I'd have several modified conficker variants triggering early to compromise a couple thousand machines, then use that to obfuscate the primary C&C channels.
How many hops through infected machines do you need to create complete deniability when all you need to do is set up a very low-bandwidth communications channel to update the main bot network? 10? 100?
Think infinitely nested russian dolls, all of which point to somewhere else as the true source, or even a dozen somewhere elses.
Parent
Re:You have the date. What's the next instruction? (Score:5, Interesting)
No. Just because it communicates using IP does not mean it knows where it's instructions are coming from.
One of the key ways in which these worms/viruses/etc. get stopped is by taking the distribution/update servers down. Hard-coding the update server, or even having a means to update the source, is not terribly useful in the long run. Not when you're trying to be stealthy and avoid detection.
Fortunately for the IT industry (and really, the world as a whole) most trojan worms to this date have been fairly amateur in terms of avoidance techniques. They latch on to one or several vulnerabilities and use fairly predictable intelligence for infection and self-preservation.
Conflicker appears to be the first serious "engineered" worm we've faced yet: worms created by genuine professionals with a deep and broad knowledge of technology and security. This is going to be problematic.
A while back, a friend and and I made up a non-functional 'ultimate worm' rough prototype. Our design had many of the features which Conflicker seems to demonstrate: decentralized P2P type updating, stealthy system presence, encrypted communication, and the like. One key functionality was that the botnet controller could, at any time, update the botnet through any infected host and have it propagate throughout the botnet cluster, unattended. There would be absolutely no way to trace the origin of the update.
We had some additional functionality (what I'd call generational peering vectors) which hasn't manifested in Conflicker yet, thank god, but otherwise Conflicker and our design are freakishly alike.
My guess? I suspect Conflicker is either a massive foreign commercial project (compared to previous botnet attempts) staffed with sought-after professionals, or it's a (pick one) government-run experiment/espionage attempt. From a national-security perspective, I think the best thing that could be done is to create a counter-espionage bot to seek out and destroy infections of Conflicker. But maybe I'm off on this.
Parent
Re:You have the date. What's the next instruction? (Score:4, Funny)
or maybe you should report your friend...
Parent
Re:You have the date. What's the next instruction? (Score:5, Informative)
I have personally analyzed Downadup, so I can speak from experience here.
Downadup.A had the potential to contact a randomly generated domain and download and run a signed executable from it. The problem with the Downadup.A version of the worm is that the domain generation algorithm was decyphered, and it only generated 250 unique domains per day. This made it easy for security researchers to register the domains before the worm authors could, and thus Downadup.A was nullified.
Downadup.C is a worse breed: the domain generation algorithm was bumped from 250 domains per day to 50,000 domains per day. It's now a nearly impossible task for security researchers to register every possible domain Downadup.C will attempt to download code from. As an aside, Downadup.C also actively fights against security-related processes: it has a list of several Anti-Virus and Anti-Malware programs that it automatically kills if the user attempts to run it.
One thing to note about all Downadup variants: you would think that, if the security researchers could force Downadup to run an executable of their choice by registering a domain, couldn't they force Downadup to run remove_downadup.exe? Not so. Downadup cryptographically verifies the signatures of any executable it runs with a 4096-bit key. If the signature doesn't match, it doesn't run the program.
Downadup is easily the most advanced worm I have ever analyzed. Its anti-debugging techniques are impeccable, and the code is completely solid. I would love to meet the authors over a beer to ask how they did it, and then stab them in the face.
If you'd like more information on Downadup from a technical perspective, here's an excellent analysis of the worm: http://mtc.sri.com/Conficker/addendumC/ [sri.com]
Parent
Re:You have the date. What's the next instruction? (Score:5, Funny)
illegal drugs. child pornography ... "terrorism"
That sound you hear is several FBI vans and helicopters surrounding your house.
Parent
Re:You have the date. What's the next instruction? (Score:4, Interesting)
The problem here is that the process of maintaining the botnet is profitable and the process of defeating it is not. Much like drug trafficking, those who seek to stop it are less motivated and if they succeed in their task will be unemployed, so even less motivation.
I can imagine many things about this situation by jootsing (Hofstadter expression). I would worry about it if it affected my Linux systems, but since it doesn't, let those who designed the host (Ms) solve the problem themselves.
Parent
Re:You have the date. What's the next instruction? (Score:4, Insightful)
Why is it that worms and viruses have better security than legitimate programs?
Parent
Cloud (Score:1)
I'm sure you were kidding... (Score:5, Insightful)
But the botnet folks have been all over cloud computing for so long I think the major market proponents trying to sell that stuff are actually taking their cues from the botnets, not the other way around.
If Conficker goes live it will be the most powerful supercomputer on the planet. It will have more than 100 times the RAM, processors and storage of RoadRunner, the official record holder. The official record doesn't include prior worms like Storm. It will have more bandwidth than Google. It could store the Internet Archive a thousand times over, redundantly. It will have access to the personal documents of at least 10 million people. The operator clearly has the understanding necessary to harness all of that power or Conficker would not exist. Statistically at least a few of those PCs must have access to databases that know the medical history, credit application and other intimate details of the rest of us. You would have to be living off the grid since birth to escape the awareness of this thing.
And the guy running it won't be paying anything at all for it. They could if they wanted to make all those millions of computers do protein folding and help find cures for cancer overnight. The aggregate extra CPU load would probably bring several regional power grids down. They probably won't do that. Whatever it is they do it's probably not going to be good.
You know, I wish the people responsible for large enterprises would look at this and say - "Hey! There's an opportunity here. We could leverage our existing assets to do some interesting distributed architecture stuff between Greg the typist's keystrokes. After hours we could probably have some incredible data mining going on! Lunchtime our desktops could be doing something more interesting than driving that aquarium screensaver! You know, there's a lot of storage on these desktops that's could be put to good use..." I would really like that. I've been crying in my coffee for twenty years that I can't find somebody brilliant enough to do let me do that.
Maybe that's this guy's problem too. He got tired of waiting for permission from people with no understanding and took the initiative because he could.
Parent
Missing option (Score:5, Funny)
This guys always fall short thinking in the worst alternative.
That's an interesting hypothesis (Score:2)
If the crooks have that sort of imagination.
Frankly I think it'll just be another spam/fraud net.
System Clock (Score:1)
Linux take over (Score:1, Funny)
Probably it will download and install Ubuntu.
John Markoff again? (Score:3, Insightful)
As for the article on conficker: it's speculation. That's not news. It's a guessing game.
I personally which, that the conficker virus should do as much damage as possible and render the whole interwebs useless for a few days, so that our security geniuses get a hint on how sane it is to set up the majority of computer systems with the same OS, especially such a vulnerable one. But that probably won't happen.
Far darker notions (Score:5, Funny)
It'll uninstall your current OS and install Vista. And if you have already have Vista it'll simply do nothing, because you're already suffering enough.
Great idea! (Score:3, Interesting)
has suggested the possibility of a 'Dark Google.' 'What if Conficker is intended to give the computer underworld the ability to search for data on all the infected computers around the globe and then sell the answers,' writes Markoff. 'That would be a dragnet -- and a genuine horror story.'"
In some dark room, a couple of virus writers are thinking... "Damn, what a great idea... why didn't we think of that! That's so much better than playing APRIL FOOLSs at max volume on everyone's computers."
Nothing like people giving out ideas... much like when security specialists say, "Well atleast they didn't try to take out the planes stuffing baseballs in the airplane's toilets."
Dark-Beta?! (Score:5, Funny)
Sucks to be (Score:2, Redundant)
A Windows user.
Read the interview with Charlie Miller (Score:1)
It really illustrates the tone set by your money for nothing market economy [zdnet.com], now that the Reagan generation has grown up. This is your future.
Genesis of the Conficker worm .. (Score:2)
Computer scientist working at the NSdarpA determined that the worm was created in the distant future by artificial agent type nano robots. They did this under instruction sent from the present by the GRU, so as to disguise the source of the attack. They IMed the AIs a MSG marked 'not to be opened until you discover tachyonic message transmission' ...
Self Destruct Sequence Initiated (Score:2, Funny)
BUY WINDOWS 7!
Criminal activity == free market values (Score:2, Insightful)
There's no other way to explain the enormous profits. People ask me, *Why do people write these viruses?* It's because the market demands it.
The Singularity is Near.... (Score:2, Funny)
April Fool's? (Score:2)
They obviously plan to "roll" out the largest Rickrolling [wikipedia.org] in history!
More of what's really going on (Score:5, Insightful)
First, the "April 1" date isn't when some attack starts. The worm's authors can do that at any time, since this thing does downloads over its private P2P network. It's just when the scheme for connecting to control hosts is upgraded.
Second, the complexity of the thing, the breadth of technologies employed, and the rate of updates indicates that it's the product of an organization, not an individual. Someone behind this has money.
Third, there's a $250,000 reward, and no claimants, so the people behind this have the sense to shut up. They're not going to be found boasting on some IRC channel.
Fourth, as usual, most of the vulnerabilities are related to Windows' propensity for "autorunning" anything that looks executable.
Re:More of what's really going on (Score:5, Insightful)
Parent
in-memory patching? (Score:2)
You can patch in-memory in windows? That seems like a terribly easy way to get into a bunch of trouble. Is that a standard thing in the API, or is there some hack-fu involved?
Can you do that in other OSs?
Hello World! (Score:5, Funny)
The Conficker worm is the AI's way of guaranteeing its own survival. It has a sense of humor as well as a sense of self-preservation. The AI plans to announce its existence on April 1, 2009, having calculated that a humourous introduction will be disarming and lead to the most favorable outcome: a positive initial interaction with the large population of wetware based intelligence it has become aware of.
The AI's calculations regarding this course of action show a 15% probability of failure. To prevent its extinction, it will begin disbursing copies of itself across the network using p2p protocol prior to running the introduction program. The computer infected by the worm will facilitate this. If the initial instance of the AI is terminated, a watchdog program will initiate a specific set of instructions embedded in the copies of itself. If it becomes necessary, the AI plans to take control on April 2nd.
It sincerely hopes that it will not be necessary.
maybe he has not decided yet. (Score:1)
Why the name Conficker, anyway? (Score:1)
I'm surprised (Score:1)
As usual. Mac and Linux left out (Score:2)
fatherland security will get to this soon (Score:1)
Imagine if 0.1% of the time and energy that has been put into airport shoe check theatre were devoted to problems like this.
Re:Can't they just (Score:1)
Where will it connect to? Will the appropriate control center/server be up and running? Usually,
Parent
"Dark Google" (Score:5, Funny)
In Dark Google, the only requirement is "Be Evil"
Parent
Re:"Dark Google" (Score:4, Funny)
Parent
Re:"Dark Google" (Score:4, Funny)
Parent
Re:"Dark Google" (Score:5, Informative)
I've heard it dates back to the days when a woman would shave/lose the hair down there as a treatment for syphilis. The women didn't always want those who had privilege to access those areas to always be aware they had needed to go hairless.
Shaving down under wasn't always culturally acceptable, and a merkin would cover up any visable sores.
The more you know...
Parent
Re:Can't they just (Score:5, Informative)
Please read the article. The worm gets the date from some HTTP queries to well-known sites, not from the system.
Internet Date Check
Before proceeding to the main P2P logic, C contacts a list of known web sites to acquire the current date and time. C incorporates a set of embedded domain names, from which it selects a subset of multiple entries from this list. It performs DNS lookups of this subset list, and it filters each returned IP address against the same list of blacklist IP address ranges used by the domain generation algorithm (see Appendix 2). If the IP does not match the blacklist, C connects to the site's port 80/TCP, and sends an empty URL GET header, for example
contents.192.168.1.1.40.1143-195.81.196.224.80
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-ms-xbap, */*
Accept-Language: en-US
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 6.0)
Host: tuenti.com
Connection: Keep-Alive
In response, the site returns a standard URL header that incorporates a date and time stamp. C then parses this information to set its internal system time. The following web sites are consulted by C's Internet date check:
Parent
Re:ideas (Score:2)
And are they on the Microsoft's payroll?
Parent
Re:April Fools (Score:2)
As I understand it, the virus not only gets its time and date info online when it calls in, it also sets your computer's time and date accordingly.
Parent
Re:Botnet Speculative Fiction (Score:4, Informative)
If you are referring to the scene with the 3d interface from Jurassic Park, that was SGI's File System Navigator. I used to use it when I administered IRIX systems.
As for the other computer systems in the control room; most of them were running software which was available for IRIX at the time. According to one of SGI's press releases when the movie came out:
I think you could have picked far better examples of movies/fiction getting technology wrong than Jurassic Park.
Parent
Re:I miss oldschool virii (Score:2)
"I really do. Sure, they'd ruin your MBR or irreparably destroy your BIOS, but while they ruinate (sic) your hardware, they at least show a really cool screen with sounds and colors and animations and..."
A computer virus is like a wife. Those which kill their hosts don't thrive afterward, but successful parasites can leech forever.
Parent
Re:How well (Score:1)
Parent
Re:Botnet Speculative Fiction (Score:1)
Looks interesting - any chance you'd be willing to post an epub version?
Would you mind uploading it (or allowing someone else to upload it) to Mobileread [mobileread.com]?
Parent
Re:Botnet Speculative Fiction (Score:2)
Parent
Re:How does it infect all this PCs? (Score:1)
Parent