Slashdot Log In
Diagnose Conficker With Web-Based Eye Chart
Posted by
timothy
on Thu Apr 02, 2009 12:37 PM
from the smoke-test-sanity-check-trial-balloon dept.
from the smoke-test-sanity-check-trial-balloon dept.
thomsomc writes "Joe Stewart from the Conficker Working Group has created an eye chart that allows for online identification of Conficker B and C infections. Using basic knowledge of the blacklisting that Conficker employs to avoid attempting to infect IPs that belong to popular Anti-Virus and security firms (including Microsoft), the group whipped up this very simple test to see if you can load content from the various pages. If you can see all of the images, you're more than likely Conficker-free. According to Honeynet, 'This detection method should be more reliable than network scanning based tests. Happy scanning!'" Related: Tech Fragments notes in passing that nothing much seems to have come of conficker's dreaded April 1 deadline.
Related Stories
Submission: Diagnose Conficker With Web-Based Eye Chart by Anonymous Coward
[+]
IT: The Birth and Battle of Conficker 239 comments
NewScientist has an interesting look back at the birth of the Conficker worm and how this sophisticated monster quickly grew to such power and infamy. "Since that flurry of activity in early April, all has been uneasily quiet on the Conficker front. In some senses, that marks a victory for the criminals. The zombie network is now established and being used for its intended purpose: to make money. Through its peer-to-peer capabilities, the worm can be updated on the infected network at any time. It is not an unprecedented situation. There are several other large networks of machines infected with malicious software. Conficker has simply joined the list. The security community will continue to fight them, but as long as the worm remains embedded in any computer there can be no quick fixes."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Jon Stewart? (Score:5, Funny)
Am I the only one that read it as Jon Stewart and then spent a few minutes trying to figure out the joke on the page?
Re: (Score:3, Funny)
Haha, me too. Give this a !jonstewart tag.
Re: (Score:3, Insightful)
the question is: how many other topics can we find that are !jonstewart?
answer: 99% of them wooooooooooooo
Re:Jon Stewart? (Score:4, Informative)
How can the first post be modded Redundant when he says something that is not a meme or a common sentiment?
Parent
Re:Jon Stewart? (Score:4, Informative)
How can the first post be modded Redundant when he says something that is not a meme or a common sentiment?
Because someone with mod points is either trolling or doesn't understand the meaning of the word. Just another flaw in the system.
Parent
Re:Jon Stewart? (Score:5, Funny)
Just another flaw in the system.
Come and see the flaws inherent in the system! Help! Help! I'm being modded down!
Parent
Re:Jon Stewart? (Score:5, Funny)
This perfectly illustrates one of the unspoken rules of Slashdot culture:
*If the sole point of your post is to either complain, call a moderation unfair, or ask for an explanation about a moderation, be prepared for your post to be modded in exactly the same way.*
It's really a wonderful cultural practice, and is preparing interworldnettubez denizens everywhere for what they can expect when asking similar questions of real world "moderators" like cops and politicians.
Let's all keep up the good work!
Parent
Pick your punchline (Score:5, Funny)
Pick your "Daily Show"-style punchline for this story:
Parent
Re:Jon Stewart? (Score:4, Funny)
Parent
sweet (Score:5, Insightful)
a nice, easy, reliable way to detect a conficker infection.
great!
Re:sweet (Score:5, Funny)
As long as it doesn't get slashdotted... that might cause a new panic
Parent
Re:sweet (Score:5, Funny)
i panicked for a sec, im on linux but thanks to virgin media the bottom two images didn't load. thankfully the chart said: any other combo = shite internet!
Parent
Re:sweet (Score:5, Funny)
Just be glad you aren't using Sunni internet.
Parent
Re: (Score:3, Funny)
*shudder*
That's totally out of control. Page after page of shameless hussies lifting their burkas to flash their ankles!
hask
Re:sweet (Score:4, Funny)
Parent
Re: (Score:2)
Indeed. I really didn't expect it to be something this nice and easy. I'm definitely going to pass this one around.
Re:sweet (Score:5, Funny)
The chart or the virus?
Parent
Re: (Score:2)
It seems that Conficker's authors could get round the tests without any trouble too; just roll out an update that blocks everything from F-secure et al. except the nice logos.
Re:sweet (Score:5, Informative)
Parent
Re:sweet (Score:5, Informative)
The reason there are logos there is to test that your browser can actually display images before you start panicking that you don't see the logos from the anti-virus. They are also good to compare download times in case that your Internet connection is just slow at that time.
I copied to source code into an Apache server here, changed the logos on the lower row to point to images on the respective sites (instead of local images) and downloaded the "description" images. Works like a charm, we already found an infected laptop.
Parent
That's pretty neat (Score:2)
I'm glad the computer I'm using is not affected. I think it's funny how every few years the media picks up and runs with the new malware of the day. Remember that one that flashes the computer's BIOS? The one named after some famous artist?
I see a dog. (Score:5, Funny)
Re:I see a dog. (Score:5, Funny)
Funny, I see a penguin, a blowfish, the devil, and some boring corporate logos. No dogs. You must have Confiker R variant (Rorschach variant)
Parent
Re: (Score:2)
Re:I see a dog. (Score:4, Funny)
I was going to explain it, but I got caught up looking at the pretty butterfly.
Parent
Re:I see a dog. (Score:4, Funny)
Well, there are only two kinds of people in the world. Those with ADD and ......
Parent
Lynx support? (Score:5, Funny)
Come on, it doesn't work in Lynx? I want my money back.
Re:Lynx support? (Score:5, Funny)
Works here.
You must be infected.
Parent
If Conficker was designed by a security guru... (Score:5, Interesting)
Because there is so much money to be made by botnets these days, it has moved from a "look what I can do" feat to a real business in its own right (legality aside). It is widely assumed that Conficker is among the first of a new breed of very carefully produced viruses and worms, written by professional developers who are paid quite well for their computer security and anti-anti-virus skills.
This class of developer knows exactly how the anti-virus companies work. It should have been expected by the Conficker designers that their virus would be examined in isolated networks. The designers would therefore be able to take advantage of that (it's easy enough to detect -- no word from the master servers, no ability to further infect, etc), and that's what we saw yesterday. Planned panic for no reason. At this point, most people think Conficker is either no serious threat, or an April Fools' Day prank. These people could be very wrong.
With the pressure off, infected machines are now able to go about their intended business, which could be sending spam, using distributed computing, farming user data, coordinated attacks of one type or another, or merely a conspiracy to protect computers from infections (a virally spreading anti-virus utility that you can't detect, stop, or remove? ingenious!).
The merits of a secret anti-virus product are more down-to-earth than you might think; most high-end zombie masters write their viruses so that they can't be detected by users and so that they are the sole "pwners" of the system -- competition is bad in this field. What you end up with is zombie masters who are suddenly interested in maintaining your computer for you - virus-free (save their virus), clean, efficient. If this zombie master is your federal government, merely reserving the right to use ("draft") your system as a "minute man" for emergencies where your computing power or attacking capabilities are needed, that might be a fair "tax."
Re:If Conficker was designed by a security guru... (Score:5, Informative)
No, they didn't plan on misleading the public about April 1st. Even the real(not PR driven) security researches didn't think anything bad would happen. The public and news sites were just using it as an excuse to make a fuss again.
Conficker has already had a few of these dates, April 1st is just the date it starts actively looking for any future updates to the worm. As long as everything is going well so far, they won't update it.
Parent
Slashdotted scare (Score:5, Informative)
Clicked on the link, page unavaliable. A reload did work.
Should be in the summary: If the page doesn't load at all, that doesn't mean you're infected, that means "Poor Internet connection?" If the page loads but some of the images don't, THAT is a positive.
Re: (Score:3, Informative)
Same here. Reloading did work. Thankfully, I'm clean!
Thank god (Score:5, Funny)
Whew, I haven't had that much relief since I accidentally ate that whole jar of exlax....
Slashdotted (Score:5, Funny)
Mirror (Score:5, Funny)
Conficker Eye Chart
Conficker Eye Chart
[f-secure.com]
[secureworks.com]
[trendmicro.com]
[openbsd.org]
[linux.org]
[freebsd.org]
How to interpret:
If you see this above:It probably means this:
= Normal/Not Infected by Conficker (or using proxy)
= Possibly Infected by Conficker (C variant or greater)
= Possibly Infected by Conficker A/B variant
= Image loading turned off in browser?
Any other combination= Poor Internet connection?
Explanation:
Conficker (aka Downadup, Kido) is known to block access to over 100 anti-virus and security websites.
If you are blocked from loading the remote images in the first row of the top table above (AV/security sites) but not blocked from loading the remote images in the second row (websites of alternative operating systems) then your Windows PC may be infected by Conficker (or some other malicious software).
If you can see all six images in both rows of the top table, you are either not infected by Conficker, or you may be using a proxy server, in which case you will not be able to use this test to make an accurate determination, since Conficker will be unable to block you from viewing the AV/security sites.
F-Secure and the F-Secure Logo are trademarks of F-Secure Corporation.
SecureWorks and the SecureWorks Logo are registered trademarks of SecureWorks Inc.
Trend Micro and the T-Ball logo are trademarks or registered trademarks of Trend Micro Inc.
Parent
Re:Mirror (Score:5, Insightful)
Ha.
Anyway, the page is a clever idea.
Here's another interpretation to add to the list: Some of the sites that the page pulls images from are Slashdotted.
Parent
This is gonna cause mass hysteria.. (Score:2, Insightful)
Re: (Score:2, Insightful)
I think it's already there... I got it to actually load 1 out of 6 trys
Well that's why it's slashdotted... people are loading it six times!
Nothing? (Score:3, Interesting)
Someone set us up the spambot.
Spam was way down most of this year, until yesterday. Then it shot back up to where it was last year.
Clearly someone tagged 4/1 as the day to start the spambots back up. Whether this is directly related to the conficker thing I couldn't tell.
Re:Nothing? (Score:4, Interesting)
I can't take credit for saying this as I'm only parroting it from another source, Fark I believe, but someone said it was well-known in the security industry that April 1st is by far the most common date for new malware to go live, and is also a common date for existing malware to update.
Probably to maximize confusion.
Parent
Oh shit (Score:5, Funny)
How long before they ruin this test (Score:5, Interesting)
Re:How long before they ruin this test (Score:4, Insightful)
Not if they're blacklisting. Only if they're redirecting. And if they were redirecting they'd presumably already have fake site mirrors set up, including these images, so the test would have never worked.
Parent
Oops (Score:5, Funny)
Another option for the eye chart (Score:5, Funny)
And if you can see the top row and not the bottom one it means you work at Microsoft.
Re:Very nice & interesting technique (Score:5, Funny)
Sucks when / is blocked, now, isn't it? :)
Parent
Re:Jon Stewart (Score:4, Informative)
Try the em tag.
Parent
Re: (Score:3, Insightful)
Re:How long before... (Score:5, Insightful)
Then we (it's open source after all!) modify the test to use iframes (ewwww... but useful in this situations) to actually load the full pages, once Conficker gets updated so it allows the pages, we move to actually downloading the patches with a message like "if the file doesn't download, you're probably infected", by the time Conficker gets good enought to actually allow the patches but modifing them on the fly so they are not useful (just random noise with the same size and filename), then we're screwed.
Maybe I shouldn't give them ideas. I bet the author of Confickr reads slashdot.
Parent
Re: (Score:3, Funny)
Maybe I shouldn't give them ideas. I bet the author of Confickr reads slashdot.
Considering that s/he actually gets shit done I highly doubt it.