.CA Registrar Trying To Preempt Conficker 227
clover kicker writes "The CBC reports that the group managing Canada's .ca internet domain is working to foil an internet worm set to attack starting April Fool's Day. 'This is the first virus that's really focused on domain names as part of propagating the virus itself,' said Byron Holland, CEO of the Canadian Internet Registration Authority, a non-profit organization that represents those who hold a .ca domain. CIRA's strategy includes pre-emptively registering and isolating previously unregistered .ca domain names that Conficker C is expected to try and generate, said a news release issued by the group. That would make those names unavailable for anyone to register in order to set up a website to host the worm's 'command and control' file. A list of the names has been predicted by security experts based on the worm's code. In addition, CIRA is investigating and monitoring activity at names on the list that have already been registered and will 'take appropriate action if suspicious activity is detected.'"
Hrm (Score:5, Interesting)
Re: (Score:1)
Re: (Score:1, Funny)
Anti-virus software becomes live CDs that require a reboot to use. When you run it, it either replies "Your computer is fine" or "You must reinstall Windows".
Re:Hrm (Score:4, Funny)
We can only hope for some explosions to make it interesting.
Re:Hrm (Score:5, Interesting)
Learn to say (Score:1)
Re: (Score:2, Insightful)
This is because there's just no way to do it without destroying what makes the internet such a good thing in the first place.
Re: (Score:2, Funny)
bandwidth requirements for spam and other garbage keep climbing
What? BitTorrent isn't number one traffic anymore? This is not acceptable!
*ducks*
Re: (Score:2)
Well, Conficker has P2P functionality...
I think it would be really really fun if it turned out to share everyone's music and video. Especially if MAFIAA computers got infected in the process.
Popcorn time indeed.
Re: (Score:2)
Yeah, until we get the phone call from someone who needs help disinfecting a Windows machine. Then it isn't quite as entertaining.
Unless it's your job (as in something you'd claim on taxes) just say, "no." It worked for me. After a few times of, "I need to download a file," or, "I think I have a virus...what's a backup," and the venerable, "I need to install [insert piece of crap software], can you help me," being denied they stopped calling me. Are family relations any better? No, but they're not any worse, and teh simple fact is that I *don't* do that kinda thing anymore: at work, at home, or anywhere else. Even if I *wanted* t
Re: (Score:2)
For me... well yes and no. I'm really wondering what it is going to do in the first place.
Yes: because it could be a wake-up call to computer security. But then I have been thinking that since the i-love-you virus or what was it, the first one to propagate by e-mailing itself to everyone in the outlook address book. Many people know or at least should know about viruses and worms by now, but many/most still don't care.
No: because in case of a truly malicious attack the results could be quite horrible for
Re: (Score:2, Informative)
in case of a truly malicious attack the results could be quite horrible for the infected users, the Internet or even the world as a whole.
For us desktop and server technicians - Ka Ching !!
Re:Hrm (Score:4, Funny)
Re: (Score:3, Funny)
Am I the only one hoping like hell that someone will release this virus for the Mac and Linux platforms? :)
Re: (Score:2)
No.
I don't use Windows, so I will not be directly affected.
But it may have an impact on the internet itself. Think about wasted bandwidth, web sites putting measures against it, domain registrars requiring more Draconian measures for registring domains (imagine having to send paperwork, while you don't have to now), ...etc.
Tactics? (Score:4, Insightful)
It's like telling your enemy "Hey, I know where and when your going to strike"
We know it's capable to updating itself, this just gives the author an 8 day head start on writing a new pseudo random URL generator.
Re: (Score:1)
Re: (Score:1)
Hey, I in ur baze iz an im taken ur domainz...
Re: (Score:3, Informative)
Yes, it should have been done quietly. Perhaps it is a PR thing "our .ca domains are not vulnerable"? Who knows.
As I >pointed out [slashdot.org] in another comment, the author(s) scan all the info about Conficker and then modify it to protect itself against the defenses. They did that by releasing the C variant to select domains out of a random number of 50,000 total, after the initial 250 got outed in B.
I bet that there will be a D variant shortly before April 1st, and it will have more defenses and convolutions.
Inter
Re:Tactics? (Score:5, Informative)
It seizes to amaze me as to why they would make this public, 8 days before conficker is "supposed" to become active.
Assuming English isn't your first language: "It never ceases to amaze me" is what you meant, i.e. "I'm always surprised."
Re: (Score:2)
Re:Tactics? (Score:4, Interesting)
It seizes to amaze me as to why they would make this public, 8 days before conficker is "supposed" to become active.
It's like telling your enemy "Hey, I know where and when your going to strike"
We know it's capable to updating itself, this just gives the author an 8 day head start on writing a new pseudo random URL generator.
Others have already answered to the effect that publicly coordinating actions doesn't significantly raise the exposure in this particular case.
But going beyond that, are you sure that they're not manoeuvring in the face of the enemy, trying to elicit a response? Once you've got a subject under observation, sometimes the best way to learn its true nature is to poke it and see what it does.
Re: (Score:2)
Re: (Score:2)
Isn't the auto-generated domain the only way it can update itself? Where do you think all of these compromised computers are going to get the new URL generator from?
And why do they need the URL generator, if they can contact the compromised machines without it?
Re: (Score:2)
If they were smart, they'd have kept that little tidbit secret... quietly shuffle the domains off into never-land to help protect the world at large, and still allow them to be registered.
Have they never heard of a honey pot? Registering a domain in Canada requires you sign several contracts, become a member in CIRA, give them rights to your first born, etc.. Anonymous domain registration is not allowed in Canada, and until quite recently, registering a .CA domain name was restricted to Canadian citizens. I
Re: (Score:2, Funny)
"grammer" nazi?
Re: (Score:3, Funny)
Re: (Score:2)
If you're going to correct somebody on something as silly as that, at least get it right....
Grammar = the spelling/construction of sentences to form semantic meaning.
Grammer = An actor, most notable for his role as Dr. Frasier Crane in Cheers and Frasier.
Re: (Score:1, Insightful)
People misusing ceases irritates me almost as much as people saying "I could care less". That's all well and good, if you care a great deal about something, but what people mean when they say it (and Americans are the guiltiest of all when it comes to this) is "I couldn't care less".
Re: (Score:2)
Unless they mean "I could care less [... if I really, really tried hard]".
Re: (Score:2)
Oh, I'm soooo sorry that you have never heard of sarcasm.
Re: (Score:2)
I could cease to care less.
Source code (Score:2, Insightful)
Re: (Score:2)
I'd pay even for just the comments, assuming the developer had the sense to make his code maintainable.
April Fools!!! (Score:5, Funny)
Re: (Score:2)
And then, relieved, people forget to remove it. And on April 2nd, when it is no longer a joke, the real fun begins.
Can't somebody just... (Score:1)
Re: (Score:3, Informative)
Re: (Score:2)
IIRC the authors were smart enough to use digital signatures to protect against that.
Re: (Score:2)
... which makes me worry about what else might be in store.
They are already way past the script-kiddie stage.
Re: (Score:2)
Also its set to go off on 1. April, so when the internet is down and nukes are flying people are just going to laugh thinking its a hoax.
Re: (Score:1)
Helps, but not much ... (Score:5, Informative)
I saw the article today on CBC (Canada's equivalent of the BBC).
This effort may help, but given that the worm has so many other TLDs to choose from, it may not help much. Making the 110 TLDs only 109 (or even 75 if other TLD authorities do the same) will not help that much.
Moreover, there is another mechanism which is not very clear, whereby the infected nodes will contact each other via a See Peer to Peer protocl [sri.com]. So, once the botnet gets going, the need for the domain name (so called "Internet Rendevouz points") may diminish.
Also, the article contains some inaccuracies:
Actually, the worm author(s) are aware that the user may change the clock of the PC to avoid the worm from triggering. So they query several well known sites and check the date/time on the HTTP headers to make this defense point moot. See Internet Date Checking [sri.com]
It will query only 500 out of 50,000 generated domain names. See the domain generation algorithm [sri.com].
I bet there will be a revision D shortly before April 1st, and the author(s) will address many of the potential defenses in revision C.
Re:Helps, but not much ... (Score:5, Funny)
Well, that would certainly explain the "C," wouldn't it?
Re: (Score:2)
Re: (Score:2)
It will query only 500 out of 50,000 generated domain names.
This part I still don't get. It means that either the authors plan to register a huge number of domains (very unlikely as in it makes it way too obvious who is behind this worm), or only about 1% of the infected hosts will succeed in connecting to the correct host to receive instructions. Still a large number of course, but how about the other 99% of infected hosts? Are they just going to sit idle? Or if using that p2p functionality to propagate instructions: how are they going to find each other?
Re: (Score:2)
They use a huge amount to make it impossible for people to put a watch-list on every domain. 50,000 per day, over months is a number too large to watch every domain. People are anxious about the April 1st, but that's unlikely to be when an update occurs. That's just when the worm starts looking for updates. An update is more likely to come much later, or whenever they require pushing out a spambot etc.
You only need a subset to connect to the rendez-vous domain. The worm keeps a list of the last 100 or so IP
Re: (Score:2)
Here is my educated guess:
It is based on probability.
The author(s) of the worm would register just 500 (or so) of the 50,000 domains. That is 1% as you said.
The worm then generates the 50,000 random names, and tries to contact a sample of 500 of these.
It has to just succeed in contacting one of them, and downloading a payload.
There is also the peer to peer protocol, which is not fully understood (the SRI researches say that studying it is an "ongoing concern"), but will allow nodes to act as client and/or s
Re: (Score:2)
Ideally, yes, all of them cooperating would help a lot.
But note that the TLDs belong to different entities/countries with varying levels of competence/funding. Some are very small islands that have a cool TLD, run by small outfits.
Getting them all to agree to act and coordinate it all would not be realistic.
Let us hope I am wrong. I don't use Windows, but I think this worm will have an impact on the internet itself.
What's in a name? (Score:4, Funny)
I think I've heard every lexically significant variation on the name of this damn worm by now. I have no idea what "Conficker" actually means or to what it refers, but so far on this thread people have called it "Conflicker," "Cornflicker," and best of all "Cornfucker."
I think another name for it is "Downadup," which I always read as either "Downandup" or "Download a Duplicate."
Who gets to name the worms? We know that this one employs neat tricks like code signing peer-to-peer driven software updates and that it might be used for a sort of "evil Google" that people can use to data mine financial stuff and so on. Couldn't we lobby for a more rational taxonomy, so we could call this one "Cryptographically Labyrinthine Internet-Traveling ORganized Information Stumbler?"
Re: (Score:1)
I have no idea what "Conficker" actually means or to what it refers
It sounds like the English word, "configure." Also, "ficken" is German for "to fuck", so one would imagine that, like any good piece of malware, it fucks with your configuration.
I forget where I read that, so [citation needed]. Sorry. I swear, I saw it on Wikipedia, but it's not there now....
Re: (Score:1)
Configuration(conf) F*cker(ficker).
And yes, the fs are overlapping.
Re: (Score:2, Funny)
Re: (Score:2)
Bad idea, the CLITORIS can not be found by man... certainly not a slashdotter.
Ever since there has been a bright red clitoris on every ThinkPad, this hasn't been true.
Cryptographic Signing, Peer to peer (Score:1)
Re: (Score:2)
And slammer is still very active after 6 years...
i just got off the toilet (Score:1, Funny)
plop!
Seems like a futile attempt (Score:5, Insightful)
It's cute that they're trying to preempt the worm, but to be effective they pretty much have to disable ALL potential domains. Miss one, and the worm will find it.
What I don't get is how people can still be surprised/impressed/scared by these things. Today's viruses have little in common with their elegant, obfuscated ancestors. Any twit can assemble a "virus" by tapping into the OS' libraries. Today's worms are essentially package managers, so anything you can do with legitimate software like emailing, flashing your BIOS or opening ports on your firewall, a virus can do the same things. It simply has to talk to its software repository, pull down the pieces it needs and proceed with its dirty deeds.
Hell, a tiny perl script could turn standard tools like Yum and Emerge into virus delivery agents. They already possess all the required functionality...
Re: (Score:3, Informative)
On the contrary, conficker looks very much like something that harkens back to the bad old days. True it doesn't have the hard memory constraints of a boot sector virus but it's not bloated nor is it just a primitive script.
It uses strong crypto to protect it's updates, it uses peer to peer to distribute it's updates and code obfuscation that puts the best of the old school to shame. The obfuscation is so good in fact that it's proving to be a serious barrier to pulling apart the new peer to peer code; i
Re: (Score:2)
So have you found a way to keep inelegant viruses from being dangerous?
The root cause IMO (Score:2, Insightful)
It's like someone announcing on a street corner that the bricks on the south wall of a bank were found to be very thin, but don't worry..
Re: (Score:3, Insightful)
The flaw in your argument is trusting MS to be timely about its updates.
I'd say tell the vendors, and give them about a month.
If they haven't fixed it by then, there's a chance that someone else has found it, and publishing it won't hurt anything else, and may actually help by putting pressure on the vendor for a fix.
Keeping an exploit under wraps only works if the vendor is responsive enough so that they don't get beat by a different "researcher" looking to use the hole for his own gain.
Re: (Score:3, Insightful)
Second, the general ethics about flaws disclosure is to inform the manufacturer first, but to keep in mind that even if you are a talented security researcher, there are numerous malicious talented security researcher and that if the manufacturer doesn't react,
Full Disclosure (Score:2, Insightful)
> Isn't one of the root causes of all this the fact that the exploit was released into the wild?
Yes and no.
In the bad old days before full disclosure, vendors would threaten security researchers. That lead to the bad guys knowing everything and being able to hack with impunity, the security researchers being considered the "bad guys" even though they weren't doing anything bad with the holes they found, and the general public being totally ignorant of all the security problems out there.
In other words,
Re: (Score:2, Insightful)
Isn't one of the root causes of all this the fact that the exploit was released into the wild?
No. Microsoft was (made) aware of the vulnerability and had a patch available on 2008-10-18. According to Symantec's malware database, W32/Conficker.A was first seen on 2008-11-24. If all vulnerable machines had been patched in a timely fashion, Conficker would not have spread.
Full-disclosure motivates vendors to patch their vulnerable software, and allows administrators and users to take precautions (independent of the vendor's action or inaction). For more information on why full-disclosure is preferabl
RegistrY, not registrAR (Score:2)
Re: (Score:2)
D'oh, I screwed up the submission. Blame me.
Re: (Score:2)
Re: (Score:2)
Except nobody is in the driver seat at the moment.
This is a way of trying to keep anyone from stepping in.
Re: (Score:2)
Incorrect... someone is most certainly in the driver seat. Botnets aren't autonomous sytems that spawn out of control. They are replicated and controlled spawned instances, nodes or bots in a net mind you, doing whatever whomever is pulling the strings would like.
Re: (Score:1)
Yeah, you know how they control this one?
BY THE MECHANISM .CA IS TRYING TO THWART YOU FUCKING RETARD.
Why the HELL did you feel qualified to comment on this?
Re: (Score:2)
Re: (Score:3, Insightful)
I know I shouldn't feed the trolls, but if these people who "analyzed" it only know what they've been able to observer or provoke it to do. I must have missed where they completely reverse engineered it and created a fix.
They figured out 1 of a myriad of its activities and service mediums let alone been able to crack one of its control channels. I'm all for fighting the good fight, but saying we unders
Re: (Score:2)
Well, it could be changed just as easily. .ca domain, the controller can easily avoid hitting the previously predicted names, and either avoid .ca (very easy), or generate new names.
If you already own a control server, you can also 'update' your zombies.
By telling that they will monitor the
Re: (Score:2, Funny)
Re: (Score:2)
This has to be the most comprehensive spamming I've seen on this site for a while.
Re: (Score:2)
I wouldn't mind so much if he/she made decent use of white space. I can't even read it without my eyes twisting up.
Re: (Score:2)
You read it? you are a sadomachist
Re: (Score:1, Offtopic)
Good, now I know where to pick up supplies.
Cache of guns. $10,000
Cache of ammunition: $10,000
Gold and silver conins: $10,000
Shooting a militant conspiracy nut in the head while he goes to check his mail, with the ATF and FBI standing back watching and laughing, but technically seeing "nothing": Priceless
Re: (Score:2)
You are just *SO* cute? Would you like to tell me about DRM and Open Office, too?
I feel left out... (Score:5, Funny)
My wife runs MacOS and I have my Linux... I really wish I could get involved in the party. Will Cornfucker run under Wine?
Re: (Score:2, Funny)
Re:I feel left out... (Score:5, Funny)
Oh your elitist, mob-rule attitude is not helpful. Some of us aren't fortunate enough to be able to afford Microsoft software. The wife's Mac OS X came with her machine and my computer did come with Windows installed on it but I didn't create the restore media before my machine was trashed with malware. So instead of buying software, I got free software. It works just fine though. Well enough to post here, view all sorts of porn that would have trashed my computers again if I were running Windows, and aside from playing games and DRM media, I can do anything I ever wanted to do.
It is only during events like those created by cornfucker that I really begin to feel left out of the party.
Re:I feel left out... (Score:4, Funny)
Oh the irony: "Some of us aren't fortunate enough to be able to afford Microsoft software. The wife's Mac OS X..."
Re:I feel left out... (Score:4, Funny)
nono.. that's why he can't afford Windows... he had to sell the car and remortgage the house to buy the Mac.
Re: (Score:2)
As soon as your OS is used by more than 50 people
If we are going to make comparisons based on popularity don't forget that the most popular restaurant in the world is McDonald's.
Re: (Score:3, Funny)
No. It uses a vulnerability in the Windows File and Printer sharing daemon to inject a DLL file into svchost.exe.
I suggest filing a bug with SAMBA and Wine, respectively.
Re: (Score:3, Funny)
I recall a test of viruses under Wine, a while ago... apparently, only a few of the tested viruses would even run, but none were able to do anything dangerous.
Some have used this as an argument that Wine is not nearly compatible enough.
Re: (Score:2)
Yes, so the solution is to keep peddling the environment that makes this easy? I'm bewildered by what people put themselves through to be able to run excel macros.
Re: (Score:2, Insightful)
Maybe ACs should be disabled until at least 30 comments are written or something...
Re: (Score:2)
maybe. there has to be a happy medium somehow.
Re: (Score:2)
Oh probably. Do you think they'll be able to channel an answer?
Directly from /b/ (Score:2)
Re:ugh (Score:5, Insightful)
Look, we don't hate you for what you write - it may well be true. It just has nothing to do with this story, OK? It really is offtopic. In fact I agree with a lot of what you wrote (and disagree with some twisted facts too) but I think the moderators are right modding you down to hell, and maybe banning your IP range. You are annoying people. Annoyed people don't listen. Find a forum to discuss this in a sane way and people might listen.
Re: (Score:3, Insightful)
now I'd subscribe again for that. It would have to be lottery style or something mad random... way too many trolls out there with too much time on their hands.
Re: (Score:2)
This is almost as good as mad libs!
Re: (Score:1, Offtopic)
1. Pre-stretch anus.
2. Apply lubricant to Yoda doll.
3. Insert into anus.
4. Remove from anus.
5. Repeat step 3 (and 2 as needed) and 4 as desired.
6. Burn in troll hell.
The obvious question (Score:2)
Re: (Score:2)
R-I-D-I-C-U-L-O-U-S
Re: (Score:2)
I've registered 3 .ca domain names, and not encountered any sort of problems or difficulties. At all.
I don't know which .ca registrar you're dealing with, but the ones I've dealt with are fine.