Diagnose Conficker With Web-Based Eye Chart 180
thomsomc writes "Joe Stewart from the Conficker Working Group has created an eye chart that allows for online identification of Conficker B and C infections. Using basic knowledge of the blacklisting that Conficker employs to avoid attempting to infect IPs that belong to popular Anti-Virus and security firms (including Microsoft), the group whipped up this very simple test to see if you can load content from the various pages. If you can see all of the images, you're more than likely Conficker-free. According to Honeynet, 'This detection method should be more reliable than network scanning based tests. Happy scanning!'" Related: Tech Fragments notes in passing that nothing much seems to have come of conficker's dreaded April 1 deadline.
Jon Stewart? (Score:5, Funny)
Am I the only one that read it as Jon Stewart and then spent a few minutes trying to figure out the joke on the page?
Re: (Score:3, Funny)
Haha, me too. Give this a !jonstewart tag.
Re: (Score:3, Insightful)
the question is: how many other topics can we find that are !jonstewart?
answer: 99% of them wooooooooooooo
Re: (Score:2)
No; the real question is, how many other tags do we need to add about what this is not? Clearly there should be a !stephencolbert tag as well as a !billmurray and !torquemada. Better add !natalieportman too, and of course !dmca. What else isn't this story about?
Re: (Score:1)
That's what I was trying to communicate, but apparently I'm flamebait :(
That hurts, slashdot...:( I was expecting someone else to dig up old articles with the name Jon or Stewart in them and say "Silly noob, these articles are more than 1% of /."
Maybe yall are still venting after the internet sucking yesterday, but its no reason to take it out on me!
*cries and runs away*
Re: (Score:2)
Re:Jon Stewart? (Score:4, Informative)
How can the first post be modded Redundant when he says something that is not a meme or a common sentiment?
Re:Jon Stewart? (Score:4, Informative)
How can the first post be modded Redundant when he says something that is not a meme or a common sentiment?
Because someone with mod points is either trolling or doesn't understand the meaning of the word. Just another flaw in the system.
Re:Jon Stewart? (Score:5, Funny)
Just another flaw in the system.
Come and see the flaws inherent in the system! Help! Help! I'm being modded down!
Re: (Score:1, Redundant)
In the general case, if the comment is so obvious it wasn't worth making in the first place (or, especially, just repeats something in the summary / article), then it's redundant.
In this case, I agree, the moderation is silly. Hopefully it will be corrected in metamod.
Re: (Score:1, Insightful)
Re: (Score:1)
Which this particular one doesn't do, so please mod me irrelevant.
Hah! You CAN'T!
Re:Jon Stewart? (Score:5, Funny)
This perfectly illustrates one of the unspoken rules of Slashdot culture:
*If the sole point of your post is to either complain, call a moderation unfair, or ask for an explanation about a moderation, be prepared for your post to be modded in exactly the same way.*
It's really a wonderful cultural practice, and is preparing interworldnettubez denizens everywhere for what they can expect when asking similar questions of real world "moderators" like cops and politicians.
Let's all keep up the good work!
Pick your punchline (Score:5, Funny)
Pick your "Daily Show"-style punchline for this story:
Re: (Score:2, Funny)
I say this with love... keep your day job.
Re: (Score:2)
Ah yes, as hilarious as the first hundred times I've seen that joke posted about me. Maybe I _should_ just change my name to !jonstewart...
-Joe
Re: (Score:1)
Re:Jon Stewart? (Score:4, Funny)
sweet (Score:5, Insightful)
a nice, easy, reliable way to detect a conficker infection.
great!
Re:sweet (Score:5, Funny)
As long as it doesn't get slashdotted... that might cause a new panic
Re:sweet (Score:5, Funny)
i panicked for a sec, im on linux but thanks to virgin media the bottom two images didn't load. thankfully the chart said: any other combo = shite internet!
Re:sweet (Score:5, Funny)
Just be glad you aren't using Sunni internet.
Re: (Score:3, Funny)
*shudder*
That's totally out of control. Page after page of shameless hussies lifting their burkas to flash their ankles!
hask
Re:sweet (Score:4, Funny)
Re: (Score:1)
Since the images are each only 3 to 10 KiB each, I doubt it.
Re: (Score:2)
Re: (Score:2)
Indeed. I really didn't expect it to be something this nice and easy. I'm definitely going to pass this one around.
Re:sweet (Score:5, Funny)
The chart or the virus?
Re: (Score:2)
Hopefully just the chart. ;)
Re: (Score:2)
It seems that Conficker's authors could get round the tests without any trouble too; just roll out an update that blocks everything from F-secure et al. except the nice logos.
Re:sweet (Score:5, Informative)
Re: (Score:2, Informative)
The site is slow, but I found a copy here. [joestewart.org]
I'm going to make my own page based on this idea because there was no reason to put the stupid Linux and BSD logos on the page. That's just being a douche bag.
Re:sweet (Score:5, Informative)
The reason there are logos there is to test that your browser can actually display images before you start panicking that you don't see the logos from the anti-virus. They are also good to compare download times in case that your Internet connection is just slow at that time.
I copied to source code into an Apache server here, changed the logos on the lower row to point to images on the respective sites (instead of local images) and downloaded the "description" images. Works like a charm, we already found an infected laptop.
Re: (Score:2)
I'm more upset he didn't reference the Logos at the bottom of the page. He did all the proprietary ones.
Re: (Score:2)
I'm going to make my own page based on this idea because there was no reason to put the stupid Linux and BSD logos on the page. That's just being a douche bag.
with blackjack and hookers? in fact, forget the page...
Re: (Score:2)
According to the chart, my Fedora/Seamonkey (with javascript disabled and no Flash installed) is possibly infected with Conflicker C?
That's pretty neat (Score:2)
I'm glad the computer I'm using is not affected. I think it's funny how every few years the media picks up and runs with the new malware of the day. Remember that one that flashes the computer's BIOS? The one named after some famous artist?
I see a dog. (Score:5, Funny)
Re:I see a dog. (Score:5, Funny)
Funny, I see a penguin, a blowfish, the devil, and some boring corporate logos. No dogs. You must have Confiker R variant (Rorschach variant)
Re: (Score:2)
Re:I see a dog. (Score:4, Funny)
I was going to explain it, but I got caught up looking at the pretty butterfly.
Re:I see a dog. (Score:4, Funny)
Well, there are only two kinds of people in the world. Those with ADD and ......
Re: (Score:2)
Linux and OpenBSD too ?! (Score:1)
oh gosh, I am infected (Score:1)
Re: (Score:1)
$ sudo aptitude install w3m-img
Infection cured?
Re: (Score:2)
Mine can. w3m displays images just fine in both xterm and rxvt if it's built to.
Lynx support? (Score:5, Funny)
Come on, it doesn't work in Lynx? I want my money back.
Re:Lynx support? (Score:5, Funny)
Works here.
You must be infected.
Re: (Score:1)
If Conficker was designed by a security guru... (Score:5, Interesting)
Because there is so much money to be made by botnets these days, it has moved from a "look what I can do" feat to a real business in its own right (legality aside). It is widely assumed that Conficker is among the first of a new breed of very carefully produced viruses and worms, written by professional developers who are paid quite well for their computer security and anti-anti-virus skills.
This class of developer knows exactly how the anti-virus companies work. It should have been expected by the Conficker designers that their virus would be examined in isolated networks. The designers would therefore be able to take advantage of that (it's easy enough to detect -- no word from the master servers, no ability to further infect, etc), and that's what we saw yesterday. Planned panic for no reason. At this point, most people think Conficker is either no serious threat, or an April Fools' Day prank. These people could be very wrong.
With the pressure off, infected machines are now able to go about their intended business, which could be sending spam, using distributed computing, farming user data, coordinated attacks of one type or another, or merely a conspiracy to protect computers from infections (a virally spreading anti-virus utility that you can't detect, stop, or remove? ingenious!).
The merits of a secret anti-virus product are more down-to-earth than you might think; most high-end zombie masters write their viruses so that they can't be detected by users and so that they are the sole "pwners" of the system -- competition is bad in this field. What you end up with is zombie masters who are suddenly interested in maintaining your computer for you - virus-free (save their virus), clean, efficient. If this zombie master is your federal government, merely reserving the right to use ("draft") your system as a "minute man" for emergencies where your computing power or attacking capabilities are needed, that might be a fair "tax."
Re:If Conficker was designed by a security guru... (Score:5, Informative)
No, they didn't plan on misleading the public about April 1st. Even the real(not PR driven) security researches didn't think anything bad would happen. The public and news sites were just using it as an excuse to make a fuss again.
Conficker has already had a few of these dates, April 1st is just the date it starts actively looking for any future updates to the worm. As long as everything is going well so far, they won't update it.
Re: (Score:2)
With the pressure off, infected machines are now able to go about their intended business
bot-net performance anxiety is a new concept to me. what you're saying sounds reasonable, but the obvious question is why wait?
there's no limitation that says that Conficker cannot be in operation while it continues to spread. It's clear that the majority of infected computers will never be cleaned (because their owners don't know/care). So why be coy?
Even if we knew what it did, it wouldn't change the fact that the oblivious people running infected machines will remain oblivious.
Re: (Score:2)
Because there is so much money to be made by botnets these days, it has moved from a "look what I can do" feat to a real business in its own right (legality aside). It is widely assumed that Conficker is among the first of a new breed of very carefully produced viruses and worms, written by professional developers who are paid quite well for their computer security and anti-anti-virus skills.
This class of developer knows exactly how the anti-virus companies work. It should have been expected by the Conficker designers that their virus would be examined in isolated networks. The designers would therefore be able to take advantage of that (it's easy enough to detect -- no word from the master servers, no ability to further infect, etc), and that's what we saw yesterday. Planned panic for no reason. At this point, most people think Conficker is either no serious threat, or an April Fools' Day prank. These people could be very wrong.
With the pressure off, infected machines are now able to go about their intended business, which could be sending spam, using distributed computing, farming user data, coordinated attacks of one type or another, or merely a conspiracy to protect computers from infections (a virally spreading anti-virus utility that you can't detect, stop, or remove? ingenious!).
The merits of a secret anti-virus product are more down-to-earth than you might think; most high-end zombie masters write their viruses so that they can't be detected by users and so that they are the sole "pwners" of the system -- competition is bad in this field. What you end up with is zombie masters who are suddenly interested in maintaining your computer for you - virus-free (save their virus), clean, efficient. If this zombie master is your federal government, merely reserving the right to use ("draft") your system as a "minute man" for emergencies where your computing power or attacking capabilities are needed, that might be a fair "tax."
Except there's nothing particularly new, innovative, or resistant to AV in conficker. Conficker came to exist long after the vulnerability it exploits was publicly fixed. It is trivially detectable with a wide array of different techniques, and easily curable. The only thing making it effective is public ignorance about the need to update, and exploitation that flaw is very common.
Re: (Score:2)
Except there's nothing particularly new, innovative, or resistant to AV in conficker. Conficker came to exist long after the vulnerability it exploits was publicly fixed. It is trivially detectable ...
I don't disagree with your assessments, but that's not what I was talking about, either. The point is that we have no idea of what it can do. We know exactly how it got there.
As to how this relates to a virus acting as an anti-virus: When I said not detectable, I meant from the perspective of the everyday [l]user, not a security expert or security software. A zombie master wants his/her zombies to be otherwise clean and operable with minimal intrusion upon the system, as this minimizes detection and m
Re: (Score:2)
Yeah, you need to be a real expert to run AVG, or go to this website:
http://www.confickerworkinggroup.org/infection_test/cfeyechart.html [confickerw...ggroup.org]
Conflicker can be removed, and should be.
As someone who has had a PC for pretty much the entire history of the PC, I have never had a virus on an IBM Compatible.
So I wonder how bad it really is.
Slashdotted scare (Score:5, Informative)
Clicked on the link, page unavaliable. A reload did work.
Should be in the summary: If the page doesn't load at all, that doesn't mean you're infected, that means "Poor Internet connection?" If the page loads but some of the images don't, THAT is a positive.
Re: (Score:3, Informative)
Same here. Reloading did work. Thankfully, I'm clean!
Re: (Score:2)
Can't believe you guys. Clicking on an unverified link about a virus. Duh!
No more dangerous than clicking an unverified link about anything else...
Thank god (Score:5, Funny)
Whew, I haven't had that much relief since I accidentally ate that whole jar of exlax....
Re: (Score:2, Funny)
Slashdotted (Score:5, Funny)
Mirror (Score:5, Funny)
Conficker Eye Chart
Conficker Eye Chart
[f-secure.com]
[secureworks.com]
[trendmicro.com]
[openbsd.org]
[linux.org]
[freebsd.org]
How to interpret:
If you see this above:It probably means this:
= Normal/Not Infected by Conficker (or using proxy)
= Possibly Infected by Conficker (C variant or greater)
= Possibly Infected by Conficker A/B variant
= Image loading turned off in browser?
Any other combination= Poor Internet connection?
Explanation:
Conficker (aka Downadup, Kido) is known to block access to over 100 anti-virus and security websites.
If you are blocked from loading the remote images in the first row of the top table above (AV/security sites) but not blocked from loading the remote images in the second row (websites of alternative operating systems) then your Windows PC may be infected by Conficker (or some other malicious software).
If you can see all six images in both rows of the top table, you are either not infected by Conficker, or you may be using a proxy server, in which case you will not be able to use this test to make an accurate determination, since Conficker will be unable to block you from viewing the AV/security sites.
F-Secure and the F-Secure Logo are trademarks of F-Secure Corporation.
SecureWorks and the SecureWorks Logo are registered trademarks of SecureWorks Inc.
Trend Micro and the T-Ball logo are trademarks or registered trademarks of Trend Micro Inc.
Re:Mirror (Score:5, Insightful)
Ha.
Anyway, the page is a clever idea.
Here's another interpretation to add to the list: Some of the sites that the page pulls images from are Slashdotted.
This is gonna cause mass hysteria.. (Score:2, Insightful)
Re: (Score:1)
Re: (Score:2, Insightful)
I think it's already there... I got it to actually load 1 out of 6 trys
Well that's why it's slashdotted... people are loading it six times!
Re: (Score:2)
Defective thinking. (Score:2)
They should have posted a list of 26 links and told people to click on the link corresponding to the first letter of their name. Or something like that. Or gotten Google to host the page.
Useful in China? (Score:2, Interesting)
My C= is infected!!!! (Score:2)
I tried the VIC-20, 64, 128 and Plus-4
None of them show the pictures....
Nothing? (Score:3, Interesting)
Someone set us up the spambot.
Spam was way down most of this year, until yesterday. Then it shot back up to where it was last year.
Clearly someone tagged 4/1 as the day to start the spambots back up. Whether this is directly related to the conficker thing I couldn't tell.
Re:Nothing? (Score:4, Interesting)
I can't take credit for saying this as I'm only parroting it from another source, Fark I believe, but someone said it was well-known in the security industry that April 1st is by far the most common date for new malware to go live, and is also a common date for existing malware to update.
Probably to maximize confusion.
Oh shit (Score:5, Funny)
Re: (Score:1)
It's not slashdotted, it's the end of the world! (Score:2)
How long before... (Score:2, Interesting)
...Conficker is patched to allow access to these specific images from these domains?
Re:How long before... (Score:5, Insightful)
Then we (it's open source after all!) modify the test to use iframes (ewwww... but useful in this situations) to actually load the full pages, once Conficker gets updated so it allows the pages, we move to actually downloading the patches with a message like "if the file doesn't download, you're probably infected", by the time Conficker gets good enought to actually allow the patches but modifing them on the fly so they are not useful (just random noise with the same size and filename), then we're screwed.
Maybe I shouldn't give them ideas. I bet the author of Confickr reads slashdot.
Re: (Score:3, Funny)
Maybe I shouldn't give them ideas. I bet the author of Confickr reads slashdot.
Considering that s/he actually gets shit done I highly doubt it.
Re: (Score:2)
Conficker messes with DNS not HTTP, assuming they did not want to DDoS themselves they would have to now build in an HTTP proxy (to pass three requests on and 404 the rest) and a firewall to not let anything out to those IPs other than TCP port 80, good luck with that.
How long before they ruin this test (Score:5, Interesting)
Re:How long before they ruin this test (Score:4, Insightful)
Not if they're blacklisting. Only if they're redirecting. And if they were redirecting they'd presumably already have fake site mirrors set up, including these images, so the test would have never worked.
Oops (Score:5, Funny)
Another option for the eye chart (Score:5, Funny)
And if you can see the top row and not the bottom one it means you work at Microsoft.
Irony? Just a bit? (Score:2)
It's got to be irony when, the day after April fools day, the day the virus in question was supposed to "detonate" for lack of a better word, the easiest method of detection is THIS.
Very cool.
Re: (Score:2)
Only the newsies supposed that it was going to "detonate".
Interesting idea, but ... (Score:1, Insightful)
What happens when those six sites see that they are getting leeched, and pull those images? Chaos ensues as man + dog believes themselves to be infected.
Ingenious! (Score:2)
While technologically simple (or because of it), this is a truely amazing idea! One of these once-in-a-lifetime ideas, in fact.
Re:Very nice & interesting technique (Score:5, Funny)
Sucks when / is blocked, now, isn't it? :)
Re: (Score:2)
I didn't mean when /. is blocked, I meant when / is blocked [blogspot.com].
Re: (Score:2)
If / is blocked by StopBadware, all sites with a / anywhere in the URL get blocked.
Now realize that all sites HAVE a / anywhere in the URL.
And that that actually happened once, at least on Google's copy of the StopBadware database. ;)
Re: (Score:1)
(or, conversely, "hardcode" IP-to-URL equations for sites I like to speed up access to they, &
You may want to rethink that part. For one, unless you have pathetic DNS servers, I doubt you'd ever notice doing the lookups. And if just once, that IP happens to be down, or has moved, the time it would take you to figure out the problem, you'd have lost all the time you "saved".
math pedantic (Score:2)
30 ms is 30 times faster than 0 ms?
wow.
Re: (Score:2)
literally, 30x as fast!
:::PEDANT ALERT:::
Actually, 1ms would be 30x as fast as 30ms, or 29x faster.
Oms can't be represented as 'so many times as fast as" any number, but since 0ms is actually anything less than 0.5ms (assuming that you only have the one sig-fig) then we CAN say that 0ms is at least 60x as fast as 30ms, or at least 59x faster.
Re: (Score:1)
Ummm, yeah. First off, pinging the site tells you nothing except round trip time. Try something like 'time dig +short slashdot.org' Mine takes about 6 milliseconds of real time. Sure, the DNS server likely has it cached (which would be true of the OpenDNS servers).
I don't know about you, but I wouldn't notice a reduction of 6 milliseconds. Even 30 milliseconds I wouldn't notice. Depending on your setup, your local machine probably caches the results as well, so you're likely only doing that lookup
Re:Jon Stewart (Score:4, Informative)
Try the em tag.
Re: (Score:3, Insightful)
Re: (Score:2)
Disco.
If I could transfer my mod points to you I would.
Re: (Score:2)
Re: (Score:2)
Yeah, you're right. But compiling a linux kernel is easier than some of the things that I see her attempting to do with Windows. ;-)