The inside story of the Conficker worm [New Scientist]
Remember the Conficker worm that gained notoriety a few months ago when it managed to propagate across millions of Internet-connected computers and computer security experts warned that its creators might use it to initiate a major attack on the Internet's critical infrastructure? The worm and its botnet are still around, just not as famous these days as the hints of an attack have died down. New Scientist has a great article that details how Conficker rose to become such a feared entity within security circles and why the threat it posed is changing the way that researchers and the federal government will react to the next cybersecurity threat.
Though Microsoft released a Windows patch on October 23rd of last year designed to block the malicious activities of a worm like Conficker, many users did not opt to install the patch. Around a month later, on November 20th, Conficker exploded on the Internet, searching out unprotected machines, installing itself and then blocking the computer from becoming infected with other malware. One of the unique aspects of Conficker at that point in time was programming that caused the worm to seek out updates on a list of web servers that changed daily. A month later, the worm's authors released a new version that allowed the worm to be transferred via shared USB drives. Later, versions of the worm emerged that had the ability to update itself from a growing list of international web domains and via P2P connections.
Conficker has yet to attack any of the Internet's infrastructure. Its authors appear to be using the malware to sell a fake antivirus software at this time. According to this article, the collaboration among international computer security experts and government cyber security agencies to combat Conficker has created channels for the exchange of information to combat the next similar threat. And the U.S. Department of Homeland Security is working on a report to analyse what can be learned from the Conficker experience.
Comments