New Conficker variant in the wild

ThraxThrax 🐌Austin, TX Icrontian
edited March 2009 in Science & Tech
New Conficker variant in the wild

Comments

  • ThraxThrax 🐌 Austin, TX Icrontian
    edited March 2009
    Nuked the old ticker to make way for this post.

    Snark asked how we know it's arriving on April 1. I responded that it's already in the wild, but the code reveals an activation date of 4/1.
  • KwitkoKwitko Sheriff of Banning (Retired) By the thing near the stuff Icrontian
    edited March 2009
    We're already patched here, our AV is fully up to date, our internet access runs through a proxy server, my ISP is blocking access to those sites, but I figured it was still a good idea to run the BitDefender cleaning tool.

    If this is the future of virii and worms, I'm shit scaredless.
  • MiracleManSMiracleManS Chambersburg, PA Icrontian
    edited March 2009
    I'll be honest, as a case study this is an AMAZING example of a virus. The way it changes and continue to modify in such a way as to make it impossible to defend against is very neat. It just brings to the forefront what most of us have known for years. It's a competition and the good guys are losing.
  • deepseadeepsea Lancaster, PA
    edited March 2009
    I'd disagree on the good guys losing. As Kwitko pointed out, the patches are out, ISPs have (ok, maybe can would be better) the IPs to block, and the virus is already decoded to 4/1 activation. It's no longer "how can we stop it", it's OK, which users haven't updated their systems. How hard would it be to identify infected PCs on 4/1 and let the ISP for the users address the problem with them directly, be it locking down their access, giving access to a limited range of sites (security related and help sites?) or sending a "YOU'RE INFECTED" email.
  • ThraxThrax 🐌 Austin, TX Icrontian
    edited March 2009
    The patches are out... Not Conficker.C! Those ISP block lists? They only work on A and B!

    Lastly, your suggestion to let ISPs snoop on people's PCs (that's what it would take) for the presence of a virus is intensely scary.
  • MiracleManSMiracleManS Chambersburg, PA Icrontian
    edited March 2009
    What Rob just mentioned is my concern. It's an ongoing fight and we're losing. Keeping users up to date (not just talking about corporate clients, but general users as well) is all but impossible. It just feels like a footrace where our lane is a frictionless surface.
  • deepseadeepsea Lancaster, PA
    edited March 2009
    You wouldn't have to snoop PCs. Just look for users that are pinging the suspect domains on 4/1.
  • BuddyJBuddyJ Dept. of Propaganda OKC Icrontian
    edited March 2009
    CNN has a story on it today:
    http://www.cnn.com/2009/TECH/03/24/conficker.computer.worm/index.html

    Looks like Conficker.C is srs bsns.
  • LincLinc Owner Detroit Icrontian
    edited March 2009
    Yeah, a coworker printed out an article on it to ask me about it. Looks like its gone mainstream.
  • SnarkasmSnarkasm Madison, WI Icrontian
    edited March 2009
    This is one of those things I utterly hate to say, but the coder in me really admires Conficker.C's build and abilities. It's really a pretty scary bug - the code analysis is an eye-opening read, for those that don't know of just what it's capable.
  • Josh Taylor
    edited March 2009
    My advice: Buy a Mac or Linux (they are immune to windows malware). The PC is pretty much dead.

    The authors of Conficker are very proud of themselves. In fact, they maybe Chinese or Russian.
  • ThraxThrax 🐌 Austin, TX Icrontian
    edited March 2009
    PC dead? Er, no.
  • SnarkasmSnarkasm Madison, WI Icrontian
    edited March 2009
    Er, what? News - Mac and Linux boxen are PCs, home slice.

    Conficker authors should be proud of themselves, it's quite an impressive bit of code. Everybody switching to Mac or Linux will simply make hackers retarget their efforts to those codebases. Nice thought, though.
Sign In or Register to comment.