[AfrICANN-discuss] Have agencies scrubbed the Conficker worm from their systems?

[Anne-Rachel Inné]

http://gcn.com/Articles/2010/03/19/Conficker-cleanup-031910.aspx?p=1

Have agencies scrubbed the Conficker worm from their systems?

   - By William
Jackson<http://gcn.com/forms/emailtoauthor.aspx?AuthorItem={C4126F0C-6B16-4232-985C-93F86A33A188}&ArticleItem={D16E7BF2-CD6D-4F52-819F-1AFAF3AB45E6}>
   - Mar 19, 2010

A company that has been tracking the scanning activity of the prolific
Conficker worm says that traffic from infected government systems has
dropped off significantly in recent months, which could indicate a
successful effort to remediate infections.

 “We started to notice a decrease over the last two or three months,” said
Rodney Joffe, senior vice president and technologist at Neustar Inc., a
directory services provider that administers the domain name registry for
the .US country code top level domain for the Commerce Department.

 The number of infected government systems dropped from a peak of tens of
thousands. “Now they are down to less than 40 systems in the entire U.S.
federal network,” he said.

 The Homeland Security Department, which runs the U.S. Computer Emergency
Readiness Team, did not immediately respond to requests for comment.

 Joffe, who also is director of the Conficker Working Group, said the
apparently successful eradication of a worm that has proved to be
surprisingly resilient for more than a year is good news, even if the
government has not yet said how it was done.

 “For the first time the government is taking the lead in a technical
security issue, rather than lagging,” he said. “If they can do it, there is
no excuse for other enterprises not to. It is obviously possible to
remediate.”

 Joffe said the working group hopes to have details of the government effort
available for a “lessons learned” paper the group plans to publish in the
coming months.

 The worm, also known as W32.Downadup, has infected more than 10 million
computers since its appearance in late 2008, and although the infected
machines do not appear to have engaged in large scale malicious activity,
the worm is troublesome because of its ability to update itself and morph
into new forms. It also can disable security features of infected computers
such as Windows Update and antivirus tools.

 “It is incredibly robust,” Joffe said. “It doesn’t seem to get remediated
successfully and there continue to be outbreaks.”

 He said the worm has a good command of Windows internals and network layer
traffic, and also has developed the unusual ability to download and execute
code without rebooting the infected system, a feat that Joffe likened to
changing the tires on a moving car.

 The original W32.Downadup.A exploited only the MS08-067 vulnerability in
Windows XP Service Pack 2 and Windows 2003 Service Pack 1 operating systems,
for which Microsoft issued an unusual patch outside of its regular monthly
patching cycle. A subsequent .B variant added password guessing and the
ability to copy itself to USB drives to its bag of exploits, and a .C
variant added an additional layer of protection.

 The worm uses an algorithm to generate a pseudo-random list of domains for
its command and control network, which its infected clients check daily for
instructions. Security analysts said the .C variant uses a new algorithm to
determine what domains to contact. It went from generating 500 domains a day
to 50,000 domains with the new algorithm. Because a command and control
server can be a weak spot whose elimination can disable a botnet, this could
make Conficker more difficult to attack.

 A later version, .E, uses peer-to-peer networking for command and control.
“At that point we lost visibility into infected machines,” Joffe said. But
an estimated 6.5 million machines remain infected by earlier versions that
use daily call-ups that can be tracked. It is that traffic that indicates a
federal clean-up, he said.

 “We see the check-in every day,” he said. “It appears they have across the
entire federal government been remediating Conficker. We’re pretty sure the
federal government has done something no one else has.”

 About the Author

**William Jackson is a senior writer for GCN and the author of the
CyberEye<http://gcn.com/articles/list/cybereye.aspx>
 column.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.afrinic.net/pipermail/africann/attachments/20100321/cc7500e1/attachment.htm