<span class="inside-head">PC security forces face April 1 showdown with Conficker worm </span><div class="byline" id="byLineTag">By Byron Acohido, USA TODAY</div><div class="inside-copy">SEATTLE In the brief, tumultuous history of cybercrime, there has never been anything quite like the Conficker worm.</div>
<p class="inside-copy">In
the past few months, Conficker's creators have infected at least 3
million Windows PCs worldwide with malicious software, and perhaps as
many as 12 million. At this moment, the bad guys are locked in a
high-stakes showdown with a posse of security groups led by Microsoft.</p><p class="inside-copy">Conficker's
controllers have set a date for what amounts to a cyber-shootout at the
OK Corral. Next Wednesday April Fools' Day millions of infected
PCs, called bots, will begin reporting for further instructions,
presumably to begin spreading spam, stealing data or carrying out
online scams. And there appears to be little the good guys can do to
cut off such communications.</p><p class="inside-copy">"We have not yet
begun to feel the real impact of Conficker," says Paul Henry,
researcher at security firm Lumension. "We may soon be at the whim of
those in control of what has emerged as a formidable army of infected
machines."</p><p class="inside-copy"><b>Vintage worm </b></p><p class="inside-copy">Conficker
requires no action on the part of the PC user to spread. It's a
throwback to self-replicating worms that scanned the Internet for PCs
displaying known and unpatched Windows security holes.</p><p class="inside-copy">Such worms largely disappeared after 2004, as Microsoft <a href="http://stocks.usatoday.com/custom/usatoday-com/html-quote.asp?symb=msft" target="_blank">(MSFT)</a>
improved its process for identifying new holes and quickly issuing
patches. But last September, Chinese hackers began selling a $37.80
program for tapping into a newly discovered Windows hole on some 800
million machines worldwide, according to SRI International, a
non-profit research firm.</p><p class="inside-copy">Microsoft took
notice, and on Oct. 23, issued a rare emergency patch. Most home PC
users in North America got patched quickly, via Windows Auto update.
But many corporate and government users were lackadaisical about
patching. In China and other nations where pirated copies of Windows
are widely used, patches simply weren't available. "Once the patch was
out, no one paid attention," says Don Jackson, senior researcher at
SecureWorks. "They underestimated the risk."</p><p class="inside-copy">Precursors
of Conficker began spreading on a limited basis, mostly in Asia. In
early January, a full-featured version began seeking out unpatched PCs
across the globe. The worm slithered onto any shared hard drives; it
searched out nearby servers and issued hundreds of combinations of user
IDs and passwords to break in; it copied itself onto any device plugged
into a USB port, such as thumb drives, music players or digital
cameras. When that infected device later got inserted into another work
station, that machine became infected.</p><p class="inside-copy">Conficker
also took extraordinary measures to prevent each new bot from being
disinfected by Microsoft or antivirus programs, or usurped by a rival
botnet group. SRI found, for instance, that Conficker's encryption
algorithm came from MIT's Ron Rivest, copied from a recently published
research paper.</p><p class="inside-copy">On Feb. 12, Microsoft put up
a $250,000 bounty for information leading to the capture of Conficker's
creators. The software giant also formed an alliance of security
groups, dubbed the Conficker Cabal, to battle the worm.</p><p class="inside-copy">The
Cabal focused on disrupting what was perhaps Conficker's most unnerving
feature. Eight times a day, each bot tried to connect with a list of
250 randomly generated Web addresses each a potential rendezvous
point to receive further instructions. Each day, this list of 250
rendezvous points changed.</p><p class="inside-copy">To cut this off,
the Cabal identified the Web addresses scheduled to turn up on the
daily lists, and began registering any that weren't already registered
by someone else. The goal: to "pre-empt registration of those domains
for potential criminal use," says Christopher Budd, of Microsoft's
security response team.</p><p class="inside-copy"><b>Upgrade slips through </b></p><p class="inside-copy">Yet,
on March 6 and on March 17, the bad guys somehow slipped a malicious
software upgrade to millions of infected PCs. The upgrade began
organizing the bots into a vast peer-to-peer, or P2P, network, says SRI
program manager Phillip Porras. P2P networks are powerful and flexible,
because each PC can function as a command server. They're commonly used
to share videos and music and play complex online games.</p><p class="inside-copy">The
upgrade also included instructions for each bot to begin a daily
routine on April 1 of checking in at 500 rendezvous points, randomly
selected from a pool of 50,000 domain names. This trick will make it
more difficult for the Cabal to preregister addresses, says Porras.</p><p class="inside-copy">Joe
Stewart, a senior researcher at SecureWorks, notes that the infected
PCs are already capable of receiving directives from the controllers
via the P2P network, "so the 50,000 domains aren't really needed. They
could even be a practical joke on the part of the authors."</p><p class="inside-copy">Botnets
have emerged as the cybercrime world's tool of choice to carry out
scams. Josu Franco, Panda Security's director of business development,
surmises that Conficker's controllers may be moving methodically to
corner the market on botnets for hire. "This is free inventory for
them," says Franco.</p><p class="inside-copy">The good guys' defense
boils down to vigilance. While the Cabal may not be able to stop the
controllers from issuing directives, it remains poised to disrupt any
criminal activity attempted by Conficker bots.</p><p class="inside-copy">"There
may be a second phase of the threat at some point in time,"
acknowledges Microsoft's Budd. "However, we believe, given the
tremendous amount of attention this worm has received, industry and law
enforcement efforts will be a deterrent to a large second wave of
attacks."</p>
<div>
<table width="100%" border="0" cellpadding="0" cellspacing="0">
<tbody><tr>
<td> </td>
</tr>
<tr>
<td bgcolor="#cccccc"><img src="http://images.clickability.com/pti/spacer.gif" width="2" height="2"></td>
</tr>
<tr>
<td> </td>
</tr>
<tr>
<td>
<br></td>
</tr>
</tbody></table>
</div>
<table width="100%" border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="font-cn"> </td>
</tr>
<tr>
<td class="font-cn">
<span class="fonttitle">Find this article at:</span>
<br>
<a href="http://www.usatoday.com/tech/news/computersecurity/wormsviruses/2009-03-24-conficker-computer-worm_N.htm">http://www.usatoday.com/tech/news/computersecurity/wormsviruses/2009-03-24-conficker-computer-worm_N.htm</a>
</td></tr></tbody></table><br><br><div class="gmail_quote">2009/3/25 media tic <span dir="ltr"><<a href="mailto:media.tic01@gmail.com">media.tic01@gmail.com</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Merci<br>
<br>
2009/3/25 Anne-Rachel Innι <<a href="mailto:annerachel@gmail.com">annerachel@gmail.com</a>>:<br>
> For your information<br>
> ar<br>
><br>
> _______________________________________________<br>
> AfrICANN mailing list<br>
> <a href="mailto:AfrICANN@afrinic.net">AfrICANN@afrinic.net</a><br>
> <a href="https://lists.afrinic.net/mailman/listinfo.cgi/africann" target="_blank">https://lists.afrinic.net/mailman/listinfo.cgi/africann</a><br>
><br>
><br>
_______________________________________________<br>
AfrICANN mailing list<br>
<a href="mailto:AfrICANN@afrinic.net">AfrICANN@afrinic.net</a><br>
<a href="https://lists.afrinic.net/mailman/listinfo.cgi/africann" target="_blank">https://lists.afrinic.net/mailman/listinfo.cgi/africann</a><br>
</blockquote></div><br><br clear="all"><br>-- <br>Anne-Rachel Inne<br>