Spyware Warrior

[Daveski17]

SAN FRANCISCO (AP) -- Looks like you'll have to be on your toes for more than just the occasional innocent prank on April Fools Day.

Computer experts are warning about something called the Conficker worm, a bug that so far has infected at least 3 million PCs. Tech experts say many of the infected machines are set to begin "phoning home" to the worm's creators over the Internet on April 1. When that happens, the people behind it will be able to get the rogue program to send spam, more viruses, clog network traffic or even crash Web sites.

Don't panic just yet, though. Researchers who have been keeping tabs on Conficker say April Fools will probably come and go quietly, as least on the computing front. ~ WUSA 9.com

Anyone got any thoughts, or is this more April tomfoolery?


http://www.wusa9.com/news/watercooler/stor...83658&catid=148




_________________
Cry, 'Havoc!' and let slip the dogs of war.

~ Shakespeare Julius Caesar

[suzi]

No one really knows what might happen yet. There is the potential for the worm to infect thousands of more computers if users are not protected. The more infected computers in the bot net, the more damage can be done -- more spam, possible DDoS attacks and such. But since there's been a lot of publicity, the creators of conficker might not do anything on April 1 -- but they could up their attack at a later date.
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn.

[suzi]

There are two videos here with a really good explanation of how conficker works.

http://www.f-secure.com/weblog/archives/00001642.html
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn.

[Daveski17]

Very interesting.
_________________
Cry, 'Havoc!' and let slip the dogs of war.

~ Shakespeare Julius Caesar

[harrywaldron]

So far the malware writers have not seeded additional updates on the "owned" botnet PCs to further update the Conficker worm. While it's been fairly quiet, further updates could occur this weekend or even a month from now. Certainly the bad guys don't want to start seeding new updates with the widespread coverage and everyone watching

The April 1st routine was mainly to update and not attack (although new malware attacks could originate later from an updated infected client). Below are some good security site resources to periodically check on developments (along with these good forums as well):

http://www.f-secure.com/weblog/
http://isc.sans.org/
http://www.avertlabs.com/research/blog/
http://blog.trendmicro.com/

AVERT is reporting a few UDP based updates via the highly encrypted P2P channel
http://www.avertlabs.com/research/blog/index.php/2009/04/01/confickerc-on-the-wire-2/

[harrywaldron]

F-Secure has a good FAQ providing the latest developments on this Internet worm:

Conficker - Post April 1st FAQ
http://www.f-secure.com/weblog/archives/00001647.html