Experts watch for Conficker superworm to be activated

Samuel Johnson said that “Nothing concentrates one’s mind so much as the realization that one is going to be hanged in the morning.” We can say that the minds of IT security experts is very concentrated now, as they brace themselves to respond to the activation of the huge botnet created by the Conficker superworm. The malware has created a network of infected PCs, estimated to be at least 9 million strong, under its control — thus dwarfing the zombie army created by the infamous Storm worm, which reached a mere one million at its peak in September 2007.

Register’s John Leyden reports that variants of Conficker (aka Downadup), which began circulating in late November, exploit the MS08-067 vulnerability in the Microsoft Windows server service (addressed by Microsoft with an out-of-sequence patch last October). The malware also infects removable devices and network shares using a special autorun file. The worm uses social engineering trickery so that users on Windows machines looking simply to browse the contents of a memory stick may be tricked into selecting an option that actually runs a malware payload and infects their PC.

Leyden adds that some variants are programmed to spread across machines in the same local area network. Weak passwords in corporates have therefore aided the distribution of the worm. The multiple infections techniques — note that none of them features e-mail — has caused the worm to proliferate aggressively. Experts say it has been years since any worm has spread so widely. Our readers would be correct to feel that the Conficker worm epidemic appears like a return to the bad old days of worms such as Nimda, Blaster, and Sasser.

Security watchers say that one reason for the success of Conficker is that the worm only needs to hit one infected machine in a network to spread. Slow patching, particularly in large organizations and corporations, has also contributed to the epidemic. “We haven’t seen this type of advanced worm in many years,” Eric Schultze, CTO of patching firm Shavlik Technologies told Leyden. “It’s successful because once a single machine is infected in a corporate environment, it can spread itself to all of the other corporate machines, whether they’ve been patched or not. In terms of damage it can do, some reports say the worm is a dud but I believe that it’s simply ‘sleeping’ and may be woken up at a future date to execute some set of evil instructions. Even if never executed, the worm turns off the windows update service and blocks access to many security vendor websites [blocking uptake of new antivirus signatures]. To many, these actions alone may be considered malicious.”

Why have we not seen a worm of this type for three or four years? Experts say it may be that writing such a worm is simply too much like hard work. “It’s more effort to write malware that exploits a new vulnerability than, say, regular executable malware that is e-mailed or shoved on web,” said Graham Cluley, senior technology consultant at anti-virus firm Sophos. “If e-mail or web attacks work just fine, then why go to extra effort? These guys aren’t doing it for intellectual challenge or showing-off. Money is the motive.”

Cluley added that “Hackers never completely abandon old tricks…. They can always dust them off and use them again. For example, there was a huge increase is infected email attachments last year year. It’s a danger to think we have any particular attack strategy licked.”

Cluley, like other security researchers, credited Microsoft for releasing a clean-up tool in January after publishing a patch in October, while noting the software giant bears significant responsibility for creating the security vulnerability that allowed the worm to spread in the first place.