The Conficker Cabal Announced
by Jose NazarioToday Microsoft announced a broad industry alliance to combat Conficker, the savage Windows worm taking advantage of MS08-67. The Conficker group isn’t going to be formed, it’s been happening for a while now. This is just the public announcement (and also of a quarter million dollar bounty for whoever is behind it). Conficker has affected millions of PCs and spreads by the MS08-067 vuln over TCP/445, but also over USB keys and file shares. That’s what’s causing it to spread like wild fire in the enterprise. We are a part of this effort, together with groups like ICANN and many others.
One of the strategies being used by the group that has come together is to “soak up” the domain names being used by Conficker with pre-registration and lock. Here’s an example record for one of today’s domains:
Domain ID:D155329089-LROR
Domain Name:PWULRROG.ORG
Created On:10-Feb-2009 23:47:07 UTC
Last Updated On:11-Feb-2009 00:18:18 UTC
Expiration Date:10-Feb-2010 23:47:07 UTC
Sponsoring Registrar:PIR Special Projects (R1776-LROR)
Status:TRANSFER PROHIBITED
Status:ADDPERIOD
Registrant ID:Special-001
Registrant Name:Conficker Cabal
Registrant Organization:Microsoft
Registrant Street1:One Microsoft Way
Registrant Street2:
Registrant Street3:
Registrant City:Redmond
Registrant State/Province:WA
Registrant Postal Code:98052
Registrant Country:US
Registrant Phone:+1.2023243000
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:cflicker@live.com
The worm seeks to update itself by using a long list of psuedo-randomly generated domain names to contact over HTTP and then grab new code. The algorithm for this domain name generation scheme has been cracked (by F-Secure and others) and has been used to pre-compute the names for pre-registration to prevent hostile parties from using this update feature. This has been facilitated – greatly facilitated – by ICANN, TLD operators, and various registrars working together with Microsoft and others to identify the names and grab the ones they need to. These records can then be pointed at sinkholes to discover Conficker-infected hosts checking in.
That sinkhole data is being shared within the “cabal” and shared with customers: ISPs and their customers, enterprises, CERT teams, and others. This, in turn, is being used to try and clean up hosts with tools and information sheets with clear instructions. This is truly a global operation. Here’s yesterday’s sinkhole stats by top countries:
Just because the bot’s update mechanism appears to be cut off doesn’t mean that it’s no longer a problem. As noted above, the worm tries to propagate over file shares by brute forcing usernames and passwords. As it does so, it often locks people out of their accounts after X password login failures. IT admins everywhere are pretty busy with this.
This whole effort came together because Microsoft and others have been working with the research and security communities for a while now and lots of trust and relationships have been built. This facilitated such a large, cross-group collaboration to come together.
A few select links abount Conficker:
- An Analysis of Conficker by the MTC group at SRI. Very well done.
- Downadup: Small Improvements Yield Big Returns, from Symantec.
- Conficker/Downadup: Memory Injection Model from the ThreatExpert blog
- Centralized Information About The Conficker Worm from Microsoft.
[...] It also spreads via removable storage devices like USB drives, and network shares by guessing passwords and usernames, which is “causing it to spread like wild fire in the enterprise,” Jose Nazario, manager of security research for Arbor Networks, wrote on a company blog. [...]