Conficker Awakens, Starts Scamming

The Conficker worm is back in action and stumping security experts once again. One of the most craftily designed pieces of malware recently got an update and is finally starting to behave like other worms. Here's what's going on:

New Marching Orders

On Wednesday, April 8 security firms started seeing some variants of Conficker C, the latest Conficker flavor, receive updates through its encrypted peer-to-peer (P2P) file-sharing functionality. Security Firm Trend Micro reports that the new Conficker instructions came from a server in Korea and the new file was created on April 7, 2009 at 07:41:21. The new update strengthened Conficker's defenses and the new Conficker functions will shut down on May 3, 2009.

Until May 3, the refreshed Conficker will search the Internet for uninfected Windows machines that have not applied the Microsoft MS08-67 security patch. This search-and-infect functionality was turned off in previous Conficker varieties, presumably to control the size of a future botnet. However, it seems Conficker's authors have rethought that strategy and are looking to grow their creation once more. Some Conficker variants are also programmed to infect an unpatched computer, and then once Conficker is in the machine the worm patches up the weakness to keep out other types of malware that capitalize on the same vulnerability.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine