April 10, 2009, 1:04 PM — The Conficker worm is back in action and stumping security experts once again. One of the most craftily designed pieces of malware recently got an update and is finally starting to behave like other worms. Here's what's going on:
New Marching Orders
On Wednesday, April 8 security firms started seeing some variants of Conficker C, the latest Conficker flavor, receive updates through its encrypted peer-to-peer (P2P) file-sharing functionality. Security Firm Trend Micro reports that the new Conficker instructions came from a server in Korea and the new file was created on April 7, 2009 at 07:41:21. The new update strengthened Conficker's defenses and the new Conficker functions will shut down on May 3, 2009.
Until May 3, the refreshed Conficker will search the Internet for uninfected Windows machines that have not applied the Microsoft MS08-67 security patch. This search-and-infect functionality was turned off in previous Conficker varieties, presumably to control the size of a future botnet. However, it seems Conficker's authors have rethought that strategy and are looking to grow their creation once more. Some Conficker variants are also programmed to infect an unpatched computer, and then once Conficker is in the machine the worm patches up the weakness to keep out other types of malware that capitalize on the same vulnerability.
Once Conficker infects a new machine or gets its refresh, it tries to connect to MySpace.com, MSN.com, Ebay.com, CNN.com, and AOL.com to verify the computer is connected to the Internet.
Conficker's first scam revealed
The new Conficker has also started to exhibit signs of traditional malware. Using one of the oldest tricks in the book, called scareware, the new Conficker C downloads a fake antivirus program called Spyware Protect 2009 (pictured). F-Secure says it's called Spyware Guard 2008. The fake program then delivers a pop-up message telling you that your computer is infected, but for only $49.95 the fake antivirus program can remove the malware. You are then directed to a bogus website where you unwittingly enter all your credit card information and then the criminals are laughing all the way to the bank -- your bank, that is. The scareware scam seems to be coming from a server in the Ukraine, according to the Washington Post.
Conficker: Spambot in disguise?
Conficker, being a tricky little piece of programming, seems to be connected in some way to the Waledac worm -- and Waledac itself is considered to be an update of the Storm Worm. There is no consensus about what Conficker is actually doing, but according to the security firm F-Secure, Conficker is going to a domain known to be associated with Waledac and actually downloading the Waledac worm. Trend Micro, meanwhile, says Conficker is downloading some code from the Waledac domain, but the security firm wants to do further studies before confirming a Conficker-Waledac connection. However, Trend Micro suggests that Conficker may be getting ready to work as a large-scale spamming botnet, a known function of the Waledac worm.
Conficker: More than meets the eye
Apparently the new Conficker has more tricks up its sleeve that researchers have yet to uncover. While security teams try to uncover all of Conficker's latest tricks and tweaks, they do know that Conficker is awake and the worm's authors are beginning to use Conficker-infected machines to make money. Just how far this will go is unknown at the moment.
Where do we go from here?
As security researchers begin to unravel the mysteries surrounding the latest version of Conficker, you can protect yourself from the worm by first testing your system for infection and then by making sure you have the latest Microsoft Security patches and that your antivirus program is up to date. The Conficker Working Group has a simple test to see if you're infected with Conficker.
