2 min read

Conficker April Surprise

Răzvan STOICA

April 03, 2009

Conficker April Surprise

The virus posesses two main update mechanisms.

The most visible is the HTTP or web mechanism whereby each infected machine checks
500 of the 50000 possible update URLs every day, for a neat 1 in a hundred
chance to get an update. This mechanism is obviously pretty slow, by itself,
but its speed does not depend on the number of machines which are infected. If
one of the links remains up and serving the update for a hundred days, the
whole virus network is updated.

The P2P update system is less visible. Its only requirement is to somehow introduce
on the Internet a new machine (or several hundred) which are already updated
and accessible from anywhere.

One could do so by using an alternate infection mechanism such as malicious e-mail
or a trojanized version of the virus planted on a file sharing network or even,
for spy-movie drama, by leaving a USB drive which contains the virus unattended
on a park bench.

Using this system, an infected machine checks arround 600 IP addresses(of the total
of roughly 3.3 billion usable IP addresses) every hour, in an attempt to find
other infected machines which have more recent code and update itself.

Now, let’s assume a network of 10 million infected computers (a pessimistic estimate),
of which only one runs an updated version of the virus. The probability for an
infected machine to find the single existing updated machine, in the first try,
is 1 in three billion.

It seems vanishingly small, but we have 10 million machines to play with, 600 tries
per hour each (or a total of 6 billion tries), so we can be very sure that the
updated code _will_ be found within the hour.

The simple, scary logic of exponential growth then takes over. Finding one of two
machines is twice as easy, one of four even easier and the ball keeps rolling
until, using this system, the entire network could be updated in just 16 hours
or thereabouts. A smaller network will take longer, but not much longer.

Combine the two systems (I’ll spare you, again, the gory mathematical details) and you
get an approximate time of 9 hours for a full 10 million-strong network update.

But is the speedup of using the HTTP mechanism worth it, from a virus writer’s
point of view? Considering that every security researcher and company worth
their salt is monitoring the 50000 URLs, no, not really.

It’s vastly more probable that the author or authors are keeping the http option in
reserve and relying on P2P for regular updates.

Conficker is here to stay, in other words. Our only valid options, as always, are to
immunize everyone against new versions and to slowly clean up the
already-infected hosts.

 

tags


Author



Right now

Top posts

Watch Out for These Ongoing Bank of America Phishing Campaigns Targeting Customers in the US

Watch Out for These Ongoing Bank of America Phishing Campaigns Targeting Customers in the US

July 16, 2021

3 min read
How to protect yourself against cyberstalking

How to protect yourself against cyberstalking

July 06, 2021

2 min read
The Top Five Security Risks Smartphone Users Face Today

The Top Five Security Risks Smartphone Users Face Today

July 02, 2021

4 min read
Phishing Alert: Scammers Use Fake SharePoint and DocuSign Messages to Steal Users’ Login Credentials

Phishing Alert: Scammers Use Fake SharePoint and DocuSign Messages to Steal Users’ Login Credentials

July 02, 2021

3 min read
Your Doxxing Dossier Will Keep Growing Thicker Until You See the Danger

Your Doxxing Dossier Will Keep Growing Thicker Until You See the Danger

June 30, 2021

2 min read
Mobile security threats: reality or myth?

Mobile security threats: reality or myth?

June 13, 2021

3 min read

FOLLOW US ON

SOCIAL MEDIA


You might also like

How to keep your Android device immune to malicious vaccine themed apps How to keep your Android device immune to malicious vaccine themed apps
Cristina POPOV

April 22, 2021

2 min read
Facebook Takes Down Two Hacking Groups Operating out of Palestine Facebook Takes Down Two Hacking Groups Operating out of Palestine
Silviu STAHIE

April 22, 2021

2 min read
Ransomware attack causes supermarket cheese shortage in the Netherlands Ransomware attack causes supermarket cheese shortage in the Netherlands
Graham CLULEY

April 13, 2021

2 min read