Downadup heading for April Fool's mayhem
Published: 16 Mar 2009 09:06 GMT
The authors of the latest variant of the Downadup worm are upping the ante against security vendors who are working to stop the spread and threat of the persistent program.
Downadup shuts down security services, blocks computers from connecting to security websites, and downloads a Trojan. It also is programmed to begin connecting to 50,000 different domains on 1 April to receive updated copies or other malware, as opposed to connecting to 250 domains a day as previous versions are doing, Ben Greenbaum, senior research manager for Symantec Security Response, said on Friday.
The authors of the code are "strengthening their hold on their collection of infected machines at the same time they are attempting to strengthen their ability to control those machines by moving to 50,000 domains," he said.
A self-described "cabal" of companies, including Microsoft, Symantec and a host of domain-registration providers, have been trying to thwart the efforts of Downadup by pre-registering and locking up the domain names being used by the worm to distribute updates.
Now that Downadup is targeting 50,000 domains, the group has its work cut out for it, Greenbaum said. Regardless, "it's unknown at this point whether [boosting the domains] is an effective sidestep around the cabal's actions," he said.
The worm, also called Kido or Conficker, was first detected in November and is believed to have infected more than 10,000 computers. The first two versions exploit a vulnerability that Microsoft patched in October.
A second variant, Conficker.B, was detected last month. It added the ability to spread through network shares and via removable storage devices, such as USB drives, through the AutoRun function in Windows.
Among the domains targeted by Downadup was that of Southwest Airlines, which was expected to see an increase in traffic from the botnet on Friday, Sophos said last week. However, a Southwest spokesman said there had been no impact to the site from any additional traffic as a result of Downadup.
Experts are urging computer users to apply the Microsoft patch and update their antivirus software. And this week, Enigma Software Group and BitDefender announced free Downadup-removal tools.
Conficker has proved to be such a nuisance that Microsoft has even offered a $250,000 (£180,000) reward for information leading to an arrest in the Downadup case.
Symantec has more technical and historical details on Downadup on its website.
Credit: Latest Conficker worm gets nastier from CNET News
Did you find this article useful?
15 out of 15 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
Full Talkback thread
3 comments
