Interest in the Conficker (or Downadup) is reaching a frenzied peak. As media interest in this worm continues to rise, customers are asking if Symantec is ready for Conficker. The answer is a resounding yes. Symantec customers are already protected (as long as they are running the latest AV and IPS definitions). This article provides a short overview of Conficker (Downadup) and the protection offered by Symantec products.
Background
Conficker first appeared in late 2008 as the first worm in the wild to leverage a newly reported vulnerability in Microsoft Windows’ Remote Procedure Call (RPC) service (MS08-067). Symantec named the worm Downadup, but over time the popular name for this threat has become Conficker. Symantec customers were quickly protected from the vulnerability with newly released IPS and AV signatures.
In late November, a new variant (.B) was detected which added a Swiss Army-like collection of new tricks in the hope of spreading the threat far and wide and infection rates began to pick up and grow again in non-Symantec customers. Symantec Security Response has been monitoring the evolution and growth of the threat using its extensive honey pot network. As of our most recent statistics, there are roughly 1.75 million Downadup infections worldwide.
Most recently (in early March) Symantec was the first company to detect a significant new variant of the threat (.C) which was silently downloaded to infected machines. The (.C) update increased the robustness of existing infections and made them harder to detect and remove. The new version of the threat includes new logic to protect itself further from detection by security software however this should not affect Symantec software because we already block the threat before it ever has a chance to run.
The following table summarizes the different flavors of Downadup/ Conficker:
|
|
W32.Downadup
|
W32.Downadup.B
|
Downadup.C
|
|
Propagation Method
|
• MS08-067 Exploitation
|
• MS08-067 Exploitation
• File Share brute forcing
• Removable Media Infection
|
• Removed
|
|
Command & Control
|
• HTTP
|
• HTTP
• Primitive P2P
|
• Improved HTTP
• Robust P2P
|
|
Defense Techniques
|
• None
|
• Kills some DNS lookups
• Kills AutoUpdate
• HTTP Code Signing
• P2P Code Signing
|
• Kills some DNS lookups
• Kills AutoUpdate
• Kills Security Software
• Advanced Anti-Analysis
• P2P & HTTP Code Signing
|
What does Conficker do?
No one yet knows the full purpose of Conficker. To date, infected machines appear to be dormant members of a new bot network largely awaiting further instructions.
Am I protected?
Symantec AntiVirus products protect customers from this threat using the following definitions:
Symantec Intrusion Protection System (IPS) protects customers from this threat using the following signatures:
Should anyone get infected (e.g. if they are not running Symantec products) Symantec has published a fix tool which can be used to remove the malware from infected machines. That tool can be found
here.
So what happens next and why is everyone talking about April 1st?
Security Technology and Response engineers have discovered that the next phase in the Conficker story is expected on April 1st.
The latest version (.C) of threat has a more complex mechanism for attempting to update itself over the Internet. With previous versions of the Downadup, each infected computer would attempt to contact 250 new websites every day for possible further “attack instructions”. Machines infected with the new version will check 500 random websites per day out of a total of 50,000 possible sites (each infected computer will check its own distinct set of 500 sites). This new version of the threat will not begin to contact these websites until April 1, 2009. On that date we expect a new set of instructions to likely be sent to infected machines which will no doubt change the behavior yet again as the cat and mouse game continues. As before, we continue to monitor the active infections in our honey pot network. The stakes are high but we believe that our customers are fully protected as long as they have our latest AV and IPS signatures deployed on their systems.
More Information
1) Enterprise customers can find more details
here.
2) Consumer / Norton customers can find more details
here.
3) The Symantec removal tool can be found
here. A link to this has been published in the latest US-CERT advisory
here.
4) Watch CBS correspondent Leslie Stahl talk to Steve Trilling, Symantec VP Security Technology & Response, on 60 Minutes about the impact of the Conficker
here.