Monday, December 20, 2010

CONFICKER Worm : What is it anyways?

Conficker, formally named W32/Conficker.worm, also known as Downup, Downadup and Kido. It uses flaws in Windows software and Dictionary attacks on administrator passwords to co-opt machines and link them into a virtual computer that can be commanded remotely by its authors. Conficker has spread rapidly into what is now believed to be the largest computer worm infection since the 2003. Researchers have found 5 variants of conflickers - Conficker.A, Conficker.B, Conficker.C, Conficker.D & Conficker.E.
Depending on the specific variant, the worm may spread via LAN, WAN, web, or removable drives, and by exploiting weak passwords. Conficker disables several important system services and security products, and downloads arbitrary files. Computers infected with the worm become part of a army of compromised computers and could be used to launch attacks on websites, distribute spam, host phishing websites, or carry out other malicious activities.
Description of all variants:
Win32/Conficker.A was reported to Microsoft on November 21, 2008.
Worm:Win32/Conficker.A is a worm that infects other computers across a network by exploiting a vulnerability in the Windows Server service (SVCHOST.EXE). If the vulnerability is successfully exploited, it could allow remote code execution when file sharing is enabled.
Worm:Win32/Conficker.B & C are worms that infects other computers across a network by exploiting a vulnerability in the Windows Server service (SVCHOST.EXE). If the vulnerability is successfully exploited, it could allow remote code execution when file sharing is enabled. It may also spread via removable drives and weak administrator passwords. It disables several important system services and security products. 
Win32/Conficker.D is a variant of Win32/Conficker. Conficker.D infects the local computer, terminates services, blocks access to numerous security related Web sites and downloads arbitrary code. Conficker.D can relay command instructions to other Conficker.D infected computers via built-in peer-to-peer (P2P) communication. This variant does not spread to removable drives or shared folders across a network (as with previous variants). Conficker.D is installed by previous variants of Win32/Conficker.
Worm:Win32/Conficker.E is a member of the Win32/Conficker family and was proactively detected when first discovered as Worm:Win32/Conficker.gen!A. Conficker.E acts as an update mechansim for previous variants of Win32/Conficker. This variant deletes its own executable on May 3 2009.

No comments:

Post a Comment