DataCentreTimes - Conficker flatters to deceive
Datacentre Times
Home

 

Conficker flatters to deceive

02-04-2009   Bookmark and Share

In March, security vendor Sophos warned that legitimate websites would feel the impact of Conficker. However, few companies admitted any serious problems at all. Then on Monday, a couple of researchers at the Honeypot Project announced that they have been able to fingerprint Conficker and offered a way to see if you were detected.

There are estimates that over 15 million computers worldwide have been infected with conficker and today, was supposed to be web meltdown day. This is because the four variants of Conficker were each supposed to try and contact thousands of websites. Many of those web addresses belonged to legitimate businesses and they risked being knocked offline through denial of service attacks. Other addresses were expected to download new instructions to the worm.

Despite infecting all these computers and with security experts telling us the sky is falling, the impact of Conficker has been muted. You could say that this is because the news media has been heavily focused on the G20 meeting in London but the reality is that it has been a serious anti-climax. According to Sophos, the Conficker build up is more down to security company induced hysteria than anything else.

According to Guy Bunker, Chief Scientist, Symantec "nothing of any excitement happened today regarding Conficker. However, it did change its tactics on just how many domains it can contact, to tens of thousands of addresses per day and it has increased its own protection on the systems it infects.

"Of course, the fact that is hasn’t done anything today doesn’t mean that nothing will happen tomorrow or the day after, or the day after that. The virus will remain on peoples’ systems until it is removed – so, while it isn’t doing anything bad, now would be the time to remove it."

While Conficker may have been a damp squib today, experience with previous malware shows that any complacency is likely to have serious consequences. We don't, for example, know what the endgame is for Conficker. Another unknown is whether this is just a distraction while the writers seed a more dangerous piece of malware.

So while no news is good news it's also an opportunity for companies to continue cleaning up systems.

 

 1 of 1