Busted! Conficker's tell-tale heart uncovered

The Register ^ | 30 March 2009 | Dan Goodin

[ShadowAce]

Security experts have made a breakthrough in their five-month battle against the Conficker worm, with the discovery that the malware leaves a fingerprint on infected machines that is easy to detect using a variety of off-the-shelf network scanners.

The finding means that, for the first time, administrators around the world have easy-to-use tools to positively identify machines on their networks that are contaminated by the worm. As of mid-Monday, signatures will be available for at least half a dozen network scanning programs, including the open-source Nmap, McAfee's Foundstone Enterprise and Nessus, made by Tenable Network Security.

Up to now there were only two ways to detect Conficker, and neither was easy. One was to monitor outbound connections for each computer on a network, an effort that had already proved difficult for organizations with machines that count into the hundreds of thousands or millions. With the advent of the Conficker C variant, traffic monitoring became a fruitless endeavour because the malware has been programmed to remain dormant until April 1.

The only other method for identifying Conficker-infected computers was to individually scan each one, another measure that placed onerous requirements on admins.

The discovery of Conficker's tell-tale heart two days before activation may prove to be an ace up the sleeve of the the white hat security world.

"This is an extraordinarily inexpensive, not-very-time-intensive way of finding machines on your network that are actually running malicious software," said Dan Kaminsky, one of the three researchers who discovered the Conficker fingerprint. "This is not something we get to do all the time. Most pieces of malicious software are not that easy to find."

The availability of the new Conficker definitions is the result of the sleuthing and quick response of an industry-wide cast of characters, said Kaminsky, who is director of penetration testing at security company IOActive.

The finding came Friday afternoon as Kaminsky pored over data that members of the Honeynet Project had collected on the worm. Along with Honeynet's Tillmann Werner and Felix Leder, Kaminsky soon noticed that Conficker changes the way a small piece of the Windows operating system acts. The behavior, located in pre-authentication routines before users enter file-sharing passwords, makes easy-to-identify changes to the way machines look on a network.

"Once I heard that Conficker had code running on the anonymous surface, I said 'Wait, we can fingerprint that,'" Kaminsky said. "If you can get packets to a box, you can find out fairly reliably whether it's infected with Conficker."

Kaminsky said he then turned to help from Securosis researcher Rich Mogull, who on Saturday began mobilizing providers of network scanning products to add the Conficker definitions as soon as possible.

"This is the fastest turn-around I've ever seen," Kaminsky said.

Products from Qualys and ncircle are also expected to add anti-Conficker detection signatures. Werner and Leder have developed their own proof-of-concept scanner, which is available here.

Since showing up a few days after Microsoft released an emergency patch for Windows in late October, Conficker has elicited a grudging admiration from security professionals, who can't help acknowledging the worm's sophistication. It attacked multiple vectors, was able to crack passwords and spread like wildfire, infecting more than ten million boxes in just a few months' time, by some estimates.

Conficker's profile has only grown larger in the past few weeks as the calendar slowly approaches April 1. That's the day that machines infected with Conficker C will be able to tap into a much larger pool of internet addresses to receive instructions - 50,000 instead of the previous 250.

But it would appear the evil geniuses who spawned the malware made a fatal error that until now had gone unnoticed. Its discovery just a few days before an important deadline could lead to its eradication - but only if network admins worldwide put down what they're doing and make use of the tools now.

"We have no idea what Conficker is going to do on April 1," Kaminsky said. "Certainly there is no reason anyone wants to find out on their network. My recommendation is that people run one of the vulnerability scanners on Monday or Tuesday." ®

[ShadowAce]

[sionnsar]

ping!

[ReleaseTheHounds]

Dear Tech Freepers,

Please advise: should we less-than-tech-savvy Freepers just follow one or more of the links mentioned in this article and do a scan? I have McAfee Security Center — will running an extra scan or two on that be sufficient?

Thanks for your recommendations.

[antiRepublicrat]

Now nobody has any business being infected. Download the free nmap, configure according to instructions, and run against your network.

[mysterio]

Malwarebytes.org. Best malware remover I’ve ever worked with.

[antiRepublicrat]

Go to this security site.

The first option requires that you first download and install the Python language interpreter, then download, unzip and run the scanner.exe program according to the instructions at the top. Scan another machine by putting in the IP address, or scan your own using 127.0.0.1.

The best answer, especially if you're scanning more than one machine, is to use the nmap instructions at the first link I gave. Download and install nmap and run according to instructions.

These are white-hat hacker sites, better known as "computer security experts," so you can generally trust what's posted there. Their reputations and careers would be gone if they pushed malicious code themselves.

[fanfan]

I have AVG 8.5

Is that enough?

[green pastures]

I don’t have a network to deal with, just my sister’s laptop dell. It has Norton 360, which I updated yesterday. I also ran malwarebytes a few weeks ago and it came up clean.

I became the default IT person for my sister— even though I don’t know much about PCs, I know more than she does about them...

:-(

[Rammer]

ping

[ShadowAce]

You may want to go ahead and try to update it again today. The article says the fix was coming out today—so yesterday may have been a little early.

[nathanbedford]

cornping

[ReleaseTheHounds]

OK, antiRepublicrat... you probably thought you had a reasonably tech-savvy Freeper with me, but obviously you were wrong.

I went to that site you linked to (DoxPara Research). I then used your link to download and install the Python Language. I then downloaded and unzipped the scanner.exe program you linked to (this gave me something called “the pydoc”?). When I clicked “open browser” under this window, I get a page called “Python: Index of Modules”...

Am I getting close to where I can run the scanner? It’s not clear to me how to go from these downloads to running the scan.

Thanks in advance for the help.

[Syntyr]

ReleaseTheHounds,

1. Download and install the second link from antiRepublicrats message. This is the Python Language. The file is python-2.6.1.msi. Just accept the defaults and everything should be good.

2. Download the file in the thrid link in his message. The scs.zip file. Extract the contents of scs.zip to a folder on your PC. Most likley c:\scs.

3. Run a command prompt - i.e. click START then RUN enter CMD and press OK

4. Change to the folder with the scs scanner in it - i.e. CD\SCS and press enter

5. Scan your PC - SCANNER 127.0.0.1 and press enter. 127.0.0.1 is what is called the loopback IP address. Its the default ip address of you PC. It menas scan the PC you ar erunning the command from.

you can scan multiple PC’s by entering their IP address with the command SCANNER “ip address”

HTH

[antiRepublicrat]

The zip file should have 13 files in it, including scanner.exe.

Sorry, I pointed you there before I tried it myself. You didn't need to install the Python language since the zip comes with the Python run-time (I don't have Python installed in my Windows virtual machine, and it ran).

Here are the easy instructions after you've downloaded the file (don't type the quotes):

1. Click Start, click Run
2. Type "cmd" and hit Enter
3. In the DOS box, type "c:" and hit Enter
4. Type "md \scanner" and hit Enter
5. Unzip the contents of the zip into c:\scanner
6. Back in the DOS box, type "cd\scanner" and hit Enter
7. Type "scanner.exe 127.0.0.1" and hit Enter
8. When done, type "exit" and hit Enter

You can replace "127.0.0.1" with any IP address in your network, or any IP address outside of your network, but people may not be happy with you.

[TChris]

I have AVG 8.5

Is that enough?

Probably yes.

Make sure the virus definitions are up to date and that you have all the current Microsoft updates installed.

Windows Defender is pretty good spyware protection too. I run it along with AVG.

[fanfan]

Thank you.

[Marie Antoinette]

ping

[Still Thinking]

Thanks, aR. Nerd that I am, I already have Python loaded, so it was the work of about a minute to load and run the scanner.

[TheBattman]

Why does it have to be so convoluted? And yes, I am operating from the slightly biased point of view of a Mac users...