Update: Conficker, the Internet's No. 1 threat, gets an update

Wily worm uses P-to-P for new instructions; other clues link it to Waledec and the Storm worm

Security researchers say a worm that has infected millions of computers worldwide has been reprogrammed to strengthen its defenses while also trying to attack more machines.

Conficker, which takes advantage of a vulnerability in Microsoft's software, has infected at least 3 million PCs and possibly as many as 12 million, making it into a huge botnet and one of the most severe computer security problems in recent years.




[ IBM has suggested that the number of PCs infected with Conficker may be in the tens of millions. | Beware: Fake security software scammers have been jumping on Conficker. | Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

Botnets can be used to send spam and attack other Web sites, but they need to be able to receive new instructions. Conficker can do this two ways: it can either try to visit a Web site and pick up instructions or it can receive a file over its custom-built encrypted p-to-p (peer-to-peer) network.

Over the last day or so, researchers with Websense and Trend Micro said some PCs infected with Conficker received a binary file over p-to-p. Conficker's controllers have been hampered by efforts of the security community to get directions via a Web site, so they are now using the p-to-p function, said Rik Ferguson, senior security advisor for the vendor Trend Micro.

The new binary tells Conficker to start scanning for other computers that haven't patched the Microsoft vulnerability, Ferguson said. A previous update turned that capability off, which hinted that Conficker's controllers maybe thought the botnet had grown too large.

But now, "it certainly indicates they [Conficker's authors] are seeking to control more machines," Ferguson said.

The new update also tells Conficker to contact MySpace.com, MSN.com, Ebay.com, CNN.com, and AOL.com apparently to confirm that the infected machine is connected to the Internet, Ferguson said. It also blocks infected PCs from visiting some Web sites. Previous Conficker versions wouldn't let people browse to the Web sites of security companies.

In another twist, the binary appears to be programmed to stop running on May 3, which will shut off the new functions, he said.

By Jeremy Kirk
source : infoworld