Wily worm uses P-to-P for new instructions; other clues link it to Waledec and the Storm worm
Security researchers say a worm that has infected millions of computers worldwide has been reprogrammed to strengthen its defenses while also trying to attack more machines.
Conficker, which takes advantage of a vulnerability in Microsoft's software, has infected at least 3 million PCs and possibly as many as 12 million, making it into a huge botnet and one of the most severe computer security problems in recent years.
[ IBM has suggested that the number of PCs infected with Conficker may be in the tens of millions. | Beware: Fake security software scammers have been jumping on Conficker. | Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]
Botnets can be used to send spam and attack other Web sites, but they need to be able to receive new instructions. Conficker can do this two ways: it can either try to visit a Web site and pick up instructions or it can receive a file over its custom-built encrypted p-to-p (peer-to-peer) network.
Over the last day or so, researchers with Websense and Trend Micro said some PCs infected with Conficker received a binary file over p-to-p. Conficker's controllers have been hampered by efforts of the security community to get directions via a Web site, so they are now using the p-to-p function, said Rik Ferguson, senior security advisor for the vendor Trend Micro.
The new binary tells Conficker to start scanning for other computers that haven't patched the Microsoft vulnerability, Ferguson said. A previous update turned that capability off, which hinted that Conficker's controllers maybe thought the botnet had grown too large.
But now, "it certainly indicates they [Conficker's authors] are seeking to control more machines," Ferguson said.
The new update also tells Conficker to contact MySpace.com, MSN.com, Ebay.com, CNN.com, and AOL.com apparently to confirm that the infected machine is connected to the Internet, Ferguson said. It also blocks infected PCs from visiting some Web sites. Previous Conficker versions wouldn't let people browse to the Web sites of security companies.
In another twist, the binary appears to be programmed to stop running on May 3, which will shut off the new functions, he said.
By Jeremy Kirk
source : infoworld
Showing posts with label Conficker. Show all posts
Showing posts with label Conficker. Show all posts
Friday, April 10, 2009
Thursday, April 9, 2009
Bitdefender Discovers New Conficker Variant
The malware researchers from anti-virus vendor Bitdefender have identified a new variant of the infamous Conficker worm. Its analysis has revealed an improved obfuscation layer and additional blocked strings. Conficker, also known as Downadup or Kido, is one of the most complex and well-written pieces of malware that security researchers have seen in recent years. The original variant, Conficker.A, appeared back in November 2008, soon after Microsoft broke its patch cycle in order to release MS08-067, a fix for...
December 2008 saw the release of Conficker.B, the most successful variant to date, which infected an estimated number of 12 million computers at its peak. This was followed by another seriously revamped version, initially dubbed Conficker.B++. Security experts speculated that this update aimed at combating the efforts of the Conficker Cabal, a coalition of industry organizations and companies collaborating to fight the worm. Conficker.B++ is currently better known as Conficker.C.
Bitdefender announced yesterday that it had identified a new variant, but details were scarce, as it was still being analyzed. New information will be posted when it becomes available, the company's press release reads. However, our inside sources at Bitdefender have been able to provide us with more insight into this incident.
New Conficker variant blocked by Bitdefender Antivirus
Enlarge picture
According to them, the analysts got suspicious after a customer reported that he could not access www.bdtools.net, the website used by Bitdefender to host free removal tools, from his computer infected with Conficker. This was particularly interesting, because the domain name was not amongst the ones blocked by the known variants of the worm. After securing a sample and analyzing it, the researchers concluded that they were dealing with a new version.
Even though it does not bring radical changes, like Conficker.B or Conficker.C do, this variation has an extended blacklist. The newly added strings, used by the worm to block access to domains or executables containing them, are: precisesecurity, ms-mvp, mitre, enigma, bdtools, av-sc, adware, activescan, stinger, kill, cfremo and bd_rem. Downadup also features two layers of obfuscation to prevent analysis and detection. However, our sources have informed us that, in this variant, the primary obfuscation layer is heavily modified and seems to have been particularly designed to block emulation.
Bitdefender has determined that this new version has actually been in circulation since around March 18th, but pretty much passed unobserved. It is currently detected as Win32.Worm.Downadup.Gen, under a generic routine able to identify any known variant of Conficker. The users who cannot access the www.bdtools.net website in order to obtain Bitdefender's free Conficker removal tool can download it from our secure servers. Furthermore, people having trouble executing the tool on infected computers, should rename it to something random and try again.
source : news.softpedia
Conficker spreads via peer-to-peer
The Conficker worm is finally doing something--updating via peer-to-peer between infected computers and dropping a mystery payload on infected computers, Trend Micro said on Wednesday.
Researchers were analyzing the code of the software that is being dropped onto infected computers but suspect that it is a keystroke logger or some other program designed to steal sensitive data off the machine, said David Perry, global director of security education at Trend Micro.
The worm also tries to connect to MySpace.com, MSN.com, eBay.com, CNN.com and AOL.com as a way to test that the computer has Internet connectivity, deletes all traces of itself in the host machine, and is set to shut down on May 3, according to the TrendLabs Malware Blog.
Because infected computers are receiving the new component in a staggered manner rather than all at once there should be no disruption to the Web sites the computers visit, said Paul Ferguson, advanced threats researcher for Trend Micro.
"After May 3, it shuts down and won't do any replication," Perry said. However, infected computers could still be remotely controlled to do something else, he added.
Last night Trend Micro researchers noticed a new file in the Windows Temp folder and a huge encrypted TCP response from a known Conficker P2P IP node hosted in Korea.
"As expected, the P2P communications of the Downad/Conficker botnet may have just been used to serve an update, and not via HTTP," the blog post says. "The Conficker/Downad P2P communications is now running in full swing!"
In addition to adding the new propagation functionality, Conficker communicates with servers that are associated with the Waledac family of malware and its Storm botnet, according to a separate blog post by Trend Micro security researcher Rik Ferguson.
The worm tries to access a known Waledac domain and download another encrypted file, the researchers said.
Conficker.C failed to make a splash a week ago despite the fact that it was programmed to activate on April 1.
Initially, researchers thought they were seeing a new variant of the Conficker worm, but now they believe it is merely a new component of the worm.
The worm spreads via a hole in Windows that Microsoft patched in October, as well as through removable storage devices and network shares with weak passwords.
thanks : Elinor Mills
source : cnet
Tuesday, April 7, 2009
Conficker copycat prowls for victims, says Microsoft
Four-year-old Neeris worm copies Conficker's attack strategies
An old, but little-known worm has copied some of the infection strategies of Conficker, the worm that raised a ruckus last week, Microsoft security researchers said late Friday.
Neeris, which harks to May 2005, is now exploiting the same Windows bug that Conficker put to good use, and is spreading through flash drives, another Conficker characteristic, said Ziv Mador and Aaron Putnam, researchers with the Microsoft Malware Protection Center.
[ IBM's estimates suggest that tens of millions of PCs may be infected by Conficker. | Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]
According to Mador and Putnam, Neeris' makers recently added an exploit for the MS08-067 vulnerability that Microsoft patched last October. The emergency update -- one of the rare times Microsoft has issued a patch outside its usual monthly scheduled --- fixed a flaw in the Windows Server service, which is used for file- and print-sharing by Windows PCs.
Conficker, the worm that began using a new communications scheme to receive commands from its hacker controllers last Wednesday, exploited the same MS08-067 vulnerability to devastating effect in late 2008 and early 2009. During January, for instance, Conficker infected millions of machines, many of them by exploiting MS08-067.
"Neeris [also] spreads via Autorun," Mador and Putnam said in an entry to the malware center's blog. "The new Neeris variant even adds the same 'Open folder to view files' AutoPlay option that Conficker does."
Conficker spread from infected PCs by adding an autorun.inf file to the root directory of any USB-based device, primarily flash drives. Later, when the drive was connected to an uninfected computer, the autorun.inf file silently copied the worm to the machine.
By Gregg Keizer
source : infoworld
An old, but little-known worm has copied some of the infection strategies of Conficker, the worm that raised a ruckus last week, Microsoft security researchers said late Friday.
Neeris, which harks to May 2005, is now exploiting the same Windows bug that Conficker put to good use, and is spreading through flash drives, another Conficker characteristic, said Ziv Mador and Aaron Putnam, researchers with the Microsoft Malware Protection Center.
[ IBM's estimates suggest that tens of millions of PCs may be infected by Conficker. | Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]
According to Mador and Putnam, Neeris' makers recently added an exploit for the MS08-067 vulnerability that Microsoft patched last October. The emergency update -- one of the rare times Microsoft has issued a patch outside its usual monthly scheduled --- fixed a flaw in the Windows Server service, which is used for file- and print-sharing by Windows PCs.
Conficker, the worm that began using a new communications scheme to receive commands from its hacker controllers last Wednesday, exploited the same MS08-067 vulnerability to devastating effect in late 2008 and early 2009. During January, for instance, Conficker infected millions of machines, many of them by exploiting MS08-067.
"Neeris [also] spreads via Autorun," Mador and Putnam said in an entry to the malware center's blog. "The new Neeris variant even adds the same 'Open folder to view files' AutoPlay option that Conficker does."
Conficker spread from infected PCs by adding an autorun.inf file to the root directory of any USB-based device, primarily flash drives. Later, when the drive was connected to an uninfected computer, the autorun.inf file silently copied the worm to the machine.
By Gregg Keizer
source : infoworld
Monday, March 30, 2009
'60 Minutes': What's next for the Conficker worm?
The following is a transcript of a "60 Minutes" report on Internet viruses that aired Sunday.
The Internet is infected. Malicious computer hackers have been creating more and more weapons that they plant on the Internet. They call their weapons viruses and worms--they're creepy, crawly toxic software that contaminate our computers without our ever knowing it. You can be infected by simply visiting your favorite Web site, or just by leaving your computer on, overnight while you're asleep.
And the problem is growing, exponentially. Last year the number of infections tripled. And an entire industry of computer security professionals is in a race to keep the hackers from their goal, which is usually to steal your money.
One of the most dangerous threats ever, a computer worm known as "Conficker," is spreading through the Internet right now. By some estimates, 10 million computers have been infected worldwide.
At Symantec, the company that makes Norton antivirus software, engineers have been tracking Conficker since last November as it worms its way across the globe.
"This map is showing a visual representation of where all of the known infections of Conficker are across the world," explained Steve Trilling, a Symantec vice president who says the worm is now living on millions of computers, mainly in corporations.
So far, the bad guys who created it haven't triggered Conficker. It's just sitting out there like a sleeper cell.
"Imagine a network of spies that has infiltrated a country. And every day, all of the spies are calling in for their instructions on what to do next," Trilling explained.
Asked what the worm is being asked to do, Trilling told Stahl, "That's the interesting thing. The only thing the worm is being asked to do is to ask for further instructions."
For several months, Trilling says the worm has just been sitting there, awaiting instructions.
It's that ominous, because once the hackers issue instructions, Conficker could turn menacing in an instant.
With one click, the worm's creator can instruct it to suck sensitive data, like bank passwords and account numbers, out of millions of computers, or launch a massive spam attack to clog up the works.
The newest targets of worms are social networking sites. Trilling demonstrated to Stahl how it might work.
Looking at a real Facebook page, Trilling explained, "We added your friend and colleague Morley Safer, you can see down there on the left."
He says a worm can crack into a Facebook account, like Morley's, and send a message to anyone on his friends list.
It's a message a friend or colleague, like Stahl, would be sure to open since it comes from a trusted friend. Stahl took the bait and clicked on what looked like Morley's video link.
"Something looks a little off," Trilling remarked. "You're already infected."
As Trilling demonstrated on a second screen, the hacker "owned" Stahl's online movements. "From here on out, everything you do, gonna show up on the hacker's machine," he explained.
So when Stahl typed her username and password into a bank Web site, it appeared instantaneously on the hacker's screen, along with her bank account details.
"Every single keystroke you hit, in fact, if you make a mistake and hit a backspace, that shows up in the window," Trilling explained.
The hacker then followed her around, as she browsed the Internet from CBS News to Amazon.com.
"So, if I buy something, they're gonna have my credit card," Stahl remarked.
"Everything you type in, your address, your credit card, it's all gonna show up in that window," Trilling warned.
A minefield on the Internet
The Internet has become a minefield. Hackers have hidden their malicious software known as "malware" on some of the most trusted Web sites, like eBay, the Miami Dolphins football team, even my.barackobama.com.
Trilling says too few people have top-notch, up-to-date security software.
"There is something that would have prevented me from answering Morley's message. Or I would never have gotten Morley's message?" Stahl asked.
"As soon as you clicked on that link and you had security software, you would immediately get an alert. 'This is a bad Web site.' And it would have blocked the attack. You would have never been hit. Putting on that software, you're preventing yourself from becoming a victim," Trilling advised.
But according to Symantec's own figures, the hackers are inventing up to 15,000 new infections every day, designed specifically to get around the latest anti-virus protections. Symantec has to send out updates every five minutes.
"You sell the antivirus, anti-worm stuff. I mean, how do I know you're not just saying, 'Go out and get this,' 'cause you sell it? I mean, you know... there's a sort of conflict of interest here," Stahl pointed out.
"Well look, Lesley, in 60 minutes we are blocking nearly 400,000 threats around the world. If you're goin' out on the Internet and you're not protected, it's like walkin' outta your house and leavin' the door open," Trilling argued.
But Mary Rappaport says all the doors on her home computer were locked tight. She had antivirus software and a firewall, and so she thought she was safe to do her banking online. But then she noticed something odd going on and called the bank.
"They told me that three charges in the last three days had been made to my account. One for $3,000, one for $4,000, and one for $1,200," she recalled.
Rappaport knew she had to act quickly.
The bank replaced the stolen money and suggested that she merely change her password. That was to be the end of it. But the next day, she was checking her balance. "And I saw $1,000 being moved from my son's savings account into my checking account," she recalled. "Right before my eyes. I saw my money being moved."
A hacker was trying to move all her money into one account, her checking account, to make it easier to transfer overseas. Luckily, the bank was able to freeze her accounts before she lost any more money.
"I had what I thought were adequate protections. You know, I had anti-spyware software," she said. "And antivirus."
"And I thought I had a good enough firewall. Wrong!" Rappaport told Stahl. "My understanding anyway is that they were able to get some sort of bug onto my system that disabled the ability to update these software programs."
Mary suspects her teenage sons picked up the bug while downloading from music or game Web sites. But it could have come from any number of Web sites.
Going to Google
Stahl asked Google what they're doing to deal with these big problems, because their search engine is what most people use to surf the net.
Stahl went to talk to Vint Cerf, one of the founding fathers of the Internet, and now a vice president at Google. The company itself says that one in every 100 Google searches brings up an infected site.
"People are blaming Google 'cause if you do the search, they say, you--Google--should be responsible if we get infected," Stahl remarked. "Now you've heard that."
"I have heard that, and I think that's a very bizarre way of looking at things," Cerf replied.
Google's position is that it's not the policeman of the Internet, but its engineers do scour the Web and issue warnings about malicious infections, or malware.
"If we happen to see what we believe is malware on that Web site, then when you go there we will pop up a Web page and it says, 'We think we found malware on this site. Maybe you don't want to go there,'" Cerf explained.
"Now I understand that if you go there anyway, Google sends you a second warning, saying: 'Are you kidding? Are you serious? We told you not to go there.' Something like that," Stahl said.
"Of course people still go," Cerf acknowledged. "And at that point it's their problem."
"The more you hear about this, the more you feel that if you bank online, shop online, open an e-mail, I mean, that almost anything you do puts you in jeopardy," Stahl remarked.
"That's a true statement. There are things. Bad things can happen. On the other hand, I've been on the Net ever since the Net started, and I haven't had any of the bad problems that you've described," Cerf replied.
But tens of millions of people have--one if four Americans, according to recent reports, as the hackers get more and more sophisticated.
Hunting hackers
Don Jackson is a hacker hunter. He is director of threat intelligence at SecureWorks in Atlanta, which protects corporations against cyber-attacks and tracks the hackers who launch them.
"Part of my job is to know the enemy, to know our adversaries," he explained.
To Jackson, the enemy is a hacker. "An enemy is somebody who wants to use computers to hurt somebody else or to make money for themselves."
Using an assumed name, "Gozi," Jackson infiltrates chat rooms where hackers sell their worms and viruses to their clients: other hackers. He asks for a demo so his company can create software to disable the malware. The hackers, he says, are typically young, male and often from Russia.
Asked how he tracks them down, Jackson said, "Well, they're like any other business. They have to advertise to get clients."
As Jackson explains, these brazen hackers do this openly on the Internet. "Unfortunately they're all too easy to find," he said.
He says many Russian hackers are in cyber-gangs that display fascist symbols, like a Swastika and anti-American artwork. They boast about all the dollars they've stolen from the rich Americans. A single hacker can make $30,000 a month and be championed in local newspapers.
"There's an example recently where two boys were arrested actually and then let go the next day, but the article in the newspaper wasn't that they were arrested and that they committed a crime, but saying: 'Look at our two local boys made good. They've cheated some greedy Westerners out of so much money,'" Jackson explained.
"They're heroes," Stahl remarked.
"They are," he agreed. "And it's bringing money into the local economy."
Russian authorities tend to look the other way, which explains why members of the cyber gangs have no fear. They even show their faces on the Internet.
One of the hackers, who calls himself "Tempest," is just 14 years old and working full time. "So he can't legally drive a car and he can't join the army, but he can hack into banks and siphon money out," Jackson remarked.
It's not known who's behind the computer worm Conficker, whether it's a gang of Russian hackers or some solitary evil genius. This worm is wily--it keeps mutating. Security software companies have been kept very busy.
But Conficker can jump over protections. While Stahl was reporting this story in early March, she was stunned to learn that the wily worm had struck CBS News.
"People were havin' problems with their BlackBerries, their logons," explained Louie Pelaez, a network engineer.
He says Conficker is so aggressive, it took CBS technicians 24/7 over 10 days to hunt down and quarantine the affected computers.
"Do you actually know where it started? Can you pinpoint it?" Stahl asked.
"We really will probably never know exactly how it infected the network," Pelaez said. "We just know that, you know, once it hit, it began to propagate."
CBS News has now contained the infection, but Pelaez says Conficker could still be hiding undetected somewhere within the network.
Asked if he thinks CBS is safe, or if this could happen again, Pelaez told Stahl, "No, I pretty much thought that we were pretty solid. You try to secure a network. But there's no guarantee that somebody can't come up with something that will, you know, wreak havoc."
Conficker investigators have been talking about an April Fool's attack, because in dissecting the worm, they can see it's been programmed to receive new instructions on April 1. But nobody knows if the instructions will be benign, or something that could disrupt the entire Internet.
source :news.cnet.com
The Internet is infected. Malicious computer hackers have been creating more and more weapons that they plant on the Internet. They call their weapons viruses and worms--they're creepy, crawly toxic software that contaminate our computers without our ever knowing it. You can be infected by simply visiting your favorite Web site, or just by leaving your computer on, overnight while you're asleep.
And the problem is growing, exponentially. Last year the number of infections tripled. And an entire industry of computer security professionals is in a race to keep the hackers from their goal, which is usually to steal your money.
One of the most dangerous threats ever, a computer worm known as "Conficker," is spreading through the Internet right now. By some estimates, 10 million computers have been infected worldwide.
At Symantec, the company that makes Norton antivirus software, engineers have been tracking Conficker since last November as it worms its way across the globe.
"This map is showing a visual representation of where all of the known infections of Conficker are across the world," explained Steve Trilling, a Symantec vice president who says the worm is now living on millions of computers, mainly in corporations.
So far, the bad guys who created it haven't triggered Conficker. It's just sitting out there like a sleeper cell.
"Imagine a network of spies that has infiltrated a country. And every day, all of the spies are calling in for their instructions on what to do next," Trilling explained.
Asked what the worm is being asked to do, Trilling told Stahl, "That's the interesting thing. The only thing the worm is being asked to do is to ask for further instructions."
For several months, Trilling says the worm has just been sitting there, awaiting instructions.
It's that ominous, because once the hackers issue instructions, Conficker could turn menacing in an instant.
With one click, the worm's creator can instruct it to suck sensitive data, like bank passwords and account numbers, out of millions of computers, or launch a massive spam attack to clog up the works.
The newest targets of worms are social networking sites. Trilling demonstrated to Stahl how it might work.
Looking at a real Facebook page, Trilling explained, "We added your friend and colleague Morley Safer, you can see down there on the left."
He says a worm can crack into a Facebook account, like Morley's, and send a message to anyone on his friends list.
It's a message a friend or colleague, like Stahl, would be sure to open since it comes from a trusted friend. Stahl took the bait and clicked on what looked like Morley's video link.
"Something looks a little off," Trilling remarked. "You're already infected."
As Trilling demonstrated on a second screen, the hacker "owned" Stahl's online movements. "From here on out, everything you do, gonna show up on the hacker's machine," he explained.
So when Stahl typed her username and password into a bank Web site, it appeared instantaneously on the hacker's screen, along with her bank account details.
"Every single keystroke you hit, in fact, if you make a mistake and hit a backspace, that shows up in the window," Trilling explained.
The hacker then followed her around, as she browsed the Internet from CBS News to Amazon.com.
"So, if I buy something, they're gonna have my credit card," Stahl remarked.
"Everything you type in, your address, your credit card, it's all gonna show up in that window," Trilling warned.
A minefield on the Internet
The Internet has become a minefield. Hackers have hidden their malicious software known as "malware" on some of the most trusted Web sites, like eBay, the Miami Dolphins football team, even my.barackobama.com.
Trilling says too few people have top-notch, up-to-date security software.
"There is something that would have prevented me from answering Morley's message. Or I would never have gotten Morley's message?" Stahl asked.
"As soon as you clicked on that link and you had security software, you would immediately get an alert. 'This is a bad Web site.' And it would have blocked the attack. You would have never been hit. Putting on that software, you're preventing yourself from becoming a victim," Trilling advised.
But according to Symantec's own figures, the hackers are inventing up to 15,000 new infections every day, designed specifically to get around the latest anti-virus protections. Symantec has to send out updates every five minutes.
"You sell the antivirus, anti-worm stuff. I mean, how do I know you're not just saying, 'Go out and get this,' 'cause you sell it? I mean, you know... there's a sort of conflict of interest here," Stahl pointed out.
"Well look, Lesley, in 60 minutes we are blocking nearly 400,000 threats around the world. If you're goin' out on the Internet and you're not protected, it's like walkin' outta your house and leavin' the door open," Trilling argued.
But Mary Rappaport says all the doors on her home computer were locked tight. She had antivirus software and a firewall, and so she thought she was safe to do her banking online. But then she noticed something odd going on and called the bank.
"They told me that three charges in the last three days had been made to my account. One for $3,000, one for $4,000, and one for $1,200," she recalled.
Rappaport knew she had to act quickly.
The bank replaced the stolen money and suggested that she merely change her password. That was to be the end of it. But the next day, she was checking her balance. "And I saw $1,000 being moved from my son's savings account into my checking account," she recalled. "Right before my eyes. I saw my money being moved."
A hacker was trying to move all her money into one account, her checking account, to make it easier to transfer overseas. Luckily, the bank was able to freeze her accounts before she lost any more money.
"I had what I thought were adequate protections. You know, I had anti-spyware software," she said. "And antivirus."
"And I thought I had a good enough firewall. Wrong!" Rappaport told Stahl. "My understanding anyway is that they were able to get some sort of bug onto my system that disabled the ability to update these software programs."
Mary suspects her teenage sons picked up the bug while downloading from music or game Web sites. But it could have come from any number of Web sites.
Going to Google
Stahl asked Google what they're doing to deal with these big problems, because their search engine is what most people use to surf the net.
Stahl went to talk to Vint Cerf, one of the founding fathers of the Internet, and now a vice president at Google. The company itself says that one in every 100 Google searches brings up an infected site.
"People are blaming Google 'cause if you do the search, they say, you--Google--should be responsible if we get infected," Stahl remarked. "Now you've heard that."
"I have heard that, and I think that's a very bizarre way of looking at things," Cerf replied.
Google's position is that it's not the policeman of the Internet, but its engineers do scour the Web and issue warnings about malicious infections, or malware.
"If we happen to see what we believe is malware on that Web site, then when you go there we will pop up a Web page and it says, 'We think we found malware on this site. Maybe you don't want to go there,'" Cerf explained.
"Now I understand that if you go there anyway, Google sends you a second warning, saying: 'Are you kidding? Are you serious? We told you not to go there.' Something like that," Stahl said.
"Of course people still go," Cerf acknowledged. "And at that point it's their problem."
"The more you hear about this, the more you feel that if you bank online, shop online, open an e-mail, I mean, that almost anything you do puts you in jeopardy," Stahl remarked.
"That's a true statement. There are things. Bad things can happen. On the other hand, I've been on the Net ever since the Net started, and I haven't had any of the bad problems that you've described," Cerf replied.
But tens of millions of people have--one if four Americans, according to recent reports, as the hackers get more and more sophisticated.
Hunting hackers
Don Jackson is a hacker hunter. He is director of threat intelligence at SecureWorks in Atlanta, which protects corporations against cyber-attacks and tracks the hackers who launch them.
"Part of my job is to know the enemy, to know our adversaries," he explained.
To Jackson, the enemy is a hacker. "An enemy is somebody who wants to use computers to hurt somebody else or to make money for themselves."
Using an assumed name, "Gozi," Jackson infiltrates chat rooms where hackers sell their worms and viruses to their clients: other hackers. He asks for a demo so his company can create software to disable the malware. The hackers, he says, are typically young, male and often from Russia.
Asked how he tracks them down, Jackson said, "Well, they're like any other business. They have to advertise to get clients."
As Jackson explains, these brazen hackers do this openly on the Internet. "Unfortunately they're all too easy to find," he said.
He says many Russian hackers are in cyber-gangs that display fascist symbols, like a Swastika and anti-American artwork. They boast about all the dollars they've stolen from the rich Americans. A single hacker can make $30,000 a month and be championed in local newspapers.
"There's an example recently where two boys were arrested actually and then let go the next day, but the article in the newspaper wasn't that they were arrested and that they committed a crime, but saying: 'Look at our two local boys made good. They've cheated some greedy Westerners out of so much money,'" Jackson explained.
"They're heroes," Stahl remarked.
"They are," he agreed. "And it's bringing money into the local economy."
Russian authorities tend to look the other way, which explains why members of the cyber gangs have no fear. They even show their faces on the Internet.
One of the hackers, who calls himself "Tempest," is just 14 years old and working full time. "So he can't legally drive a car and he can't join the army, but he can hack into banks and siphon money out," Jackson remarked.
It's not known who's behind the computer worm Conficker, whether it's a gang of Russian hackers or some solitary evil genius. This worm is wily--it keeps mutating. Security software companies have been kept very busy.
But Conficker can jump over protections. While Stahl was reporting this story in early March, she was stunned to learn that the wily worm had struck CBS News.
"People were havin' problems with their BlackBerries, their logons," explained Louie Pelaez, a network engineer.
He says Conficker is so aggressive, it took CBS technicians 24/7 over 10 days to hunt down and quarantine the affected computers.
"Do you actually know where it started? Can you pinpoint it?" Stahl asked.
"We really will probably never know exactly how it infected the network," Pelaez said. "We just know that, you know, once it hit, it began to propagate."
CBS News has now contained the infection, but Pelaez says Conficker could still be hiding undetected somewhere within the network.
Asked if he thinks CBS is safe, or if this could happen again, Pelaez told Stahl, "No, I pretty much thought that we were pretty solid. You try to secure a network. But there's no guarantee that somebody can't come up with something that will, you know, wreak havoc."
Conficker investigators have been talking about an April Fool's attack, because in dissecting the worm, they can see it's been programmed to receive new instructions on April 1. But nobody knows if the instructions will be benign, or something that could disrupt the entire Internet.
source :news.cnet.com
