Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

New Conficker Variant Increases Its Flexibility

Soulskill posted more than 5 years ago | from the those-yoga-classes-really-helped dept.

Worms 120

CWmike writes "Criminals behind the widespread Conficker worm have released a new version that could signal a major shift in the way the malware operates. The new variant, dubbed Conficker B++, was spotted three days ago by SRI International researchers, who published details of the new code on Thursday. To the untrained eye, the new variant looks almost identical to the previous version of the worm, Conficker B. But the B++ variant uses new techniques to download software, giving its creators more flexibility in what they can do with infected machines."

cancel ×

120 comments

The Botnet National Anthem (5, Funny)

Chris Tucker (302549) | more than 5 years ago | (#26936809)

Botnets, worldwide botnets.
What kind of boxes are on botnets?

Compaq, HP, Dell and Sony, TRUE!
Gateway, Packard Bell, maybe even Asus, too.

Are boxes, found on botnets.
All running Windows, FOO!

This is you on windows (-1, Offtopic)

Anonymous Coward | more than 5 years ago | (#26937083)

Re:This is you on windows (4, Insightful)

Chris Tucker (302549) | more than 5 years ago | (#26937217)

And they keep coming back to Windows.

"Oh, I KNOW Windows loves me. All the abuse is my fault. I deserve it!"

Re:This is you on windows (1, Interesting)

Anonymous Coward | more than 5 years ago | (#26939919)

And they keep coming back to Windows.

"Oh, I KNOW Windows loves me. All the abuse is my fault. I deserve it!"

In this case it actually is. This worm is only targeting all the smartasses turning off windows update because they think they know better (whether sysadmins or personal users). This was patched months ago.

Re:This is you on windows (2, Interesting)

Anonymous Coward | more than 5 years ago | (#26941781)

"Oh, I KNOW Windows loves me" - by Chris Tucker (302549) on Friday February 20, @07:50PM (#26937217) Homepage

It does, because it does ME, & I have yet to be infected/infested for decades online now...

You can have the same results, simply IF you can read english & apply what is noted here to secure yourself (1-2 hrs. of work for YEARS of uptime, stability, & bugfree operation):

HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA, plus make it "fun-to-do", via CIS Tool Guidance:

http://www.tcmagazine.com/forums/index.php?s=e692b654cf47859bebf9e4380bec3a03&showtopic=2662 [tcmagazine.com]

----

"All the abuse is my fault. I deserve it!" - by Chris Tucker (302549) on Friday February 20, @07:50PM (#26937217) Homepage

It's the fault of Microsoft for shipping OS in such a relatively unsecured state (&, it doesn't HAVE to be that way, because tools like SCW (server configuration wizard) exist in MS Windows variants, such as Windows Server 2003 for example, & it OUGHT to be run right after setup is completing... but, it's not, for example), &, the fault of the misguided fools that create these machinations...

I will say 1 thing in defense of the people that create malware in general (as I call it) - they ARE pointing out FUNDAMENTAL flaws that exist in default OS setups, but, that's about it, because their talents COULD be put to use elsewhere... but, as far as saying they are "talented" in this "art & science"?

Hey - ANYONE can be bogus & destructive: It's "TOO EASY"... quite another to be creative for useful things, vs. creating virus & such!

Anyhow/anyways:

NOW - IF you just "smarten up", & disable the SERVER service (which this worm exploits a bug in), because you generally (as an end-user on a single machine online via the internet only & NO home or work LAN/WAN connectivity needed) for 1 thing, & then watch it with javascript usage in your webbrowsers (meaning do NOT use it on "every site online under the sun", & ONLY on the sites you absolutely NEED javascript active for, for proper full function?

You CAN stay clean, & uninfected... &, even vs. THIS particular worm & its variants...

APK

reminds me of dis little ditty goes something like (-1, Offtopic)

Anonymous Coward | more than 5 years ago | (#26937851)

say oops upside your head say oops upside your head
say oops upside your head say oops upside your head
pay attention now or you get some more
say oops upside your head say oops upside your head
say oops upside your head say oops upside your head
now I want all you gappers, and finger snappers
you toe tappers and you love rappers
to beat the crap out of her

Re:The Botnet National Anthem (3, Funny)

Anonymous Coward | more than 5 years ago | (#26937111)

If they run foo() then all operating systems are vulnerable!
O.M.G!

Re:The Botnet National Anthem (1)

Chris Tucker (302549) | more than 5 years ago | (#26937195)

I'd mod you up if I could.

Re:The Botnet National Anthem (5, Funny)

wisty (1335733) | more than 5 years ago | (#26939503)

YOU HAVE RECEIVED THE UNIX VIRUS!

This virus works on the honor system. Please
randomly delete some of your files and forward
this to everyone you know.

This is slashdot right? (4, Interesting)

blool (798681) | more than 5 years ago | (#26936817)

Why is the summary so devoid of technical detail? You realize we don't read the articles right?

Re:This is slashdot right? (0)

WarJolt (990309) | more than 5 years ago | (#26936863)

Because the article doesn't have any technical detail either. I would assume that the new features allow them to connect through some sort of peering mechanism, but the article doesn't go into detail.

Re:This is slashdot right? (4, Informative)

Psychotria (953670) | more than 5 years ago | (#26936933)

Because the article doesn't have any technical detail either.

Well, the second linked-to article (the one by SRI) is chock full of technical details; and it's an interesting read.

Re:This is slashdot right? (3, Insightful)

Erikderzweite (1146485) | more than 5 years ago | (#26938839)

Not only did you read TFA, you follow the link from TFA! I'm sorry sir, but the usual question whether or not are you new here doesn't apply to you.
How did it come you have a slashdot account? By ./ standards you are not born yet!

Re:This is slashdot right? (4, Funny)

grizdog (1224414) | more than 5 years ago | (#26936957)

Because the article doesn't have any technical detail either. I would assume that the new features allow them to connect through some sort of peering mechanism, but the article doesn't go into detail.

Well, I thought there was some useful detail in the article, particularly this:

Overall, the modifications to Conficker B++ appear relatively minor as compared to the significant upgrade in functionality, performance, and reliability, that occurred from Conficker A to B. These smaller and more surgical changes to B appear to address some of the realities that are currently impacting Conficker's binary update strategy. In particular, in Conficker A and B, there appeared only one method to submit Win32 binaries to the digitial signature validation path, and ultimately to the CreateProcess API call. This path required the use of the Internet rendezvous point to download the binary through an HTTP transaction. Under Conficker B++, two new paths to binary validation and execution have been introduced to Conficker drones, both of which bypass the use of Internet Rendezvous points: an extension to the netapi32.dll patch and the new named pipe backdoor. These changes suggest a desire by the Conficker's authors to move away from a reliance on Internet rendezvous points to support binary update, and toward a more direct flash approach.

However, Conficker A and B did support through the previous netapi32.dll patch an ability to accept new DLLs, as long as the shell code submitted through the RPC buffer overflow matched the original Conficker infection shell code. This approach was limiting both in the requirement that direct flashing required an easily identifiable shellcode string and a single DLL method loading procedure, both of which are now subject to detection by security software. Conficker B++ dramatically increases the flexibilty of the direct flash mechanisms, offering an ability to load digitally signed Win32 executables directly to a Conficker host.

Re:This is slashdot right? (0)

Anonymous Coward | more than 5 years ago | (#26936993)

tl;dr

Re:This is slashdot right? (5, Funny)

MichaelSmith (789609) | more than 5 years ago | (#26937039)

Cripes with all the reliance they are placing on windows internals they will never get this thing ported to *nix. Its almost as bad as autocad.

Re:This is slashdot right? (0)

Anonymous Coward | more than 5 years ago | (#26937107)

Yeah, AutoCad version 9 didn't even use standard C IO mechanisms but went directly to the bios it was a MESS.

Re:This is slashdot right? (0, Redundant)

sexconker (1179573) | more than 5 years ago | (#26937001)

Slashdot posters rarely read the fucking articles.
Slashdot readers often take down sites.

Slashdot readers are a (vastly) super set of Slashdot posters.

Also, submitted by CWmike?
Conficker Writer Mike!

You're not an idiot, are you? (0)

Anonymous Coward | more than 5 years ago | (#26937035)

Just because it's SOP for slashdotters not to RTFA, doesn't mean you have to be part of the cliché as well, do you? Show some initiative and click on the second link. Rad the very thorough analysis and report back here to intelligently discuss what you've learned with your fellow slashdotters. You'll be a better slashdot member for it.

Re:This is slashdot right? (5, Informative)

InsertWittyNameHere (1438813) | more than 5 years ago | (#26937071)

In short bot herders can now push updates to infected machines rather than relying on the infected machine to seek out and download updates.

Some quotes:

"a more efficient push-based updating service"

"the ability to accept and validate remotely submitted URLs and Win32 binaries, could signal a significant shift in the strategies used by Conficker's authors to upload and interact with their drones."

"comparing Conficker B with Conficker B++, we obtained a similarity score of 86.4%. "

"out of 297 subroutines in Conficker B, only 3 were modified in Conficker B++ and around 39 new subroutines were added. "

"Under Conficker B++, two new paths to binary validation and execution have been introduced to Conficker drones, both of which bypass the use of Internet Rendezvous points: an extension to the netapi32.dll patch and the new named pipe backdoor. These changes suggest a desire by the Conficker's authors to move away from a reliance on Internet rendezvous points to support binary update, and toward a more direct flash approach."

"Conficker B++ dramatically increases the flexibilty of the direct flash mechanisms, offering an ability to load digitally signed Win32 executables directly to a Conficker host. "

Re:This is slashdot right? (5, Funny)

Narnie (1349029) | more than 5 years ago | (#26938241)

Microsoft should hire these guys to revamp Windows Update.

Mod Parent +1 Funny, but sadly True (0)

Anonymous Coward | more than 5 years ago | (#26938687)

See Subject

Don't want to be hit by this worm? Take a read (0)

Anonymous Coward | more than 5 years ago | (#26942231)

"In short bot herders can now push updates to infected machines rather than relying on the infected machine to seek out and download updates." - by InsertWittyNameHere (1438813) on Friday February 20, @07:33PM (#26937071)

In short?

Hey, it's also relatively EASY to stall these "botmasters" (destructive script kiddies is more like it) from doing that... via VERY simple measures no less!

(Simply IF you can read english & apply what is noted here to secure yourself (1-2 hrs. of work for YEARS of uptime, stability, & bugfree operation)):

----

HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA, plus make it "fun-to-do", via CIS Tool Guidance:

http://www.tcmagazine.com/forums/index.php?s=e692b654cf47859bebf9e4380bec3a03&showtopic=2662 [tcmagazine.com]

----

E.G. (per said article's points for securing a Windows based OS) ->:

A.) IF you just simply "smarten up", & disable the SERVER service, which MOST folks w/ a single home system & no LAN around do NOT even need (which this worm exploits a bug in), because you generally (as an end-user on a single machine online via the internet only & NO home or work LAN/WAN connectivity needed) for 1 thing

&

B.) Then watch it with javascript usage in your webbrowsers (meaning do NOT use it on "every site online under the sun", & ONLY on the sites you absolutely NEED javascript active for, for proper full function?

You CAN stay clean, & uninfected... &, even vs. THIS particular worm & its variants...

APK

P.S.=> It's the fault of Microsoft for shipping OS in such a relatively unsecured state (&, it doesn't HAVE to be that way, because tools like SCW (server configuration wizard) exist in MS Windows variants, such as Windows Server 2003 for example, & it OUGHT to be run right after setup is completing... but, it's not, for example), &, the fault of the misguided fools that create these machinations...

HOWEVER: I will say 1 thing in defense of the people that create malware in general (as I call it) - they ARE pointing out FUNDAMENTAL flaws that exist in default OS setups, but, that's about it, because their talents COULD be put to use elsewhere... but, as far as saying they are "talented" in this "art & science"?

Hey - ANYONE can be bogus & destructive: It's "TOO EASY"... quite another to be creative for useful things, vs. creating virus & such... apk

Re:This is slashdot right? (1)

chris_mahan (256577) | more than 5 years ago | (#26938963)

We are supposed to read the summaries too?

Meep Beep! (2, Funny)

djupedal (584558) | more than 5 years ago | (#26936869)

If you're on the highway and Conficker goes beep beep.
Just step aside or might end up in a heap.
Conficker, Conficker runs on the road all day.
Even the coyote can't make him change his ways.

Conficker, the coyote's after you.
Conficker, if he catches you you're through.
Conficker, the coyote's after you.
Conficker, if he catches you you're through.

That coyote is really a crazy clown,
When will he learn he can never mow him down?
Poor little Conficker never bothers anyone,
Just runnin' down the road's his idea of having fun.

Re:Meep Beep! (4, Insightful)

HTH NE1 (675604) | more than 5 years ago | (#26937067)

Poor little Conficker never bothers anyone,
Just runnin' down the road's his idea of having fun.

And still true: it still hasn't done anything more than spread and try to keep itself from being purged.

With all the suspense and the scale of infection, whatever the payload is going to be, it'd better be something totally awesome!

Re:Meep Beep! (4, Interesting)

v1 (525388) | more than 5 years ago | (#26937367)

I know this is a very unpopular view with a lot of people, but I'd personally like to see a major worm like this pop a msg saying your computer has been taken over and is available to be used to harm others. you need to take your computer into the repair shop and get it cleaned up and protective software installed".

And then make windows unable to do anything but display that message when it boots.

Half the population would be picking up pitchforks, and the other half would be saying THANK you!

I for one am sick and tired of ignorant computer users getting their machines botnetted, blissfully unaware of the harm they are then contributing to. (and many of them are aware and just plain don't care)

Do the world a favor. MAKE them care.

Re:Meep Beep! (0)

Anonymous Coward | more than 5 years ago | (#26937515)

Microsoft would run a campaign 'informing' the people that this was all the fault of the freetard Linux and the only solution was Windows 7.

Well, if you have deep pockets... (1)

NotQuiteReal (608241) | more than 5 years ago | (#26937583)

and know the right (wrong) folks, maybe they will sell you the "package slot", and you can get your message out.

Of course, since you are kind of advocating an exclusive deal, it will probably cost more than the run of the mill spam or phishing campaign, which can be sold and sold again...

Also, IANAL, but I suspect doing bad things for the right reason would make you just as legally culpable as doing bad things, period.

Re:Well, if you have deep pockets... (2, Insightful)

cheekyboy (598084) | more than 5 years ago | (#26938115)

In that case you will never get caught because the current bot owners are not in jail and are selling services....

If they are untouchable, you're safe too.

Re:Well, if you have deep pockets... (1)

Darkk (1296127) | more than 5 years ago | (#26938247)

Makes me wonder why Microsoft posted a bounty for the author(s) of this worm.

It's like, "Oh shit, we can't patch against this worm so we need to nab the author!"

Microsoft can't come up with a patch fast enough without proper testing and time. They figured go after the source of the problem.

Honestly $250,000 bounty is chump change so if they up the ante to $1,000,000 then people will listen.

Re:Well, if you have deep pockets... (3, Informative)

Macthorpe (960048) | more than 5 years ago | (#26939705)

It was patched a long time ago - last October [theregister.co.uk] , to be precise.

Re:Meep Beep! (1)

couchslug (175151) | more than 5 years ago | (#26937601)

Malware that actually thinned the herd would make for a more robust herd.

Re:Meep Beep! (1)

Raenex (947668) | more than 5 years ago | (#26941533)

Says "couchslug".

Re:Meep Beep! (1)

cbiltcliffe (186293) | more than 5 years ago | (#26938367)

I've seen things like this before, and the user completely ignored it. Just clicked closed the window, and kept using the computer as before, for months.

Even one that asked me how to get rid of it didn't care that they were infected....they just didn't want to have to close the window all the time.

I think the only way to get them to care would be to keep track of the number of times the warning was closed, and once it hit 6, 10, or whatever, it would turn into a modal dialog with no close button, rendering the computer useless until it was fixed. Preferably with a big heading stating "Read this, idiot!!!"

Re:Meep Beep! (0)

Anonymous Coward | more than 5 years ago | (#26939739)

I know this is a very unpopular view with a lot of people, but I'd personally like to see a major worm like this pop a msg saying your computer has been taken over and is available to be used to harm others. you need to take your computer into the repair shop and get it cleaned up and protective software installed".

If you truly believe it, make it happen.

Like all botnets, Conficker is a platform that's sold to the highest bidder. Send the authors enough cash, and you can have Conficker do what you like.

Re:Meep Beep! (1)

v1 (525388) | more than 5 years ago | (#26940555)

Tho I'd be willing to bet that shutting down their botnet would cost a lot more than the average spyware install or spam run. Since it would be their last sale.

But I bet you're right, they COULD be sold. I bet MS has enough money too. So if they REALLY wanted to get rid of it, I suppose they could pay them off? I don't see that happening though. it would set a nasty precedent that if you build a good enough botnet, MS will bury you in cash to go away. Though the botnet is already insanely profitable. Anyone have some hard (or at least relatively firm) numbers on how much a botnet such as conflicker can net for a herder? We've seen the posts here in the past where they had a full portal interface for people rending their services to send spam etc.

Re:Meep Beep! STOP THIS WORM EASILY (0)

Anonymous Coward | more than 5 years ago | (#26942877)

"I for one am sick and tired of ignorant computer users getting their machines botnetted, blissfully unaware of the harm they are then contributing to. (and many of them are aware and just plain don't care)" - by v1 (525388) on Friday February 20, @08:10PM (#26937367) Homepage

So was I, because professionally, it has eaten up a GOOD 80%++ or more of my days on the job with clients in cleansing their rigs of this madness-N-lunacy... so, I decided to put this around on the wire on 20 sites or so last year (for my "New Year's Resolution" of "DO A GOOD DEED")... &, it's done EXTREMELY well, especially vs. machinations like this new worm:

----

HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA, plus make it "fun-to-do", via CIS Tool Guidance, & beyond:

http://www.tcmagazine.com/forums/index.php?s=e692b654cf47859bebf9e4380bec3a03&showtopic=2662 [tcmagazine.com] [tcmagazine.com] [tcmagazine.com] [tcmagazine.com]

----

E.G. (per said article's points for securing a Windows based OS) ->:

----

A.) IF you just simply "smarten up", & disable the SERVER service, which MOST folks w/ a single home system & no LAN around do NOT even need to have running in that case (which this worm exploits a bug in), because you generally don't NEED it (as an end-user on a single machine online via the internet only & NO home or work LAN/WAN connectivity needed sharing files/folders/disks/printers etc.), thus, merely WASTING excess CPU cycles, memory, & other forms of I/O server service needs (for sharing files/folders/printers etc. et al), for 1 thing

&

B.) Then watch it with javascript usage in your webbrowsers (meaning do NOT use it on "every site online under the sun", & ONLY on the sites you absolutely NEED javascript active for, for proper full function?

----

You CAN stay clean, & uninfected... &, even vs. THIS particular worm & its variants...

It's the fault of Microsoft for shipping OS in such a relatively unsecured state (&, it doesn't HAVE to be that way, because tools like SCW (server configuration wizard) exist in MS Windows variants, such as Windows Server 2003 for example, & it OUGHT to be run right after setup is completing... but, it's not, for example), &, the fault of the misguided fools that create these machinations...

I will say 1 thing in defense of the people that create malware in general (as I call it) - they ARE pointing out FUNDAMENTAL flaws that exist in default OS setups, but, that's about it, because their talents COULD be put to use elsewhere... but, as far as saying they are "talented" in this "art & science"?

Hey - ANYONE can be bogus & destructive: It's "TOO EASY"... quite another to be creative for useful things, vs. creating virus & such, no questions asked...

APK

P.S.=>

"Do the world a favor. MAKE them care." - by v1 (525388) on Friday February 20, @08:10PM (#26937367) Homepage

Ah, "therein lies the rub"... lol!

Well, I agree, but... I don't *THINK* you can "make people care", until it strikes them personally... but, sooner or later, it usually does, costing them time, money, + aggravation to NO end - & IF folks don't get wind of this kind of info., or worse, don't care enough to APPLY it themselves (or, have a fairly computer + networking saavy person do it FOR them instead)? They keep guys who are in this field, PAID... sometimes?

Sometimes, I suspect it's actually guys in this field who are @ the heart of all this, because of my last statement - it creates a self-serving economy for them to profit by... how sad, IF I am correct on this note - but, face it: You cannot go "just whipping this stuff up", because yes, even MALWARES take some work to create + implement (thus, one HAS to assume they are pros, or were, @ some point in this field OR could be to some extent)... apk

Re:Meep Beep! (1, Funny)

Anonymous Coward | more than 5 years ago | (#26937973)

With all the suspense and the scale of infection, whatever the payload is going to be, it'd better be something totally awesome!

"The Rickroll To End All Rickrolls"

Re:Meep Beep! (0)

Anonymous Coward | more than 5 years ago | (#26938807)

With all the suspense and the scale of infection, whatever the payload is going to be, it'd better be something totally awesome!

Maybe they're planning a big comeback for Stoned [wikipedia.org] - to happen around 4/20, of course.

Re:Meep Beep! (0)

Anonymous Coward | more than 5 years ago | (#26939905)

I long for the "big formatting day". One day some super-darkside hacker *shall* be smart and the mob (russian or whatever) *shall* try to screw him and he'll fight back. He'll be pissed off (or maybe he'll just win some mega-lottery). In any case, at one point some super-darkside hacker shall have no incentive to use his 100 millions Winboxes botnet to send spam or anything. He'll lose interest and start the "big formatting day". 100 millions Winboxes wiped clean. No nothing on it. A clean hard disk.

That's going to be wild.

Next day you'll see adds "on xx.xx.2011, 15% of Windows machine suddenly stopped worked. On xx.xx.2011, 99.9% of Un*x computers kept working correctly. You decide".

But please, Windows fanbois, bring the monocrop fallacy etc.

Re:Meep Beep! (0)

Anonymous Coward | more than 5 years ago | (#26940245)

Next day you'll see adds "on xx.xx.2011, 15% of Windows machine suddenly stopped worked. On xx.xx.2011, 99.9% of Un*x computers kept working correctly. You decide".

No, we won't. Ads cost money, and nobody wants to spend money promoting something they have to give away for free.

The only reason Mozilla got an advert up is to push Google ad hits.

Re:Meep Beep! (1)

theMoleofProduction (842123) | more than 5 years ago | (#26937093)

Oh why don't you malware like you used to do?
Spread Conficker like you used to spew?
I haven't patched my OS since two-thousand-two,
Why don't you malware like you used to do?

Ain't had no Clamwin, or a firewall, or an update in a long long whiiiiiiile.
Can't get to Google or WinUpdate cuz they've hijacked my gosh darn hosts fiiiiile.

Oh why don't you scan ports like you used to do?
Treat my pendrive like a prostitute?
Haven't BSoDed in a day or two,
So why don't you malware like you used to do?

Readable link (3, Informative)

Seth Kriticos (1227934) | more than 5 years ago | (#26936931)

Just in case someone really wants to read TFA, here is a link to the more eye friendly version (printer version): http://www.computerworld.com/action/article.do?command=printArticleBasic&taxonomyName=Network+Security&articleId=9128280&taxonomyId=142 [computerworld.com]

Ps. Just because there is a "Slashdot this article with maximum clutter" button, you don't have to inherently click on it.

It's depressing. (2, Insightful)

Anonymous Coward | more than 5 years ago | (#26937003)

That a vulnerability patched in October could become a problem.

Will it run on Linux? (2, Insightful)

erroneus (253617) | more than 5 years ago | (#26937045)

I'd seriously like to see some malware attacking Linux users. Ubuntu users might be a good target audience with good vulnerability and gullibility. But I would really like to see some attacks to see if Linux or its users are really so much better that Windows users. Further, I would like to see how much could be blocked and avoided.

Security isn't as much of a battle among common Linux users and frankly, I wonder how lax we generally are.

Re:Will it run on Linux? (1)

techno-vampire (666512) | more than 5 years ago | (#26937121)

Security isn't as much of a battle among common Linux users and frankly, I wonder how lax we generally are.

The big problem, I think, would be the fact that most Linux users only install software from their distro's repositories. Most of them don't know how to unpack a tarball, go in with a terminal and use ./configure, make, make install. Unless you can slip something in by having a time delay before it activates, I really don't see how you're going to get much penetration. Not saying it can't be done, just that it's not going to be easy.

Re:Will it run on Linux? (1)

Logic Worshiper (1480539) | more than 5 years ago | (#26937227)

yum, rpm, sh and deb files are all Linux executables (depending what on what distro you use) and are all potentially dangerous. Mac is a much bigger target, but they don't even go after that. It's just easier to go after Windows because Windows provides the largest amount of infectable machines, and it's easier to write malware for it.

Re:Will it run on Linux? (1)

Sir_Lewk (967686) | more than 5 years ago | (#26937413)

You seem a little confused. Yum is a package manager, used primarily by redhat based distros. It *is* an executable, however there is not much to exploit, you don't "download and install a yum". Similarly, rpm is a program that is located on the host machine already. Alternatively you may have been refering to RPM packages which are not in fact executables but rather packages which rpm (the program previously mentioned) uses to install software. You could package malicious software in an RPM and have the user install it, though I must say that would be an impressive bit of social engineering, requiring the user to not only know what they are doing, but to not know enough to know better. Deb files are similar to RPM files (ie, not exectubles). "sh" as you call it, otherwise know as shell scripts, are in fact executables and would be the method I'd expect malware for linux to be spread. However, shell scripts are interpreted (by the shell, think batch files in windows/dos) and are thus easily inspected.

Truthfully though, I think the greatest defense linux users have against malware is the community aspect that has grown up around it. The community contains enough advanced users to recognize and identify any threats and average linux users are unlikely to run/install things they come across on their own.

Re:Will it run on Linux? (1)

arth1 (260657) | more than 5 years ago | (#26937561)

Yum is a package manager, used primarily by redhat based distros. It *is* an executable,

Except that it is not. It is a python source code file. When you "execute" it, your system reads the shebang on the first line, and calls python with yum as an argument.

Re:Will it run on Linux? (0)

Anonymous Coward | more than 5 years ago | (#26937823)

So you're saying it's an executable. Good. Glad we got that cleared up.

Re:Will it run on Linux? (1)

Sir_Lewk (967686) | more than 5 years ago | (#26938277)

It may not be compiled machine code, but it IS an executable. Check to see that it has the executable bit set yourself.

Re:Will it run on Linux? (1)

arth1 (260657) | more than 5 years ago | (#26938609)

Setting the executable bit on a file doesn't transform it into an executable. Try setting the execute bit on /etc/resolv.conf and see what that does.

If you add "#!/bin/tail +2" to the top of /etc/hosts, and chmod +x it, you can call it, and it will print out itself. That doesn't mean it's an executable. tail is the executable.
Likewise with yum, where python is the executable -- yum is the source file that python compiles, transparently to the user, when he types in "yum".

Re:Will it run on Linux? (1)

Sir_Lewk (967686) | more than 5 years ago | (#26938759)

If you really want to be pedantic, then yes, Python is an interpreted programming language and a python program is not, for example, an ELF file. However, for the scope of this conversation explaining the difference between RPMs and yum, the presense of an exectutable bit and pythons interpreted nature make it perfectly reasonable to call them executables. In fact, it is not at all uncommon to refer to scripts as executables in nearly any situation. All of this is irrelevant to the topic at hand though and I suggest you attempt removing the stick from your ass.

Re:Will it run on Linux? (1)

smoker2 (750216) | more than 5 years ago | (#26939767)

You ought to read your own sig.

Re:Will it run on Linux? (1)

Sir_Lewk (967686) | more than 5 years ago | (#26942427)

What a superb rebuttal! Truly now I see the error in my logic, thank you for your great insight.

Re:Will it run on Linux? (1)

dotgain (630123) | more than 5 years ago | (#26939311)

Jeez, I sure hope all your pointless hair-splitting and knowledge-spewing made your dick bigger, because it sure added NOTHING to the discussion.

Re:Will it run on Linux? (1)

Darkk (1296127) | more than 5 years ago | (#26938181)

What I do like the fact the .deb files via updates are signed by a trusted authority. Every once in awhile I would get an update saying this package can't be authenticated and asked me if I want to continue with the update. I usually say no unless I can actually trust the source.

Only time I ran into this is updating Open Office 3.0

Re:Will it run on Linux? (1)

arminw (717974) | more than 5 years ago | (#26938379)

... and average linux users are unlikely to run/install things they come across on their own...

And that is also the reason why Linux will always be a beloved geek operating system that is too complicated for ordinary users. All programs are harder to install and get working properly, which fortunately also includes viruses and worms.

Re:Will it run on Linux? (0)

Anonymous Coward | more than 5 years ago | (#26938541)

Programs not in the repositories can be more difficult to install.

But if there's a deb, rpm, or whatever prepared for your distro, you can just double-click on it just like in windows. It's still a little bit harder (you have to select the correct package*) but it's not so bad as to be a real obstacle if the application writers were the least bit prepared.

*or one that's close enough for the package manager to know how to translate it.

Re:Will it run on Linux? (1)

scientus (1357317) | more than 5 years ago | (#26938045)

thats wrong, rpm and deb are not executables and all require a root password to install and do anything at all. They are just compressed packages of files.

sh files require +x

Re:Will it run on Linux? (1)

icannotthinkofaname (1480543) | more than 5 years ago | (#26937331)

I don't think that tarballs aren that big a deal. I've been running Ubuntu since around New Year's '09 or so, as my first exploration of the Linux world. I broke away from Windows because (a) I was bored of knowing my OS so well and (b) I've been looking for a balance between cheap and stable, and few things if any beat FOSS for that.

I quickly learned how to build a tarball, whether it's gzipped or bzipped, and I even had a couple of scripts to do it for me (lost them on a reinstall when I got Windows XP from a friend and failed to get grub back from a live disc, and I only keep Windows around because of my gaming addiction). I'll get around to re-writing those at some point and throwing them into /bin where they belong.

And if malware gets into my system, what's the worst that happens? I'm forced to reinstall my OS again? Gee, like I haven't wiped a hard disk before. >_> That'd be the other problem with attacking Linux systems: we probably don't care as much about whether we will have to reinstall it on a malicious attack, and we have probably been backing up important stuff anyway for a good long while now, too. In other words, we're not nearly the idiots that Windows users tend to be (and I have seen some real idiots somehow manage to use Windows; it's quite sad to watch, honestly).

Re:Will it run on Linux? (1)

bensafrickingenius (828123) | more than 5 years ago | (#26937457)

You've been using Ubuntu for a little over a month (an admitted Linux virgin prior to that), and now you figure you're expert enough to start bashing Windows users? Wow, are you running an Advanced Placement distro of Ubuntu?

Re:Will it run on Linux? (2, Insightful)

jadedoto (1242580) | more than 5 years ago | (#26938021)

Not all Ubuntu users are idiots when it comes to Linux. Someone had to create the distribution and someone has to maintain it. I use Ubuntu after years with Gentoo for the pure ease of how things work. And it's got a great community to help others ease into it. It's counter-productive to bash Ubuntu users. Really.

Re:Will it run on Linux? (1)

icannotthinkofaname (1480543) | more than 5 years ago | (#26938193)

Never said expert, dude. Said I could install tarballs, and said that I have seen some idiot Windows users.

I was running a Kubuntu live USB one day, and the guy next to me asked me where all the "stuff" was. When he motioned to the desktop, I realized that he mentioned the icons, which were present in the school's Windows stuff, but not my Kubuntu live session. Decided to leave it at "This isn't Windows." Was about three seconds away from flooding his ears with shit he would never understand.

I have been asked multiple times by the same guy how to save stuff to a flash drive and how to remove it. I swear, if I weren't paranoid of getting into school trouble, I would have smacked the guy the first time he asked.

Granted, community college isn't the best place to find computer-oriented people (I swear, I am working on getting back into CMU), but it does give nice support to the argument that Windows users can, in fact, be idiots. I could have bashed these morons without installing Linux just because Microsoft Windows became boring as a computer experience.

By the way, is there such a thing as an Advanced Placement distro of Ubuntu that I could run? Or are you just suggesting that I install Debian? I'd consider it for the massive learning experience that I imagine is available.

Re:Will it run on Linux? (1)

zippthorne (748122) | more than 5 years ago | (#26938553)

Yes. Download the Ubuntu Alternate Install CD.

It's not really any different once you've installed everything, but it's a text based installer with a lot more options. (full disk encryption, for one)

If you really want to impress the zealots, though, forget Ubuntu, and skip right past Gentoo and try your hand at LFS. (linux from scratch)

Re:Will it run on Linux? (1)

icannotthinkofaname (1480543) | more than 5 years ago | (#26941153)

Linux from scratch? Ooh, cool. I gotta work my way up to that.

Will do some Googling later.

Re:Will it run on Linux? (1)

techno-vampire (666512) | more than 5 years ago | (#26937501)

I don't think that tarballs aren that big a deal.

Neither do I, but then, we're probably not average Linux users. My sister's been using Ubuntu for over a year now. The other day, she had to download some better drivers for her printer. Even though the OEM's website gave complete instructions on how to install it, keystroke by keystroke, she still asked me to do it for her because she's never been comfortable with a CLI. If it's not in the Ubuntu repository and I'm not there to do the work, new software just doesn't get installed.

As far as reinstalling the OS goes, I dual-booted Windows/Linux for years before putting the childish toys of Gatesware behind me over a year ago. In all that time, I've had to reinstall because of mucking things up exactly twice, and I run Fedora, a geeky, unstable, constantly-changing distro. I don't even like restarting unless there's a kernel update; last time I did, I blew away over 23 days of uptime. If you're happy with nuking and reinstalling all the time, go for it. It's your box, not mine!

Re:Will it run on Linux? (0)

Anonymous Coward | more than 5 years ago | (#26938013)

I think there are more places for spyware to hide inside $HOME than you would care to think of. There are a bunch of files that are executed at times like when X starts, when your window manager starts, and when specific applications start. Would you know how to purge all those files, if one were modified to run a nasty program?

So reinstalling a system is not a great solution, unless you plan to delete all your own files. (And yes, you could restore your home directory from backups, but how do you know whether the backups are infected?)

Re:Will it run on Linux? (1)

icannotthinkofaname (1480543) | more than 5 years ago | (#26938231)

(And yes, you could restore your home directory from backups, but how do you know whether the backups are infected?)

Nice question. I bet if a solution had been found by now, it'd be as emphasized as possible for Windows users. If a solution were available, Conficker might have a harder time spreading through USB drives.

Or maybe I'm just an idiot and I don't think outside the box. Is there such a solution?

Re:Will it run on Linux? (0)

Anonymous Coward | more than 5 years ago | (#26938509)

There are a bunch of files that are executed at times like when X starts, when your window manager starts, and when specific applications start.

rm ./.* -rf
cp --no-preserve=ownership /etc/skel/* .

X or your desktop manager will rebuild whatever config files it needs, as will any programs that you run. You'll lose the existing configs and all your bookmarks, of course, but it doesn't matter because it was all suspicious anyway.

There is very little in those .files that you should bother backing up at all, and you have to exclude them from your backup script anyway or you'll be backing up a bunch of cache files (firefox's can be quite large...) that don't rdiff well, because they're cache files.

Re:Will it run on Linux? (1)

scientus (1357317) | more than 5 years ago | (#26938029)

all you need is a desktop file, and that can automatically then download a program, install to autostart with login and your golden., now since ubuntu does not set gksu to lock the screen you just ahve to snoop the sudo password and then you have root, baby, root. Its so stupid how non +x files will run

Re:Will it run on Linux? (0)

Anonymous Coward | more than 5 years ago | (#26937161)

Most of this crap is spread through bugs and holes in the Windows OS. Linux thankfully is not as crappy of an OS.

Not to mention the constantly nagging 'Windows Update' icon drives most people bonkers and they just keep hitting 'remind me later'. That is why things like Conficker run wild IMO.

Re:Will it run on Linux? (0)

Anonymous Coward | more than 5 years ago | (#26937397)

I wonder how much projects, particularly care about security!

I am worried that Windows world has improved in leaps and bounds mainly because so far they have been the most attractive target and that has forced them to change.

I get the impression that people think that just because you are running Linux you are magically protected from targeted attacks. A myth popularized by the "U foolz, M$ Windoze suxorz, install Linux" crowd.

We will start to see attacks as Linux gets more popular on the desktop. We should be prepaired. I don't want to see a Linux is not secure view among the normal users, just as Linux is getting popular on the desktop. Nor do I want my Linux machines to be compromised.

I hope the distros, if not the projects themselves take security seriously and have enough resources to throw at security.

~AC

Re:Will it run on Linux? (1)

flyingfsck (986395) | more than 5 years ago | (#26937531)

Hmm, actually there are a lot more Linux machines in the world than Windows - about 2.2 billion Linux vs 600 million Windows. Granted, most Linux machines are cell phones and routers, but when last have you herd of a virus infecting a router? Never? Thought so. The day when Cisco starts to build firewalls running Windows and Linux machines have to be hooked up behind dinky little Netgear or Linksys firewall devices running Windows, simply won't happen...

No Exploits for Routers? (0)

Anonymous Coward | more than 5 years ago | (#26937695)

I am pretty sure there are some exploits going around for some home firewall routers. Sorry I can't be bothered to look it up.

Besides there are probably quite a few for Cisco IOS platform.

~AC

Re:Will it run on Linux? (1)

scientus (1357317) | more than 5 years ago | (#26938067)

DCC SEND HAHAHAHAHAHAHAHAHA

URL Generation (1)

phantomcircuit (938963) | more than 5 years ago | (#26937139)

Basically the code now generates a random URL based on the date obtained from a remote server and then verifies any updates on the generated URL with RSA.

Seems sort of obvious

Forget antivirus, go after them for copyright (1, Funny)

Anonymous Coward | more than 5 years ago | (#26937379)

You know, like the feds used to take down the Mafia on tax violations.

http://sourceforge.net/projects/b-improved/ [sourceforge.net]

Holy shit! Another version? (2, Insightful)

icannotthinkofaname (1480543) | more than 5 years ago | (#26937407)

Awesome. This is the greatest piece of malware I've ever seen. Conficker has done an absolutely wonderful job of becoming a real, recognized, major threat, even worming its way into several government systems.

The fact that it's evolving to continue its journey into every computer it can find is quite impressive to me. I don't think I've ever heard of a malware threat this bad. Conficker's botnet is now measured in percentage of Windows machines infiltrated. When you get a significant percentage of computers like, say, 30% of 90% of the Desktop OS market (or whatever M$'s current stranglehold is worth), that's something to be proud of.

I haven't heard of this actually doing anything malicious yet, and judging from some comments here, it hasn't actually done anything yet. But whatever it does do (after it disables and resets all the preferences and whatnot), I bet it's completely epic and noteworthy and huge and stuff. There's no way something giant isn't going down when all is said and done.

I applaud the efforts of the programmers who wrote this quite beautiful program and set it loose in the wild. I look forward to more developments, both in the program and the fight against it, and I look forward to laughing my ass off as it infiltrates Windows system after Windows system, while remembering how recently I converted to Linux. :)

Re:Holy shit! Another version? (0)

Anonymous Coward | more than 5 years ago | (#26937529)

TROLL

Re:Holy shit! Another version? (0)

Anonymous Coward | more than 5 years ago | (#26939423)

He may be a troll but he kinda speaks the truth. Whoever wrote this thing knew what they were doing and they knew it well. This is easily the biggest threat to Windows in years and *could* result with the year of the Linux desktop coming along in the next 10 years (oh, one can hope).

Re:Holy shit! Another version? (1)

John Hasler (414242) | more than 5 years ago | (#26937555)

> I haven't heard of this actually doing anything malicious yet, and judging from some
> comments here, it hasn't actually done anything yet.

Hasn't yet done anything that we know of. Yet.

Re:Holy shit! Another version? (1)

RazzleDazzle (442937) | more than 5 years ago | (#26937951)

When you get a significant percentage of computers like, say, 30% of 90% of the Desktop OS market (or whatever M$'s current stranglehold is worth), that's something to be proud of.

Man, it's too bad Redmond has a 90% infection rate of all Desktop OS workstations (or whatever MS's current stranglehold is worth).

Re:Holy shit! Another version? (1)

Darkk (1296127) | more than 5 years ago | (#26938213)

Correction.. Windows been infected by people! So infection rate is 100%

Re:Holy shit! Another version? (0)

Anonymous Coward | more than 5 years ago | (#26939855)

This is probably the most pathetic post I have ever read. You're applauding criminal activity because of some tiny personal grudge you have against a corporation?

You need a change of priorities.

Re:Holy shit! Another version? (1)

icannotthinkofaname (1480543) | more than 5 years ago | (#26941269)

No, I'm not applauding criminal activity because of a grudge. I'm applauding it for how widespread the program is and how it just refuses to die. It ain't every day you find a program as impressive as this one. How often has a piece of malware evolved to perpetuate itself, let alone multiple times?

This is a great effort on the programmers' parts, whether or not it actually does anything malicious to Windows systems.

When I saw B++ (3, Funny)

kkrajewski (1459331) | more than 5 years ago | (#26937415)

I was all excited that someone had made an OO extention to the B programming language [wikipedia.org] . We can only imagine the horror!

If you're running as non-administrator.... (1)

klubar (591384) | more than 5 years ago | (#26937553)

If you're running as a non-adminstrator account (without write access to c:\windows (and system32) would this virus still proprogate? I've never quite understood why ordinary users have write access to system directories.

Re:If you're running as non-administrator.... (2, Insightful)

t_little (91171) | more than 5 years ago | (#26937691)

It's not a virus, it's a worm - it exploits bugs in automated OS services to run the code. There doesn't even need to be a user logged in for this to spread. (It also scans local networks for weak passwords and attempts to install itself via autorun on removable media) However, there is no fundamental reason why those services should run with permission to install anything either.

Re:If you're running as non-administrator.... (0)

Anonymous Coward | more than 5 years ago | (#26937693)

If you're running as a non-adminstrator account (without write access to c:\windows (and system32) would this virus still proprogate? I've never quite understood why ordinary users have write access to system directories.

Because it is the default setting.

Re:If you're running as non-administrator.... (2, Interesting)

dbIII (701233) | more than 5 years ago | (#26937721)

As an example, the only reason some of the computers run MS Windows XP in my workplace is because some idiot wrote an in-house application under some bastard son of VB which needs write access to the root of the C: drive. To run this single user at a time database application the user needs to run as administrator. There are a lot of idiots doing such things.

While it's possible to make large mistakes with open software the majority of idiots are on the descendants of VB - however I have one python developer that has to turn off one core of his laptop to make his scripts run! Multi-cpu systems are so mainstream that there are even two processors in handheld nintento games yet developers write code that would be inadvisable in 1995!

To sum up - the reason people run as administrator is due to very poor software development and the stupid basket weaving approach we use to write most code instead of seeing things as projects.

Re:If you're running as non-administrator.... (1)

tweak13 (1171627) | more than 5 years ago | (#26938219)

I have one python developer that has to turn off one core of his laptop to make his scripts run!

Excuse my software development ignorance, but how the hell is he doing that? Breaking his code on multiple processors, I mean.

Re:If you're running as non-administrator.... (2, Interesting)

dbIII (701233) | more than 5 years ago | (#26938751)

Somehow the 1960s problem of race conditions gets him if he has more than one processor running. I really do not understand how it can be so broken, but that is why he is insisiting on turning off the second CPU in the BIOS on the machines that use his stuff (ie. he doesn't get his software on the production cluster and waste 7 CPUs per node - he gets told to piss off and read a textbook).

As for the .net problem, it's a case of the configuration file for the application getting written the root of the system drive! It's a flat file database implemented poorly and among other wonders it has a lockfile in case two people are using it at the same time to prevent corruption. I really do not know why the programmer didn't look at one of the thousand examples of simple data handling done well, but it's basket weaving not engineering.

The annoying thing is some people were migrated from linux to XP with an X windows program just to use this in house bit of rubbish that requires ringing around to see who has locked the file before they can even use it. It is the only MS Windows specific application they use - thunderbird, firefox, openoffice etc is all cross platform and the majority of their work is done on a linux cluster which requires X Windows anyway (add $500 more after XP to use that).

Back to Basics (1)

Gazzonyx (982402) | more than 5 years ago | (#26940175)

FWIW, you should give your python dev. a book and revoke his IDE until he can come back to you with a solution for setting the CPU affinity of his code. Pencil and paper coding is For His Own Good(TM) and everyone needs to go back to the basics (sometimes even BASIC) from time to time. It also builds character.

It gives you better perspective when you have a: problem, good book, pencil, paper, and no distractions/crutches. I know I need to do this from time to time (whiteboard, diagram, pseudocode, and a good reference for the language I'm using), when I'm spinning my wheels or neglecting good practices.

Stop SERVER service (for standalones) & javasc (0)

Anonymous Coward | more than 5 years ago | (#26942327)

Hey, don't want this in your systems?

Well - it's relatively EASY to stall these "botmasters" (destructive script kiddies is more like it) from doing that... via VERY simple measures no less!

(Simply IF you can read english & apply what is noted here to secure yourself (1-2 hrs. of work for YEARS of uptime, stability, & bugfree operation)):

----

HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA, plus make it "fun-to-do", via CIS Tool Guidance, & beyond:

http://www.tcmagazine.com/forums/index.php?s=e692b654cf47859bebf9e4380bec3a03&showtopic=2662 [tcmagazine.com] [tcmagazine.com]

----

E.G. (per said article's points for securing a Windows based OS) ->:

A.) IF you just simply "smarten up", & disable the SERVER service, which MOST folks w/ a single home system & no LAN around do NOT even need (which this worm exploits a bug in), because you generally (as an end-user on a single machine online via the internet only & NO home or work LAN/WAN connectivity needed) to waste CPU cycles, memory, & other forms of I/O server service needs (for sharing files/folders/printers etc. et al), for 1 thing

&

B.) Then watch it with javascript usage in your webbrowsers (meaning do NOT use it on "every site online under the sun", & ONLY on the sites you absolutely NEED javascript active for, for proper full function?

You CAN stay clean, & uninfected... &, even vs. THIS particular worm & its variants...

APK

P.S.=> It's the fault of Microsoft for shipping OS in such a relatively unsecured state (&, it doesn't HAVE to be that way, because tools like SCW (server configuration wizard) exist in MS Windows variants, such as Windows Server 2003 for example, & it OUGHT to be run right after setup is completing... but, it's not, for example), &, the fault of the misguided fools that create these machinations...

I will say 1 thing in defense of the people that create malware in general (as I call it) - they ARE pointing out FUNDAMENTAL flaws that exist in default OS setups, but, that's about it, because their talents COULD be put to use elsewhere... but, as far as saying they are "talented" in this "art & science"?

Hey - ANYONE can be bogus & destructive: It's "TOO EASY"... quite another to be creative for useful things, vs. creating virus & such, no questions asked... apk

Where is the real infection info? (1)

Jartan (219704) | more than 5 years ago | (#26938961)

The more I hear about this worm the more I'm confused that I'm not seeing it on certain computers I know must of been unpatched.

I've looked for info on how it spreads but the only thing I can ever find is that it uses an RPC exploit and that having print and file sharing on makes you vulnerable.

Is it being blocked by some routers that block file and printer sharing ports perhaps?

Re:Where is the real infection info? HOW TO STOPIT (0)

Anonymous Coward | more than 5 years ago | (#26942531)

Hey, don't want this "Conficker" worm in your systems (patched OR unpatched even)?

Simple : Because it's relatively EASY to stall these "botmasters" (destructive script kiddies is more like it) from doing that... via VERY simple measures no less!

(Simply IF you can read english & apply what is noted here to secure yourself (1-2 hrs. of work for YEARS of uptime, stability, & bugfree operation)):

----

HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA, plus make it "fun-to-do", via CIS Tool Guidance, & beyond:

http://www.tcmagazine.com/forums/index.php?s=e692b654cf47859bebf9e4380bec3a03&showtopic=2662 [tcmagazine.com] [tcmagazine.com] [tcmagazine.com]

----

E.G. (per said article's points for securing a Windows based OS) ->:

A.) IF you just simply "smarten up", & disable the SERVER service, which MOST folks w/ a single home system & no LAN around do NOT even need (which this worm exploits a bug in), because you generally (as an end-user on a single machine online via the internet only & NO home or work LAN/WAN connectivity needed) to waste CPU cycles, memory, & other forms of I/O server service needs (for sharing files/folders/printers etc. et al), for 1 thing

&

B.) Then watch it with javascript usage in your webbrowsers (meaning do NOT use it on "every site online under the sun", & ONLY on the sites you absolutely NEED javascript active for, for proper full function?

You CAN stay clean, & uninfected... &, even vs. THIS particular worm & its variants...

APK

P.S.=> It's the fault of Microsoft for shipping OS in such a relatively unsecured state (&, it doesn't HAVE to be that way, because tools like SCW (server configuration wizard) exist in MS Windows variants, such as Windows Server 2003 for example, & it OUGHT to be run right after setup is completing... but, it's not, for example), &, the fault of the misguided fools that create these machinations...

I will say 1 thing in defense of the people that create malware in general (as I call it) - they ARE pointing out FUNDAMENTAL flaws that exist in default OS setups, but, that's about it, because their talents COULD be put to use elsewhere... but, as far as saying they are "talented" in this "art & science"?

Hey - ANYONE can be bogus & destructive: It's "TOO EASY"... quite another to be creative for useful things, vs. creating virus & such, no questions asked... apk

The next version will be even more harmful!!! (1)

master_p (608214) | more than 5 years ago | (#26940489)

The next version will be...

C++!!!

And it will be considered harmful!!! :-)

future analysis? (0)

Anonymous Coward | more than 5 years ago | (#26941777)

The SRI report begins the second paragraph with "Early accounts of the exploit used by Conficker arose in September of 2009. "

Looks like their way ahead of the game, no?

oh. wait: it's just time travel stuff. nevermind.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...