February 27, 2009 By Casey Mayville
The criminals behind the widespread Conficker worm have released a new version of the malware that could signal a major shift in the way the worm operates.
The new variant, nicknamed Conficker B++, was reported by SRI International researchers, who published details of the new code on last week. At a quick glance, this variant resembles Conficker B. In particular, it is distributed as a Windows DLL file and is packed similarly. Initially, this new version was mistaken for the same worm in different packaging. However, upon further analysis, researchers found that out of 297 subroutines in Conficker B, only 3 were modified in Conficker B++ and around 39 new subroutines were added. Conficker B++ uses new techniques to download software, giving its creators more flexibility in what they can do with infected machines.
Conficker-infected machines could be used for sending spam, logging keystrokes or launching denial of service (DoS) attacks, but a group calling itself the Conficker Cabal has largely prevented this from happening. They've kept Conficker under control by cracking the algorithm the software uses to find one of thousands of rendezvous points on the Internet where it can look for new code. These rendezvous points use unique domain names, such as pwulrrog.org, that the Conficker Cabal has worked hard to register and keep out of the hands of the criminals.
The new B++ variant uses the same algorithm to look for rendezvous points, but it also gives the creators two new techniques that skip them altogether. That means that the Cabal's most successful technique could be bypassed.
Also known as Downadup, Conficker spreads using a variety of techniques. It exploits a dangerous Windows bug to attack computers on a local area network, and it can also spread via USB devices such as cameras or storage devices. All variants of Conficker have now infected about 10.5 million computers, according to an SRI International Technical Report.
Digital Communities members get access to our collaboration task forces
427 Members
77 Discussions
84 Files
Latest members Become a member
Digital Communities members get access to our collaboration task forces
669 Members
145 Discussions
150 Files
Latest members Become a member
Until recently, there was no alternative to the familiar desktop computer, and its expensive upgrades and maintenance requirements. For cash-strapped local governments, the desktop computer is quickly becoming an unsustainable option for future progress. Now, a technology known as virtual desktop infrastructure (VDI) offers an alternative. It can be significantly more affordable than buying individual computers for every employee, and it provides similar capability. This paper shows how VDI is the future of the desktop and is a game-changer for local governments.
Don't miss this opportunity to see the latest in digital government solutions, keep abreast of current policy issues and network with key government executives, technologists and industry specialists.
Digital Communities News In Your Inbox
Subscribe to Digital Communities
Digital Communities (DC) is e.Republic‘s local government program. The particular strength of DC is its focus on encouraging collaboration and creating productive relationships between and among cities, counties, regions and select private sector companies uniquely positioned to help improve the delivery of public services.
Subscribe | View Digital Issue