As has been posted on others sites, tonight at midnight, UTC, the Conficker computer virus is due to start executing. What is Conficker? It's a computer virus. Here's what Wikipedia has to say:
Conficker, also known as Downup, Downadup and Kido, is a computer worm that surfaced in October 2008 and targets the Microsoft Windows operating system. The worm exploits a previously patched vulnerability in the Windows Server service used by Windows 2000, Windows XP, Windows Vista, Windows Server 2003, Windows Server 2008, Windows 7 Beta, and Windows Server 2008 R2 Beta. The worm has been unusually difficult for network operators and law enforcement to counter because of its combined use of advanced malware techniques.
What is going to be the payoff of Conficker? Well, it's a little hard to tell. Pandalabs downplays its potential impact:
Conficker is a malware that creates random URLs everyday and the PCs infected with it check if there is any new available version to download. It does so 250 times a day. What will happen then on April 1st? The last variant creates 50,000 new URLs. We can’t know if any of them will host an update of the malware, its author could host a new version or even some other type of malware. Another question posed is if it’s really more dangerous than other types of malware. The answer is no, it’s not more dangerous, though its update functionality leaves a door open to new attacks that could be more dangerous. Its success lies in having exploited a recent MS vulnerability to distribute itself, and that’s why, it has reached many PCs.
Conficker is a malware that creates random URLs everyday and the PCs infected with it check if there is any new available version to download. It does so 250 times a day. What will happen then on April 1st? The last variant creates 50,000 new URLs. We can’t know if any of them will host an update of the malware, its author could host a new version or even some other type of malware.
Another question posed is if it’s really more dangerous than other types of malware. The answer is no, it’s not more dangerous, though its update functionality leaves a door open to new attacks that could be more dangerous. Its success lies in having exploited a recent MS vulnerability to distribute itself, and that’s why, it has reached many PCs.
Finally, an article on CNN illustrates its probable motive:
The program could delete all of the files on a person's computer, use zombie PCs -- those controlled by a master -- to overwhelm and shut down Web sites or monitor a person's keyboard strokes to collect private information like passwords or bank account information, experts said. More likely, though, the virus may try to get computer users to buy fake software or spend money on other phony products. Experts said computer hackers largely have moved away from showboating and causing random trouble. They now usually try to make money off their viral programs
The program could delete all of the files on a person's computer, use zombie PCs -- those controlled by a master -- to overwhelm and shut down Web sites or monitor a person's keyboard strokes to collect private information like passwords or bank account information, experts said.
More likely, though, the virus may try to get computer users to buy fake software or spend money on other phony products.
Experts said computer hackers largely have moved away from showboating and causing random trouble. They now usually try to make money off their viral programs
That's what I tend to lean towards. If the last variant of the virus created 50,000 URLs per day, then what could these URLs be used for? I can think of two likely possibilities.
Those would be my guesses as the most likely outcomes of this virus. Whether or not anything actually comes to fruition is still to be seen, but for now, the amount of media attention this is getting should make it a little easier to contain and defend against.
PingBack from http://www.softophile.com/terry-zinks-anti-spam-blog-whither-conficker/