Case Conficker — Part 2

[zm0]

worm is very silenced, it does not flood or broadcast the network out. it send 10 connection requests in 10 minutes.. if that guy, or guys who wrote that worm would work for a security company, then we will all be safe.. or mabe not :)

[zm0]

or it is just a guy who is interested in security, and how he can trick out the scurity companys. the creator is a security interested guy who have a lot of knowledge. the code of the worm is nicely and Not dirty, you will never find that kind of worm cos it hooks to allready running dll's and encrypt every payload different. and the

[MSK120]

It seems like the guy who made this malware had the intension of creating a super botnet that he could use to take over the internet. Either that, or a nerd in a basement somewhere with too much free time that got pissed off at society.

[Hencytjo]

I'd say it should be death penalty for people developing viruses like this. It's almost like spreading aids, just that this doesn't kill you personally but it may kill your company and thereby ruining economics for a nation if the company is huge enough. It's a threat towards today's society and that makes it a crime against humanity. Death. Sounds harsh, but let's face it, if they make a virus this powerful and for personal gain, putting millions in danger, they are a threat forever. Period.

[xlive247]

what's the answer to this?? Linux!!!

[x99exe]

Linux is just as insecure as Windows, it's just such a small portion of people actually use it. If people used Linux instead of Windows, the same things would happen in Linux.

[xlive247]

Linux is a safer, smarter option though...

[x99exe]

Only because not very many people use it in relation to Windows.

[Younowkoed]

Why dont we just find teh guy then hold him at gun point and tell him to disable the virus

[billiejinman]

thats the problem. they are unalbe to bcause the hacker is too wel protected and has thought all about dat stuff and it would b nearly impossible to be able to find him by network ip's or other stuff like that

[Stefan1826MV2]

that's because his smart and knows a-lot! about pcs

[dinmamma333k]

Oh... well that's great. This is what you said yourselves (F-Secure): We take about 5-10 different adresses of those Conficker connects to from different places - possibly just with different words. How does that logically stop or slow it down in ANY way? Think about it this way... you take 5-10 different of those adresses from those PCs. Every PC generates about 250 adresses or more. Even if that number includes the 5-10 different adresses, the systems have 245-240 adresses to download from!

[dinmamma333k]

Oh wait... that was not all. Every PC doesn't just generate around 250 adresses - you said yourselves it does unique EVERYDAY. According to what you're saying, only the next day, it doesn't include the 5-10 adresses that you collected - and then it'd still have 245-240 adresses left to connect to and download files from, like I mentioned in the last post.

[tubelev]

they never said it was in any way usefull to stop it.

[dinmamma333k]

Oh yes, they tried to. Remember the "instead they connect to us" and stuff? They tried to sort of brag about it, that the numbers decreased and stuff, though not enough - even if I can't see any logic in that it would decrease at all, refering to my previous posts here.

[tubelev]

they only claimed taht they where able to get a certain percentage of the possible domains, in order to get an estimate amount of infections...

in short:

We got about 5% of possible domains, so the number of computers connection to us equals 5% of infected PCs.

that's what they said and you obviously could not get.

[dinmamma333k]

Thx for clearing that up, but you don't have to get rude and personal.

[BioQuartz]

What would YOU do with a botnet of 9+ million computers? Most are used to DDoS/send spam, but hell, 9 million?

[AggieBucks]

SCAM! brought to you by F-secure... THEY Created THE VIRUS! how i know, THEY CREATED THE ANTI VIRUS for sale?

[BioQuartz]

You're a fucking idiot.

[vermin089]

250 Domains ? Not anymore.. Variant C is creating 50000 domains ;)

[Gwydion415]

I am sort of surprised that these guys even used DNS...

There are much better methods of calling home.

[rwmtiger]

(o,O) you don't know how happy i not using wireless net card now. 3 to 4 week ago, we did have wireless net. wireless is too slow and see this video. wow! any way. i did make sure my 2 pc is safe. i did not find any warm. so i maybe in risk free. it is still too soon to say.

[General1329]

Maybe, maybe, we could shut down conficker admin by taking one of the websites, ping the admin and shut the computer down?

Sorry if i dont make sense im only 12

Yeah this would be a cool job

[AnAngryEmo]

There is over 50,000 website URLs and they update every day. When you 'ping' somebody it just sends a packet to them and see's if it comes back. Pinging can't do anything.

:(

[owebbero]

im going to go easy on ya and just tell you no

[parkourpeter112]

lmao good reply :P

[NickFreyMovieGuy]

Wow that is a fail. Even a 12 year old should know that that wouldn't work at all. Read and learn at AnAngryEmo's reply. If you feel like suggesting anything, make sure that you think about it for more than a few seconds first.

[BioQuartz]

You're a fucking idiot. Even if you not only pinged, but DDoS/DoS'd those domains, it wouldn't shutdown the guy/group who made Conficker.

Use some fucking common sense.

[ragnarokhead19000]

Hmmm what if the "heads" of the worm were watching these two vids? Well, they would probably be expecting this anyways...Some April Fools joke this is going to turn out to be D:

[buttersownsuall]

what if F-Secure MADE Conficker? It's ALL a huge cover up. I'm just kidding. I doubt they would do that. Thank you for the info.

[Kataroku]

How do you think anti-virus software companies stay in business?

[rollsthepaul]

Could it be that the inventor projected the response that would accompany the spread of this virus? Is he looking at the removal tool and planning to use it to further spread the virus? Is the initial spread, much like Microsoft improves software, you know, selling it incomplete and waiting for the complaints to return, so they can refine it? Will conficker 2.0 be new and improved, thanks to all of the field work of the defenders? Is this a bomb, being refined until it can shut down the world?

[drfreezepop]

USE THE DCOM RCP PATCH!!!

[hunhs]

Are there any worms that move with the usb stick between osx systems 10.4 tiger 10.5 leopard, mac market is growing, that worries mac users too, heard that leopard firewall had to be really unsecure im still sitting on my tiger. Thank you for the conference video.

[buttersownsuall]

as of now I think that the Mac isn't at risk, yet