Mystery internet worm finally shows its hand

 

Gallery

Posted on 9 Apr 2009 at 12:00

A computer program that has been spreading across the internet has finally revealed its purpose. The Conficker worm, which has been infecting PCs since October 2008, has generated much interest because its ultimate purpose was not clear. Computer security experts believe that they have now discovered its primary motive, which is simply to create an enormous network of infected PCs.

Conficker was expected to do something interesting on April 1 2009, but that day passed without incident. More than a week later, security companies have discovered that the worm is no longer relying solely on its previous method of communicating with PCs, which was to generate thousands of random domains every day in the hope of connecting with a few dozen of them.

Questions are still being asked about what Conficker actually is, and how the criminals behind the worm will pull the trigger and cause it to perform some dramatic action. However, according to Trend Micro, they already have.

"You need to keep in mind that the endgame, for all intents and purposes, has already been achieved, which is the creation of a huge botnet. That's the endgame," said Rik Ferguson, senior security advisor at Trend Micro.

"What criminals want to use this botnet for is almost certainly is the generation of cash, so the question is how are they going to monetise their botnet? There's a huge botnet in existence that is being regularly updated, adding new functionality, building a P2P network and doing all kinds of clever things."

The new update means that the worm now connects to a server that is known to be used by the Waledac botnet. The botnet is seen as the successor to the infamous Storm botnet and security companies believe that the people behind these two botnets are also running Conficker.

Experts believe that they have located the Conficker update file and are currently analysing it. Visit the Conficker working group website to test if the worm is installed on your PC.

Author: Dawinderpal Sahota