Thursday, April 2, 2009

Conficker Worm, April 2nd Update

Ok, I'm still following this conficker worm story.  As I mentioned in the previous post, the worm did not disrupt the internet.  But it did "wake up" yesterday, becoming active as expected:


The worm was programmed to evolve on Wednesday to become harder to stop. It began doing just that when infected machines got cues, some from websites with Greenwich Mean Time and others based on local clocks.

The malicious software evolved from East to West, beginning in the first time zones to greet April Fools' Day.

Conficker had been programmed to reach out to 250 websites daily to download commands from its masters, but on Wednesday it began generating daily lists of 50,000 websites and reaching randomly 500 of those.
 -Quoted from Yahoo News. 

There are approximately two million computers infected.  But here's why things are so quiet: the worm hasn't been given any instructions.  Once instructed, it could cause these infected computers to act as "zombie" machines, sending out spam or overwhelming websites.  Whoever created the worm doesn't want to draw attention, since there is a 250,000 bounty for whoever can find the hacker responsible for conficker.

By the way, the Department of Homeland Security also has a tool for detecting the conficker worm.  You can find learn more about it here.