Common Tasks

Recent Posts

Community

Email Notifications

Personal Links

Archives

Security Protection - Harry Waldron (CS)

Security Best Practices, Breaking News, & Updates

New Conficker variant emerges

 

Some security firms have labeled this as B++, as it a minor variation of "B" designed to work around controls associated with DNS

New Conficker variant emerges
http://blogs.pcmag.com/securitywatch/2009/02/confickerb_aka_c.php
http://www.pcadvisor.co.uk/news/index.cfm?newsid=111098
http://mtc.sri.com/Conficker/
http://blogs.technet.com/mmpc/archive/2009/02/20/updated-conficker-functionality.aspx

QUOTE: The new technique in B++ allows bots to pull and verify signed executables from a URL provided by a remote agent A second new technique uses named pipes to pull the executables; this is a technique that probably can't work out to the Internet generally, but only inside a firewall.

The SRI report says, clearly the Conficker authors are trying to get around the DNS changes limiting their distribution capability, but it remains to be seen if B++ will do that. To quote the Microsoft report "this change may allow the author to distribute malware to machines infected with this new variant...However, there doesn't appear to be an easy way for the authors to upgrade the existing Conficker network to the new variant."

What should you do? What you always should have done: Apply security updates to all systems (especially, in this case, Windows XP and earlier systems), use a firewall and anti-malware software and keep them updated.