Attacks/Breaches

2/12/2009
02:34 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Microsoft Offers $250,000 Bounty For Worm Authors

The company has formed a cybersecurity posse with technology companies, academic organizations, and Internet infrastructure firms to dismantle the Conficker/Downadup worm's infrastructure.

Beset by malicious worms after failing to convince enough server administrators to take its out-of-band Security Bulletin, MS08-067, seriously, Microsoft is taking computer security to the streets: It has formed a cybersecurity posse to dismantle the Conficker/Downadup worm's infrastructure and has offered a $250,000 reward for information leading to the arrest and conviction of those responsible for the outbreak.

Microsoft warned last October that a vulnerability in its Server service could be exploited by a worm. Cybercriminals heard that warning and made the threat real, infecting as many as 9 million computers by mid-January. At that time, Qualys CTO Wolfgang Kandek estimated that between 25% and 30% of vulnerable systems remained unpatched.

And the problem continues more or less unabated today. Symantec said in the past five days it has seen an average of almost 500,000 infections per day with W32.Downadup.A and more than 1.7 million infections per day with W32.Downadup.B.

Jose Nazario, manager of security research for Arbor Networks, in a blog post on Thursday, called Conficker/Downadup a "savage Windows worm."

The total number of machines infected at any given time varies as a consequence of disinfection efforts. But rest assured that the number represents a very large botnet.

So it is that on Thursday, Microsoft announced a partnership with technology companies, academic organizations, and Internet infrastructure companies to fight the worm in the wild. Its partners in this worm hunt include ICANN, Neustar, VeriSign, CNNIC, Afilias, Public Internet Registry, Global Domains International, M1D Global, AOL, Symantec, F-Secure, ISC, researchers from Georgia Tech, Shadowserver Foundation, Arbor Networks, and Support Intelligence.

Together, the coalition is working to seize Internet domains associated with the worm.

"The best way to defeat potential botnets like Conficker/Downadup is by the security and domain name system communities working together," said Greg Rattray, ICANN's chief Internet security adviser, in a statement. "ICANN represents a community that's all about coordinating those kinds of efforts to keep the Internet globally secure and stable."

In a phone interview, Kevin Haley, director of security response at Symantec, said that there had been a lot of independent efforts to deal with the worm. The time was right, he said, to tackle it as a community.

According to Symantec, researchers have reverse-engineered the algorithm used to generate a daily list of 250 domains that the worm depends on to download updates. Armed with that knowledge, the coalition is taking control of the domains registered through coalition partners and using them to log and track infected systems. The group also is investigating domains overseen by registrars that aren't part of the coalition, though it's not clear how much leverage can be applied in such cases.

The worm won't be entirely stopped by such tactics; it also includes a peer-to-peer update mechanism. But it's a start.

Perhaps in recognition of the difficulty of getting help from registrars outside the coalition, particularly in countries with a tradition of tolerance for cybercrime, Microsoft said that residents of any country are eligible for its $250,000 reward. In many parts of the world, that kind of money will buy just about anything.

The last time the security community acted in unison like this was during the spring and summer of 2008, when several dozen companies and organizations came together to deal with the DNS vulnerability identified by security researcher Dan Kaminsky. But that was a bug fix rather than a worm-hunting posse.

Haley doesn't expect this sort of community policing of the Internet to happen more frequently, nor would he rule out further actions of this sort. "The groups that stepped in filled a void," he said. "As long as this is effective, we'll continue to look for opportunities."

This article was edited on 2/13 to correct the spelling of the Conficker/Downadup worm.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Cracking 2FA: How It's Done and How to Stay Safe
Kelly Sheridan, Staff Editor, Dark Reading,  5/17/2018
What Israel's Elite Defense Force Unit 8200 Can Teach Security about Diversity
Lital Asher-Dotan, Senior Director, Security Research and Content, Cybereason,  5/21/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Shhh!  They're watching... And you have a laptop?  
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10593
PUBLISHED: 2018-05-24
A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in data corrup...
CVE-2018-10595
PUBLISHED: 2018-05-24
A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in loss or corruption of data.
CVE-2018-11332
PUBLISHED: 2018-05-24
Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted site name to the manager/processors/save_settings.processor.php f...
CVE-2018-8013
PUBLISHED: 2018-05-24
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.
CVE-2017-17158
PUBLISHED: 2018-05-24
Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the versions before Prague-AL00CC00B223; the versions before Prague-L31C432B208; the versions before Prague-TL00AC01B223; the versions before Prag...