Conficker worm gets an upgrade

By

The Conficker worm, which infected large numbers of PCs last month, has received an upgrade which makes it much more effective.

The Conficker worm, which infected large numbers of PCs last month, has received an upgrade which makes it much more effective.


The new worm, dubbed Conficker B++, has been redesigned to get around attempts to shut it down. Previous variants checked for software update from a list of 250 randomly generated URLs.

However security companies managed to reverse engineer the algorithm that generated the URLs and design a way to block the software from updating. The new variant instead uses a new set of backdoors to update itself.

“We’ve discovered that the new variant no longer patches netapi32.dll against all attempts to exploit it. Instead it now checks for a specific pattern in the incoming shellcode and for a URL to an updated payload,” said Microsoft in an advisory.

“The payload only executes if it is successfully validated by the malware. However, there doesn’t appear to be an easy way for the authors to upgrade the existing Conficker network to the new variant.”

The author of the Conficker worm is still at large, despite a $250,000 bounty offered by Microsoft for information on his identity.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

Ex-student charged over Western Sydney University cyberattacks

Ex-student charged over Western Sydney University cyberattacks

International Criminal Court hit by cyber attack

International Criminal Court hit by cyber attack

Log In

  |  Forgot your password?