netdef ([info]netdef) wrote,
@ 2009-01-16 17:13:00
Previous Entry  Add to memories!  Tell a Friend  Next Entry
I told you so! Conficker Worm spreading ~ 10 Million computers in a week.
I always wanted a post title like that . . .

The Conficker Worm is making it's rounds and may very well become the most aggressive and fastest spreading malware in history with a truly nasty payload. I'm not going to count the Melissa Virus or the "I Love You" Virus of a few years ago, because as rampant as they were, their payload was relatively benign.

This new worm takes advantage of a multi-pronged attack to infect new victims. It's first intent is to create a new BotNet and "zombify" your computer. It's other mission is to steal passwords, personal info and account information in an attempt at mass identity theft.

It's using a vulnerability in Windows that was patched last month by Microsoft as the primary vector, then it attempts to use AutoRun on USB drives as well as a brute force Administrator account password hack once it gets inside a local area network.

So if you haven't yet, get patched completely to the most up to date versions you can, and turn off AutoRun on your clients and servers, and make sure all accounts on your systems that have Admin rights also have strong passwords. Even if you are using a home computer behind a firewall, make sure your account has a password.

More info here:
http://www.pcworld.com/article/157876/protecting_against_the_rampant_conficker_worm.html

(4 comments) - (Post a new comment)


[info]sacramentalist
2009-01-17 01:10 am UTC (link)
Do you know what ports the RPC calls come through?

I like to fetter the ports (25, 135-139, 445) for customers with potential infections, or people who are freshing installing windows. That way they don't get infected before they get their updates completed.

(Reply to this) (Thread)

[info]netdef
2009-01-17 03:10 am UTC (link)
According to my sources, most firewalls at default settings will block the worm from spreading via direct network connection - it's when the user visits a malicious site or opens an infected email or inserts an infected USB drive with AutoPlay active that infection takes place.

Once the worm is inside a network - behind the firewall - it attempts to infect other machines on the LAN by using the vulnerability in Windows (patched out of cycle in December) by opening a random port between port 1024 and 10000 to other IP addresses.

(Reply to this) (Parent)

[info]moosl
2009-01-17 07:04 am UTC (link)
... and make sure all accounts on your systems that have Admin rights also have strong passwords.

Do long passwords necessarily make for stronger passwords, assuming it's not a string of words found in a dictionary? For that matter, is there a place on the web you'd recommend for checking password strength?

(Reply to this) (Thread)

[info]netdef
2009-01-17 05:52 pm UTC (link)
Here is a fairly good description of password strength, as well as the use of so-called pass-phrases.

http://www.microsoft.com/protect/yourself/password/create.mspx

I personally like to use long pass-phrases on systems that support such. Most web sites don't, but the operating systems we use generally do . . . unless your client machine is joined to a domain and the admin has defined rules for passwords that don't "understand" pass-phrases.

(Reply to this) (Parent)

(4 comments) - (Post a new comment)

Create an Account
Forgot your login or password?
Login w/ OpenID
English • Español • Deutsch • Русский…