Wednesday, March 4, 2009

Conficker Scheduled to DDoS Southwest Airlines

So I'm sure everyone's heard of the Conficker/ Downadup.A/B/BB/B+/C etc etc worm by now, and if you haven't, here's a quick synopsis. This worm began to spread very quickly beginning a few months ago soon after Microsoft sent out a patch for what has become quite a popular vulnerability, at least in Conficker's author's eyes. The worm spreads in three ways, the first is by exploiting what was a weakness in Microsoft's Server Service RPC (Remote Procedure Call). This was the big one that Microsoft sent the patch for, but thanks to millions of people that don't utilize their automatic updates, this new botnet has grown to around 10 million strong. The second way it spreads is by attempting to Brute Force attack administrator passwords. This method is extremely inefficient, unless your password is something like "aaaa" or the like. The third way is by copying itself onto what ever removable media it can find, thumb drives, flash cards etc. The worm's ultimate goal is to takeover your computer and accept remote commands.
Once a computer is infected, one way it receives updates has proven to be rather creative. The worm generates pseudo-random domain names via it's onboard domain name generation algorithm. Each machine generates 250 seemingly random domain names on a daily basis to which each machine attempts to contact each one looking for commands. When the worm's authors need to issue a command to the botnet, they will simply register one of the domains that the worm is scheduled to contact, and be there waiting a couple of hours or so before the bots get there. If the bot connects to a domain that isn't issuing commands, it simply disconnects and moves on to the next one on the list. Once the good guys were able to reverse engineer this algorithm, they were granted a look into the future at every domain name that this worm will attempt to look for, and it only makes sense that some of these domains will have already been registered, legitimate domains. When they are, and 10 million PCs try to contact your domain at the exact same time, the result is a Distributed Denial of Service attack, or DD0S. Among the legitimate domains slated for a visit by Conficker are:
Music Search Engine - jogli.com on 8th of March
Southwest Airlines - wnsux.com on 13th of March
Women’s Net in Qinghai Province - qhflh.com on 18th of March
Phonetics by Computer - praat.org on 31th of March
I know that was a whole lot to say to make such a short point, but it had to be done.

0 comments: