NIST IT Security: Conflicker Worm - April Fools Day Likely To Make Fools Out Of Us Either Way

NIST Site Search

Product Research

Advertise on this site

Headlines

US-CERT Current Activity

»	Insecure Loading of Dynamic Link Libraries in Windows Applications
»	VMware Releases Updates for ESX Service Console Packages
»	Cisco Releases Security Advisory for IOS XR Software Border Gateway Protocol
»	RealNetworks Releases Update to Address Vulnerabilities in RealPlayer
»	Cisco Releases Advisories for Unified Communications Manager and Unified Presence
»	APWG Fax Back Phishing Education Program
»	Adobe Releases Security Bulletin for Shockwave Player
»	Apple Releases Security Update 2010-005
»	Microsoft Releases Security Advisory
»	VideoLAN Releases a Security Advisory for VLC Media Player

Date published: not known
Details

DOE-CIRC Updates

»	T-430: Apple QuickTime Flaw in QTPlugin.ocx ActiveX Control Lets Remote Users Execute Arbitrary Code Apple QuickTime Flaw in QTPlugin.ocx ActiveX Control Lets Remote Users Execute Arbitrary Code
»	T-429: WaspTime MS-SQL Database instance with blank password for sa account WaspTime MS-SQL Database instance with blank password for sa account
»	T-428: Vulnerability in Help and Support Center Vulnerability in Help and Support Center
»	T-427: VMWare WebAccess Vulnerability VMWare WebAccess Vulnerability
»	T-426: Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability
»	T-425: Desktop Java running in web browsers Desktop Java running in web browsers
»	T-424: Windows TCP/IP Stack IcmpSendEcho2Ex() Bug Lets Local Users Deny Service Windows TCP/IP Stack IcmpSendEcho2Ex() Bug Lets Local Users Deny Service
»	T-423: Microsoft Security Advisory (2269637) - Insecure Library Loading Could Allow Remote Code Execution Microsoft Security Advisory (2269637) - Insecure Library Loading Could Allow Remote Code Execution
»	T-422: Adobe Flash Player and AIR (CVE-2010-2216) Unspecified Memory Corruption Vulnerability Adobe Flash Player and AIR (CVE-2010-2216) Unspecified Memory Corruption Vulnerability
»	T-421: Multiple CACTI Security Vulnerabilities Multiple CACTI Security Vulnerabilities
»	T-420: Microsoft Windows TCP/IP IPv6 Extension Header Remote Denial of Service Vulnerability Microsoft Windows TCP/IP IPv6 Extension Header Remote Denial of Service Vulnerability
»	T-419: PHP 'ibase_gen_id()' Function off-by-one Buffer Overflow Vulnerability PHP 'ibase_gen_id()' Function off-by-one Buffer Overflow Vulnerability
»	T-418: Adobe Acrobat and Reader Font Parsing Remote Code Execution Vulnerability Adobe Acrobat and Reader Font Parsing Remote Code Execution Vulnerability
»	T-417: Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities
»	T-417: Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities

Date published: not known
Details

Virus Bulletin news

»	ARF published as IETF standard Abuse report format helps auto-handling of email complaints
»	Microsoft releases new fix for DLL vulnerability Earlier workaround believed to be too complex for most users.
»	Malicious tweets link to fake TweetDeck update Twitter resets passwords for accounts that appear to have been hacked.
»	94% of Internet users befriend unknown 'good-looking woman' Sensitiva data shared after two-hour chat.
»	Investment boost for Quick Heal Indian security firm gets hefty cash injection.
»	41% of spam sent via Rustock botnet Botnet spam back after short summer break.
»	Avast gets $100m investment boost Growth equity firm invests in Czech firm
»	Computer chip giant buys AV giant Intel becomes new owner of McAfee for the princely sum of $7.8bn
»	AV-Test.org issues latest round of testing results Symantec and Microsoft outdo Trend and McAfee in live tests.

Date published: not known
Details

DarkReading - All Stories

»	Networked Scanners Offer A Window Into The Enterprise, Researcher Says Emerging Web-based features make it possible to capture document contents remotely from networked sc ...
»	U.S. Businesses Could Lose Up To $1 Billion In Online Banking Fraud This Year Small- to midsized businesses taking the biggest hit, experts say, but consumer banking customers co ...
»	Product Watch: Verizon, VMware Team Up With Hybrid Cloud Service New Verizon service offers private public-cloud option
»	Could USB Flash Drives Be Your Enterprise's Weakest Link? The Pentagon last week conceded that a USB flash drive carried an attack program inside a classified ...
»	Delaware Contractor Mistakenly Posts Personal Data Of 22,000 Employees State of Delaware contractor Aon mistakenly posts personal data of 22,000 retirees without randomiza ...
»	IBM Corrects Unpatched Vulnerability Numbers After Google Challenge X-Force Team at IBM revises data on vendors with most unpatched bugs in recent IBM X-Force 2010 Mid- ...
»	Major Disruption of Pushdo Botnet Wasn't The Original Goal Botnet's spam traffic cut by 80 percent
»	China, Taiwan Nab 450 Suspects In Biggest Fraud Raid Ever Law enforcement authorities in China, Taiwan seize cash, fraud "manuals" from alleged tele ...
»	Four Best Practices For Tokenization Going beyond Visa's best practices guide

Date published: not known
Details

Conflicker Worm - April Fools Day Likely To Make Fools Out Of Us Either Way

The "Conflicker" worm is set to trigger on April 1st. This one is certainly getting a lot of press. If it goes off and causes a lot of harm everyone will look like fools for not taking it seriously. But if everyone spends tons of additional time and effort on detection and prevention and nothing happens you'll still look foolish. We've included links to basic prevention and removal information below.

What makes Conflicker more of a threat than many worms is that it does a fairly effective job of hiding its self from the most common antivirus programs and prevents computers from contacting antivirus websites. Once infected users will most likely be prevented from getting antivirus updates that might detect Conflicker. Prevention is key.

Here is what you can do to greatly lessen the threat from Conflicker:

Make sure your computer has MS Security Update MS08-067 applied. Going to Windows Update and installing everything available under the "Express" button should take care of it.
Ensure that your antivirus program is up to date and that the definition (or signature) files have been downloaded and applied.
If you have host based intrusion detection software (such as ZoneAlarm or Cisco Security Agent) make sure that its working and up to date. You can download the free ZoneAlarm version here. (Cisco Security Research and Operations has tested Cisco Security Agent (CSA) to verify that it prevents the malicious actions initiated by the worm and also active exploitation of the Microsoft Windows Server service RPC request handling code execution vulnerability. As a result, attempts to infects systems and to propagate using this method by the worm are mitigated. Based on the characteristics of the vulnerability, Cisco expects that Cisco Security Agent will prevent other similar exploitation attempts as well.)
Make sure you use strong Windows passwords on any administrator accounts. The worm tries to brute force admin passwords. Make sure you have a good password that includes numbers, special characters, and a mixture of upper and lower case letters.
Disable the Windows Autorun feature. US-CERT.GOV has instructions and links on how to do this. Correctly disabling Autorun blocks one of the methods Conflicker uses to spread and prevents several other worms from infecting your computer as well.

If you suspect a computer is infected with Conflicker run one or more of the removal tools (you can find a list at the SANS.ORG link below. One of the free online malware scanning tools should also be able to remove it. These have the advantage of being able to remove any other malware that may be on your computer or that Conflicker installed for you. If you do not have an up to date anti-virus program installed now is the time to install one, there are even some very good free anti-virus / anti-spyware programs available.

Microsoft Conflicker Information http://www.microsoft.com/conficker

The good people at SANS have done an excellent job of putting together a list of sites providing information and removal tools related to the Conflicker worm, you can find it at http://isc.sans.org/conficker.

SANS article: "April 1st - What Will Really Happen?"

F-Secure Questions and Answers: Conficker and April 1st

Conflicker Mainstream Media Reports - Frequently updated information but from a consumer news perspective.

Share or Bookmark this Article Using:
| furl | reddit | del.icio.us | magnoliacom | digg | newsvine | stumble it |

Posted by NIST.org on Monday 30 March 2009 - 21:21:27 | Read/Post Comment: 0 |