http://news.cnet.com/8301-1009_3-10207375-83.html
By Elinor Mills
Security
CNet News
March 30, 2009
Even worm creators write buggy software.
Once it infects a computer, the Conficker worm closes the hole in
Windows that it used to get onto the system so no other malware can get
in. This also makes it difficult for organizations to detect which
computers have the legitimate Microsoft patch and which have the fake
Conficker patch.
However, Conficker's "patch" has a weakness that can be used to
distinguish between patched computers and infected computers that look
patched, according to the nonprofit Honeynet Project.
Some of the researchers have released a proof-of-concept scanner that
can be used to detect Conficker. The tool is being integrated into the
free nMap vulnerability scanner, as well as scanning tools from
companies including Qualys, nCircle, and Tenable. The tools are designed
for use by network administrators at companies and not consumer users.
"What we've found is pretty cool: Conficker actually changes what
Windows looks like on the network, and this change can be detected
remotely, anonymously, and very, very quickly. You can literally ask a
server if it's infected with Conficker, and it will tell you," Dan
Kaminsky, director of penetration testing at IOActive who worked with
The Honeynet Project, wrote on his blog. "We figured this out on Friday,
and got code put together for Monday. It's been one heck of a weekend."
[...]
|