Members
  • Total Members: 12816
  • Latest: t114563
Stats
  • Total Posts: 28525
  • Total Topics: 8240
  • Online Today: 833
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)












Author Topic: A Search Is Launched for Conficker's First Victim  (Read 2657 times)

0 Members and 1 Guest are viewing this topic.

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
A Search Is Launched for Conficker's First Victim
« on: 20. March 2009., 18:12:39 »


Where did the Conficker worm come from? Researchers at the University of Michigan are trying to find out, using a vast network of Internet sensors to track down the so-called "patient zero" of an outbreak that has infected more than 10 million computers to date.

The university uses so-called darknet sensors that were set up about six years ago in order to keep track of malicious activity. With funding from the U.S. Department of Homeland Security, computer scientists have banded together to share data collected from sensors around the world place sensors around the world.

"The goal is to get close enough so you can actually start mapping out how the spread started," said Jon Oberheide, a graduate student with the University of Michigan who is working on the project.

That's not an easy job. To find the minuscule clues that will identify the victim, researchers must sift through more than 50 terabytes of data, hoping to find the telltale signatures of a Conficker scan.

One of the ways that Conficker moves about is by scanning the network for other vulnerable computers, but it can be really hard to spot it for certain, Oberheide said. "The hard thing is to find the exact Conficker scanning activity, because there is a lot of other scanning going on," he said.

Tracking down patient zero has been done, however. In 2005, researchers tracked the 2004 Witty worm's first victim, (pdf) a U.S. military base, and even identified the European IP address used to launch the attack.

It's been years since anything as widespread as Conficker has surfaced however, so there have not been many chances to reproduce this effort.

When Conficker first appeared in October, though, researchers caught a break. Other worms had dodged this kind of analysis by blocking the darknet IP addresses, but Conficker's authors didn't do that. "We were kind of surprised that it did this completely random scan, and didn't blacklist our particular sensors," Oberheide said. "If they'd done a little bit of research, they could have discovered our [network]."

Soon after the Conficker outbreak the Michigan researchers saw a big spike on their sensors, which they attributed to the worm. The network was collecting about 2G of data per hour in November, but these days it's closer to 8G. "The increase in activity we've seen on these Darknet sensors is… incredible," Oberheide said. "Now this data is actually useful; we can go back six months and see what this worm was actually doing," he added.

Another group, called CAIDA (the Cooperative Association for Internet Data Analysis) publisheda Conficker analysis earlier this month. The Michigan researchers hope to post a similar analysis of their data in with the next few weeks, but it could be months before they narrow things down to patient zero.

In the meantime, "the goal is to get close enough so you can actually start mapping out how the spread started," Oberheide said.

(PC World)

Samker's Computer Forum - SCforum.info

A Search Is Launched for Conficker's First Victim
« on: 20. March 2009., 18:12:39 »




haz

  • SCF Advanced Member
  • ***
  • Posts: 117
  • KARMA: 26
  • Gender: Male
Re: A Search Is Launched for Conficker's First Victim
« Reply #1 on: 22. March 2009., 09:02:39 »
Good luck with that !
I really would like to know whatever they will discover about the origins and purposes of this virus..
Thanks

Liton

  • SCF Newbie
  • *
  • Posts: 1
  • KARMA: 0
Re: A Search Is Launched for Conficker's First Victim
« Reply #2 on: 25. March 2009., 07:52:48 »
I can not remove Conficker worm from my PC. I have used Stinger, MRT & my Mcafee DAT is 5559 but i can't. Some one help me

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
Re: A Search Is Launched for Conficker's First Victim
« Reply #3 on: 25. March 2009., 09:36:16 »
I can not remove Conficker worm from my PC. I have used Stinger, MRT & my Mcafee DAT is 5559 but i can't. Some one help me


Hi Liton,

don't worry we will help you just start your own topic related to this problem at SCF "PC Help Center": http://scforum.info/index.php/board,16.0.html

Regards,

Samker

 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising