Have agencies scrubbed the Conficker worm from their systems?

And if so, how?

A company that has been tracking the scanning activity of the prolific Conficker worm says that traffic from infected government systems has dropped off significantly in recent months, which could indicate a successful effort to remediate infections.

“We started to notice a decrease over the last two or three months,” said Rodney Joffe, senior vice president and technologist at Neustar Inc., a directory services provider that administers the domain name registry for the .US country code top level domain for the Commerce Department.

Joffe said that Conficker appeared to have been present in tens of thousands of government systems at its peak. “Now they are down to less than 40 systems in the entire U.S. federal network,” he said.

But a spokesman at the Homeland Security Department, which runs the U.S. Computer Emergency Readiness Team (US-CERT), said the worm never had been widespread. "There have been minimal indications of Conficker infections to the US Government thus far,” the spokesman said. “Departments have been taking the appropriate actions when infections are discovered.

DHS said that the removal was the result of an integrated defense in-depth strategy that includes partnerships between agencies, US-CERT, the Joint Analysis Coordination and Knowledge Exchange and the Botnet Threat Focus Cell within the National Cyber Investigative Joint Task Force. “We are not focusing on a single threat but all hazards,” the spokesman said. “This approach has dramatically helped us on Conficker."

Joffe, who also is director of the Conficker Working Group, said the apparently successful eradication of a worm that has proved to be surprisingly resilient for more than a year is good news.

“For the first time the government is taking the lead in a technical security issue, rather than lagging,” he said. “If they can do it, there is no excuse for other enterprises not to. It is obviously possible to remediate.”

Joffe said the working group hopes to have details of the government effort available for a “lessons learned” paper the group plans to publish in the coming months.

The worm, also known as W32.Downadup, has infected more than 10 million computers since its appearance in late 2008, and although the infected machines do not appear to have engaged in large scale malicious activity, the worm is troublesome because of its ability to update itself and morph into new forms. It also can disable security features of infected computers such as Windows Update and antivirus tools.

“It is incredibly robust,” Joffe said. “It doesn’t seem to get remediated successfully and there continue to be outbreaks.”

He said the worm has a good command of Windows internals and network layer traffic, and also has developed the unusual ability to download and execute code without rebooting the infected system, a feat that Joffe likened to changing the tires on a moving car.

The original W32.Downadup.A exploited only the MS08-067 vulnerability in Windows XP Service Pack 2 and Windows 2003 Service Pack 1 operating systems, for which Microsoft issued an unusual patch outside of its regular monthly patching cycle. A subsequent .B variant added password guessing and the ability to copy itself to USB drives to its bag of exploits, and a .C variant added an additional layer of protection.

The worm uses an algorithm to generate a pseudo-random list of domains for its command and control network, which its infected clients check daily for instructions. Security analysts said the .C variant uses a new algorithm to determine what domains to contact. It went from generating 500 domains a day to 50,000 domains with the new algorithm. Because a command and control server can be a weak spot whose elimination can disable a botnet, this could make Conficker more difficult to attack.

A later version, .E, uses peer-to-peer networking for command and control. “At that point we lost visibility into infected machines,” Joffe said. But an estimated 6.5 million machines remain infected by earlier versions that use daily call-ups that can be tracked. It is that traffic that indicates a federal clean-up, he said.

“We see the check-in every day,” he said. “It appears they have across the entire federal government been remediating Conficker. We’re pretty sure the federal government has done something no one else has.”

About the Author

William Jackson is a Maryland-based freelance writer.

Featured

  • Cybersecurity

    DHS floats 'collective defense' model for cybersecurity

    Homeland Security Secretary Kirstjen Nielsen wants her department to have a more direct role in defending the private sector and critical infrastructure entities from cyberthreats.

  • Defense
    Defense Secretary James Mattis testifies at an April 12 hearing of the House Armed Services Committee.

    Mattis: Cloud deal not tailored for Amazon

    On Capitol Hill, Defense Secretary Jim Mattis sought to quell "rumors" that the Pentagon's planned single-award cloud acquisition was designed with Amazon Web Services in mind.

  • Census
    shutterstock image

    2020 Census to include citizenship question

    The Department of Commerce is breaking with recent practice and restoring a question about respondent citizenship last used in 1950, despite being urged not to by former Census directors and outside experts.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.