Despite a stream of updates and patches from Microsoft and the best efforts of security companies, the Conficker/Downadup worm has proven itself to be the most resilient and adaptable security threat to date. Perhaps it should be reclassified as a cyber cockroach.
The worm first appeared in November 2008, and has since propagated itself throughout the world. Currently it infects more than five million computers, according to the New York Times.
The worm operates by exploiting vulnerability in all releases of Windows to date, with more crafty versions appearing regularly. Depending on the version, once the worm is on a machine in stores itself in random files, and creates restore points and backdoors for reinfection, as well as watching and terminating any antiviral processes. By infecting removable storage devices, it then uses Window’s AutuRun Command to capture computers into which it is plugged.
Some versions of the worm can even create ad-hoc peer-to-peer networks, which then send and receive information over the internet. The ease and speed in which each successive version of the worm anticipates its own vulnerabilities has led many researchers to believe that Coficker’s authors have access to the anti-malware efforts of network operators and law enforcement.
The purpose of the worm is also allusive, and some researchers believe it is nothing more than ghost; others think that the intentions of the authors have not yet been revealed.
The creators of the worm are still unknown, but are believed to be operating from Ukraine. Microsoft is offering a $250,000 reward for information leading to their arrest and conviction.
Third-party anti-virus software have such as McAfee, Panda Security, Symantec Norton, Sophos, and Trend Micro have watched the malware’s evolution vigilently, and are able to detect and remove the worm.
