Conficker worm aka skynet

[Modelworks]

Originally posted by: Blain

Originally posted by: Modelworks

Originally posted by: rasczak

Originally posted by: Modelworks
It worked as expected. It is trying to download from different sites. What it downloads nobody still does not know.

do you have a honeypot that you're monitoring atm? i'm actually curious enough to load it on my spare box.

Using nmap I'm watching an old p3-900 pc with winxp and no firewall or AV. Just to see what happens.

Is the XP "raw" or has it been updated since install?
MRT fixes lots of stuff.

No the XP is sp1. Not patched. I wanted to give it every chance to show what it can do .
So far it has only contacted about 12 sites in about 3 hours of running. Conficker is small though so it doesn't take much bandwidth to spread, its only 87KB.

 

[evident]

wow, this was the biggest crock of shit i've ever seen on the interwebs. my mom heard this crap on the news on her way to work, called my dad and told her to unplug the PC, so he comes in my room and wakes me up at like 5 inthe morning . WTF :|

 

[preslove]

Originally posted by: Modelworks

Originally posted by: Blain

Originally posted by: Modelworks

Originally posted by: rasczak

Originally posted by: Modelworks
It worked as expected. It is trying to download from different sites. What it downloads nobody still does not know.

do you have a honeypot that you're monitoring atm? i'm actually curious enough to load it on my spare box.

Using nmap I'm watching an old p3-900 pc with winxp and no firewall or AV. Just to see what happens.

Is the XP "raw" or has it been updated since install?
MRT fixes lots of stuff.

No the XP is sp1. Not patched. I wanted to give it every chance to show what it can do .
So far it has only contacted about 12 sites in about 3 hours of running. Conficker is small though so it doesn't take much bandwidth to spread, its only 87KB.

How are you quarantining that box from the rest of your network. Isn't Conficker really really contagious?

 

[BassBomb]

Originally posted by: preslove

Originally posted by: Modelworks

Originally posted by: Blain

Originally posted by: Modelworks

Originally posted by: rasczak

Originally posted by: Modelworks
It worked as expected. It is trying to download from different sites. What it downloads nobody still does not know.

do you have a honeypot that you're monitoring atm? i'm actually curious enough to load it on my spare box.

Using nmap I'm watching an old p3-900 pc with winxp and no firewall or AV. Just to see what happens.

Is the XP "raw" or has it been updated since install?
MRT fixes lots of stuff.

No the XP is sp1. Not patched. I wanted to give it every chance to show what it can do .
So far it has only contacted about 12 sites in about 3 hours of running. Conficker is small though so it doesn't take much bandwidth to spread, its only 87KB.

How are you quarantining that box from the rest of your network. Isn't Conficker really really contagious?

Disconnect his main pc from LAN?

 

[TruePaige]

Originally posted by: BassBomb

Originally posted by: preslove

Originally posted by: Modelworks

Originally posted by: Blain

Originally posted by: Modelworks

Originally posted by: rasczak

Originally posted by: Modelworks
It worked as expected. It is trying to download from different sites. What it downloads nobody still does not know.

do you have a honeypot that you're monitoring atm? i'm actually curious enough to load it on my spare box.

Using nmap I'm watching an old p3-900 pc with winxp and no firewall or AV. Just to see what happens.

Is the XP "raw" or has it been updated since install?
MRT fixes lots of stuff.

No the XP is sp1. Not patched. I wanted to give it every chance to show what it can do .
So far it has only contacted about 12 sites in about 3 hours of running. Conficker is small though so it doesn't take much bandwidth to spread, its only 87KB.

How are you quarantining that box from the rest of your network. Isn't Conficker really really contagious?

Disconnect his main pc from LAN?

Or just run properly patched systems on the rest of the LAN.

 

[Modelworks]

Originally posted by: TruePaige

Or just run properly patched systems on the rest of the LAN.

There is a box running fedora and a few other things , it is my router, between it and the internet so I can capture traffic and allow/disallow what it can/cannot do. Right now the infected box can't send or receive a packet without me seeing it.

 

[Acanthus]

As long as your PC is patched and has been scanned (in case you were infected before the patch) youre fine.

 

[Insomniator]

No issues at my work in the midst of migration from Symantec Antivirus to Endpoint 11.

 

[IceBergSLiM]

OH NOES!!!!!!!!!!!1111 WILL SOME1 PLEEZ SAV MAI INTARW3bz!@!!!!!!!

 

[sash1]

OMG MAI COMPUTER JUST EXPLODED FROM DA CONFICKER!

 

[KDOG]

Nothing here. My XP machine is fine. Of course it may not have actually "activated" yet.....also it may just be waiting for us to become complacent and forget about it in a week or so then SLAM!

 

[James Bond]

Nothing reported on any of our customers networks, yet. About 90% fully updated (with AV) - maybe a few hosts snuck by - still nothing though.

 

[ultimatebob]

Yep... that was a huge friggin disappointment!

 

[Goosemaster]

Originally posted by: Insomniator
No issues at my work in the midst of migration from Symantec Antivirus to Endpoint 11.

lol...

*waits for SEP is **** thread*

<---MR4 and afraid to go to MR4a LOL

 

[rasczak]

Originally posted by: Goosemaster

Originally posted by: Insomniator
No issues at my work in the midst of migration from Symantec Antivirus to Endpoint 11.

lol...

*waits for SEP is **** thread*

<---MR4 and afraid to go to MR4a LOL

SEP is shit.

 

[Saint Nick]

symantec endpoint?

R O F L

 

[sygyzy]

Can someone explain how Conflicker registers domain name? Do registrars like GoDaddy and Namecheap have API's that allow for bulk registration? How does Conflicker "pay" for these domains? And even if they are able to register them, how will they know which work.

Conficker generates a series of domain names from which it tries to download updates

Conficker.C tries to
evade this defensive approach by creating 50.000 domains per day, making pre-registration logistically challenging.

So first it registers a bunch of domain names (randomly) then it tries to contact them (again, randomly)? WTF? It might register aoepdp.cn successfully. What are the chances that when it generates a list of names to try to download from, it will hit on aoepdp.cn?

Also, registering a domain means nothing. Doesn't it also need hosting for the update files?

 

[randay]

that was a pretty elaborate april fools joke.

 

[threeringbinder]

Text

Anyone not pass the test?

 

[biggestmuff]

Originally posted by: sygyzy
Can someone explain how Conflicker registers domain name? Do registrars like GoDaddy and Namecheap have API's that allow for bulk registration? How does Conflicker "pay" for these domains? And even if they are able to register them, how will they know which work.

Conficker generates a series of domain names from which it tries to download updates

Conficker.C tries to
evade this defensive approach by creating 50.000 domains per day, making pre-registration logistically challenging.

So first it registers a bunch of domain names (randomly) then it tries to contact them (again, randomly)? WTF? It might register aoepdp.cn successfully. What are the chances that when it generates a list of names to try to download from, it will hit on aoepdp.cn?

Also, registering a domain means nothing. Doesn't it also need hosting for the update files?

The domains are from free dynamic DNS service such as dyndns.com. Namecheap.com has a free dynamic DNSS.

Here's an in-depth analysis I posted in another thread Text

 

[oogabooga]

Originally posted by: randay
that was a pretty elaborate april fools joke.

Well when the news gets involved, you know it's going to be.

 

[thescreensavers]

Originally posted by: threeringbinder
Text

Anyone not pass the test?

I am in the clear, I think its just an April Fools joke imo.

 

[Goosemaster]

Originally posted by: NightDarker
symantec endpoint?

R O F L

Originally posted by: rasczak

Originally posted by: Goosemaster

Originally posted by: Insomniator
No issues at my work in the midst of migration from Symantec Antivirus to Endpoint 11.

lol...

*waits for SEP is **** thread*

<---MR4 and afraid to go to MR4a LOL

SEP is shit.

STFU:frown:

 

[mrSHEiK124]

Originally posted by: Genx87
I thought Skynet was a counter to another virus? Meaning if this thing goes crazy the govt is supposed to unleash Skynet which then decides the best way to fix the problem is start a nuclear war.

If we're going by the lame T3 storyline, not entirely. Skynet itself was the virus that the government turned Skynet on to counter. It became aware way earlier and decided it "I want you guys to plug me in so I can fuck up your shit"

 

[rasczak]

Originally posted by: Goosemaster

Originally posted by: NightDarker
symantec endpoint?

R O F L

Originally posted by: rasczak

Originally posted by: Goosemaster

Originally posted by: Insomniator
No issues at my work in the midst of migration from Symantec Antivirus to Endpoint 11.

lol...

*waits for SEP is **** thread*

<---MR4 and afraid to go to MR4a LOL

SEP is shit.

STFU:frown:

you started it. i was simply giving you what you wanted