Nearly 9 Million PCs Hit By 'Downandup' Worm - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
Software // Operating Systems
News
1/16/2009
05:26 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Nearly 9 Million PCs Hit By 'Downandup' Worm

The network worm is a bunch of malware variants that target older Windows machines and changes itself, or is changed by its authors, to prevent signature-based detection.

A network worm has been spreading rapidly across the Internet over the past week, despite an emphatic warning from Microsoft last October.

In October, Microsoft took the unusual step of issuing an out-of-band Security Bulletin, MS08-067, for a vulnerability affecting its Server service.

"Because the vulnerability is potentially wormable on those older versions of Windows [XP and earlier], we're encouraging customers to test and deploy the update as soon as possible," said Christopher Budd, a Microsoft Security Response Center security program manager, in a blog post.

Microsoft's concerns have proven to be well founded. The MS08-067 Worm, also known as "Downadup" and "Conflicker," has been spreading like the plague.

"The number of Downandup infections are skyrocketing based on our calculations," F-Secure's Toni Kovunen said in a blog post Friday. "From an estimated 2.4 million infected machines to over 8.9 million during the last four days. That's just amazing."

"The situation with Downandup is not getting better," he added. "It's getting worse."

Strictly speaking, Downandup isn't just one worm -- it's a bunch of variants. Modern malware changes itself, or is changed by its authors, to prevent signature-based detection.

F-Secure began receiving reports about the Downandup worm in early January. The company's researchers observed that it used server-side polymorphism -- mutating code -- and ACL (access control list) modification to make network disinfection more difficult.

Plenty of malware makes use of local polymorphism, by randomizing the names of malicious files, for example. But Downandup uses randomized network paths for its command-and-control servers, making its control mechanism harder to shut down.

"This one is really an innovative one where it randomly generates these control channels and tries them out," said Wolfgang Kandek, CTO of Qualys.

The worm also takes steps to defend itself by disabling various Windows security, updating, and networking features. It blocks access to security-related domains on the Internet. And it modifies networking settings to speed up its ability to copy itself to other computers.

According to Kandek, the damage from the worm would have been much less had server administrators patched more quickly.

MS08-067 "was an out-of-band release," he said. "Microsoft said it was wormable. I think we could have avoided the extent of the damage if we had patched faster."

Typically, he said, only 50% of systems are patched 30 days after a patch is released. "Even now [for MS08-067], 25% to 30% remain unpatched," he said. "I recognize that people have to test patches, but this has to be taken seriously."

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Slideshows
10 Ways to Transition Traditional IT Talent to Cloud Talent
Lisa Morgan, Freelance Writer,  11/23/2020
News
What Comes Next for the COVID-19 Computing Consortium
Joao-Pierre S. Ruth, Senior Writer,  11/24/2020
News
Top 10 Data and Analytics Trends for 2021
Jessica Davis, Senior Editor, Enterprise Apps,  11/13/2020
White Papers
Register for InformationWeek Newsletters
Video
Current Issue
Why Chatbots Are So Popular Right Now
In this IT Trend Report, you will learn more about why chatbots are gaining traction within businesses, particularly while a pandemic is impacting the world.
Slideshows
Flash Poll