Information Technology-Information Sharing and Analysis Center
Conficker Bulletin
March 27, 2009
Summary:
Conficker is a worm, with A, B and C variants, which exploit unpatched systems, has defensive capabilities, and is set to “call home” on April 1, 2009. Members of the Conficker family employ a specially crafted remote procedure call to cause vulnerable Windows systems to execute arbitrary code as well as employing a few more mundane propagation methods. On April 1, the updated Command and Control (C&C) communication system in Conficker C is expected to activate. The identity, motives, and intent of the authors of the Conficker worm remain unknown.
Infected machines can be readily identified by network detection of the high peer-to-peer, P2P, UDP traffic on high numbered ports. Infected internal systems may be identified by this technique inside of security perimeters and firewalls even while similar traffic outside of firewalls remains excessively noisy.
Remediation actions are detailed below but include:
· First and foremost, unpatched systems must be patched as quickly as possible
· Identify, isolate, and clean infected machines
· Use an anti-virus product to remove W32/Conficker.worm from the system and network
· Take remediation before April 1, when the worm is expected to activate a new communications channel
Analysis:
Over the last several months, the Conficker worm family has grown into a massive malicious botnet arsenal and infrastructure of millions of compromised hosts. It is becoming increasingly difficult to contain this contagion after the fact and the threat of new versions with new tricks and unknown motives is looming.
While recognizing each company has its own patching policies and procedures, the IT-ISAC encourages their members, as well as companies of other critical infrastructure sectors, to patch their networks to address the unique nature of this vulnerability. Patching against vulnerabilities which this worm is exploiting remains the most effective control.
Infected systems are going to need to be disinfected and this family of malware has grown increasingly resistant and defensive against security tools. Users will need up-to-date anti-virus tools specifically equipped to deal with this threat or engage in technically difficult, manpower intensive, manual cleanups. Although some AV products can remove the malware, many infected systems in many situations are simply going to need to be wiped and reinstalled or reimaged to reliably remove any trace of this threat. As much as possible, this needs to be done before then next round up updates begins with a looming April 1 date to activate a new communications channel.
Background:
Early accounts of the exploit used by Conficker arose in September of 2008. Microsoft issued an out of cycle advisory on October 23, 2008 to repair the vulnerability and attempt to address the potential threat from the ongoing active exploitation in the wild. None the less, in November the first version of Conficker arose and began to scan and attack unpatched systems to exploit this vulnerability and infect millions of PCs worldwide. The exploit employed a specially crafted remote procedure call (RPC) over port 445/TCP to cause vulnerable systems to execute arbitrary code.
At this stage we are on the third generation of the W32/Conficker.worm. The first version of Conficker, Conficker-A, merely propagated by exploiting the MS08-067 RPC vulnerability. MS08-067 is an exploit similar to MS06-040, which was first seen a couple of years ago. Conficker-A attempted to download and install fake anti-virus software. The specific attack symptoms for the first generation (A) of the worm are as follows: Attacking port 445; HTTP server used to serve DLL to compromised machines; Rundll32.exe used to load DLL into running processes; and Uses different paths to SYSTEM32.
Conficker-B, while not attempting to install fake AV, added to the worm propagation vector, the ability to propagate over Netbios shares and through USB key propagation, common worm propagation techniques. Attempts by Conficker-B to propagate over Netbios shares by brute forcing network accounts have resulted in some account lockouts and network disruptions.
At that point, Conficker incorporated a command and control (C&C) rendezvous system where by infected systems would mathematically generate a list of 250 domain names it would attempt to contact for updates and further commands. Network infrastructure organizations collaborated on the analysis of the Conficker behavior and banded together into a Conficker Cabal to attempt to counter the C&C infrastructure. The specific attack symptoms for the second generation (B) of the worm are as follows: Attacks port 445; HTTP server used to serve DLL to compromised machines; Uses scheduled tasks to re-infect across network; Rundll32.exe used to load DLL into running processes; Network aware, uses network shares to re-infect; and Uses Autorun.inf files to re-infect/reload the worm.
Early on March 5, 2009, a new version of Conficker, Conficker C, was detected. Conficker C introduced an expanded C&C capability generating a list of 50,000 potential domain names, of which 500 would be contacted each day, when operational. It also implemented a P2P infrastructure by which infected hosts could act as P2P servers and aid in propagation of updates and remain in communications outside of the C&C communications structure.
Conficker C also sports a widely expanded defensive mechanism to protect itself. It disables a wide variety of anti-virus and security software as well as blocking download sites and update sources. The specific attack symptoms for the third generation (C) of the worm are as follows: Same as Conficker-B but includes: Escalates privileges and Terminates security and security related processes.
On April 1, 2009, the updated C&C communication system in Conficker C is expected to swing into action. At this time, the identity, motives, and intent of the authors of the Conficker worm remain unknown. When it becomes active, Conficker C could do nothing, or it could cause significant disruptions to the Internet infrastructure. It could also merely update itself, forcing us to confront Conficker D or a successor, with whatever new propagation techniques and exploits it brings along. This botnet could be used for money making schemes such as spam or phishing or used for some offensive purpose.
Due to the sophistication of the code and the development of this worm, it's generally felt that it is unlikely to be used for destructive purposes, which would be counter productive. It's as equally likely to do nothing as it is to run rampant and be disruptive. Updating to a newer version in a continuing effort of measure and counter measure as well as active money making schemes and other criminal activity seem more likely than either two extremes.
Actions:
Several things need to be done to mitigate this threat. First, if you are infected you may use Group Policies to stop Conficker.worm from spreading. Create a new policy that applies to all computers in a specific organizational unit (OU), site, or domain, as required in your environment. It is important to emphasize that these procedures will not remove the W32/Conficker.worm from the system or network. These procedures will only stop the spread of the malware. You should use an anti-virus product to remove W32/Conficker.worm from the system and network. Each anti-virus vendor will have their own procedures and recommendations associated to removing this exploit. Additionally, the IT-ISAC website (www.it-isac.org) will have information available for download provided by our anti-virus partners.
Each generation/variant thus far requires different cleaning techniques to remove the threat. Infected systems must be identified and cleaned up. Fortunately, there are ways to manually remove the latest version, and there are also removal tools available from several vendors such as Symantec, MacAfee, and others to help users clean their systems. Vulnerable systems must be patched to prevent (re)infection. The P2P network must be neutralized as well as the domain based C&C communication network. Lastly, restricting access to the SVCHOST registry key will be needed. This will restrict
permissions on the SVCHOST registry key so that it cannot be written to again.
Diagnostic and Recommendations:
Infected machines can be readily identified by network detection of the high P2P UDP traffic on high numbered ports. Infected internal systems may be identified by this technique behind firewalls. The level of P2P traffic already present outside of security perimeters reduces the effectiveness of identifying machines through network detection outside of those security perimeters.
First and foremost, unpatched systems must be patched as quickly as possible. Organizations with up to date antivirus tools may find that their AV products may effectively clean this infection and that may be the most effective course for them. However, the Conficker family of worms has incorporated extensive defensive mechanisms and a complete rebuild may be the only prudent course of action for a compromised system. Therefore companies may opt for manual removal if they have staff with the necessary technical expertise.
Many sites will likely opt for rebuilding to insure no lingering traces of the infection. Procedures for rebuilding systems, often through an “imaging” mechanism, must insure that newly installed systems are not vulnerable to this threat. Infected systems must be identified, isolated, and cleaned. If you don’t want to re-image all infected systems there are several “hacks” and specific cleaning procedures that can be used to fight the exploit, thereby avoiding a complete rebuild.
Some organizations, part of the Conficker Cabal, are proceeding with attempts to neutralize parts of the C&C communications structure. This is likely to continue to be insufficient, in and of itself, as the authors continue to adapt to the countermeasures.
Ongoing:
It is likely that new Conficker variants will appear with new tricks. Information sharing is essential to contain this threat. The IT-ISAC will be monitoring the situation during and following the April 1 “turn on” of the C&C communications channel and will reassess as events develop.
References:
McAfee Inc.& Avert Labs, “Finding W32/Conficker.worm Whitepaper”, Updated March 19, 2009.
http://download.nai.com/products/mcafee-avert/documents/combating_w32_conficker_worm.pdf
VIL description, updated for “W32/Conficker.worm.gen.c”.
http://vil.nai.com/vil/content/v_154253.htm
IBM Internet Security Systems, "Conficker Worm / Downadup"
http://www.iss.net/threats/conficker.html
Microsoft Corporation, “Microsoft Security Bulletin MS08-067 - Critical,” 23 October 2008.
http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx
Microsoft Corporation, “Conficker Worm: Help Protect Windows from Conficker.A and Conficker.B”.
http://technet.microsoft.com/en-us/security/dd452420.aspx
Phillip Porras, Hassen Saidi, and Vinod Yegneswaran, “An Analysis of Conficker's Logic and Rendezvous Points”.
http://mtc.sri.com/Conficker/
Jose Nazario, “The Conficker Cabal Announced,” Arbor Networks, 12 February 2009.
http://asert.arbornetworks.com/2009/02/the-conficker-cabal-announced/
“Group launches strategy to block Conficker worm from .ca domain”.
http://www.cbc.ca/technology/story/2009/03/24/tech-090314-conficker.html