Conficker has been giving us all headaches for quite some time now, the latest news it that China hosts up to 28% of the World Conficker infections at its peak.

7 million separate hosts infected with Conficker at the end of 2009, that’s more than the population of some countries!

It’s a pretty nasty piece of malware and doesn’t seem to be going away anytime soon, especially with many new nations, cities & areas coming online with users inexperienced in the ways of the web – more infections are bound to happen.

China last year hosted more than one in four of the world’s computers infected with a major variant of the Conficker worm, according to an official report, highlighting the wide reach of malware inside the country. China had about 7 million Internet Protocol (IP) addresses infected with Conficker B at the end of last year, according to a recent annual security report posted on the Web site of China’s National Computer Network Emergency Response Technical Team (CNCERT). The number of infections varied during the second half of the year, which the report covered, but was higher than 5 million during all but one week.

The huge figures gave China up to 28 percent of the world’s Conficker B infections depending on the week, the report shows.The controllers of Conficker so far have hardly used their network of infected computers, but they could potentially use it to launch a crippling denial-of-service attack by ordering all of the computers to contact a victim server at the same time.

7 million infected hosts, that’s one mean looking DDoS network right there. That’s assuming all the Conficker infections are controlled by the same herders (which IMHO is unlikely). There are probably multiple groups using variations of the same malware, different infection vectors and different control channels.

I wonder if they are going to do anything with Conficker because Conficker Day on April 1st last year was a non-event and when they did start dropping some payloads – well nothing much happened either.

Malware is a growing problem worldwide, but Chinese PC users may be more easily hit than others. Over 4 percent of China’s more than 380 million Internet users run no security software, according to a recent survey. Software piracy is also rampant in the country, with unlicensed versions of Windows XP running on many PCs that are unlikely to receive regular security updates.

Conficker began spreading late in 2008 and has become the most widespread known botnet. But attention to the worm fell off last year when April 1, a day the worm was due to update, came and passed without incident. Millions of PCs worldwide remain infected with the worm.

China also had anywhere from 125,000 to over 300,000 IPs infected with Conficker C during the second half of last year, giving it up to 20 percent of the world’s infections for that variant, according to the report.

The figures from the China based report are considerably higher than those from Shadowserver, which as of April 2010 only reports about 2 million Conficker infections in China (stats here).

I would say the problems in China have many angles, the main ones being pirated software leaving users with vulnerable software and lack of education meaning people aren’t using Antivirus software and are wide open to infections.

Source: Network World

So it seems something big was brewing with Conficker, they just didn’t want to do what everyone expected and unleash it on April 1st when all eyes were on them.

Smart move really, they kept quiet and waited a week or so after before dropping some fairly serious and complex payloads (encrypted rootkits).

It seems like they are going for the old ransom tactic and duping users into buying dodgy anti-virus software.

An updated version of the Conficker worm is installing malware that attempts to lure people into buying rogue anti-virus software. Security researchers also say the worm is downloading malware tied to the notorious Waledac botnet.

Conficker’s latest move may be tied to a scheme to lure users into downloading fake anti-virus software.

Security researchers monitoring the Conficker worm’s activities say the malware has been observed downloading a file detected by Kaspersky Lab as FraudTool.Win32.SpywareProtect2009.s.

“Once it’s run, you see the app interface, which naturally asks if you want to remove the threats it’s ‘detected,’” wrote Aleks Gostev on Kaspersky Lab’s Analyst’s Diary blog. “Of course, this service comes at a price—$49.95.”

There is also some links to Waledac a supposed next-gen botnet for spamming purposes that came shortly after the demise of Storm.

It seems like Conficker is not going to be laying dormant any more, perhaps they weren’t making enough from renting out sections to spammers and DDoSers – now they really want to monetize the infected machines they have gathered.

In addition to that file, the worm is also now downloading the Waledac malware, which steals passwords and turns computers into bots for spamming operations. Waledac has emerged as a key part of spamming operations over the past several months, and is widely considered a reincarnation of the infamous Storm botnet.

“Fear is used, universally, as a means to control people,” said Sendio CTO Tal Golan. “Governments use it. Large businesses use it. So it should come as no surprise to anyone that ‘cyber-bad guys’ use it.”

At the moment, the rogue anti-virus software comes from sites located in the Ukraine (131-3.elaninet.com.78.26.179.107) although the worm is downloading it from other sites, according to Kaspersky Lab.

Unsurprisingly the source for much of the rogue software is in Eastern Europe, a hotspot for cybercrime and hackers skilled in malware and cryptography.

There’s some updates from F-Secure here:

New Conficker action

Source: eWeek

There hasn’t been a viral outbreak of this scale for quite some time, Conficker or Downadup as it’s known was only fairly recently discovered (Oct 2008) and has already infected an estimated 9 million machines!

It’s spreading fast though and it auto-updates itself via downloads from random domains making it almost impossible to stop as whatever countermeasures come out, it can just download itself the latest version and bypass them.

It also has multiple infection vectors including traveling via USB drives.

Infections of a worm that spreads through low security networks, memory sticks, and PCs without the latest security updates is “skyrocketing”.

The malicious program, known as Conficker, Downadup, or Kido was first discovered in October 2008. Anti-virus firm F-Secure estimates there are now 8.9m machines infected. Experts warn this figure could be far higher and say users should have up-to-date anti-virus software and install Microsoft’s MS08-067 patch. In its security blog, F-Secure said that the number of infections based on its calculations was “skyrocketing” and that the situation was “getting worse”.

Speaking to the BBC, Graham Cluley, senior technology consultant with anti-virus firm Sophos, said the outbreak was of a scale they had not seen for some time.

The virus targets the services.exe process (Server service) by exploiting the vulnerability associated with the MS08-067 patch.

This was a serious remote execution flaw carried out by making a malformed RPC request, apparently it was reported ‘privately’. But now it seems that perhaps the details of the exploit weren’t that private after all.

According to Microsoft, the worm works by searching for a Windows executable file called “services.exe” and then becomes part of that code.

It then copies itself into the Windows system folder as a random file of a type known as a “dll”. It gives itself a 5-8 character name, such as piftoc.dll, and then modifies the Registry, which lists key Windows settings, to run the infected dll file as a service.

Once the worm is up and running, it creates an HTTP server, resets a machine’s System Restore point (making it far harder to recover the infected system) and then downloads files from the hacker’s web site. Most malware uses one of a handful of sites to download files from, making them fairly easy to locate, target, and shut down. But Conficker does things differently.

It quite advanced even taking system restore out of the picture and downloading new files to update itself and to infect the machine further. It’s sneaky as it downloads from a bunch of seemingly randomly generated URLs making it very difficult to track and stop.

Many machines are infected in China, Brazil, Russia, and India – personally I think this is because piracy is rife in these areas and Microsoft doesn’t allow pirated copies of Windows to use Windows Update (especially with the WGA tool or Windows Genuine Advantage).

Source: BBC News (Thanks Navin)