İngilizce İçerikli Yazıdır. (The page language is english..)

(An Analysis of Conficker’s Logic and Rendezvous Points)

http://mtc.sri.com/Conficker

SRI International
Technical Report

An Analysis of Conficker’s Logic and Rendezvous Points
Phillip Porras, Hassen Saidi, and Vinod Yegneswaran

Introduction

Conficker is one of a new interesting breed of self-updating worms that has drawn much attention recently from those who track malware. In fact, if you have been operating Internet honeynets recently, Conficker has been one very difficult malware to avoid. In the last few months this worm has relentlessly pushed all other infection agents out of the way, as it has infiltrated nearly every Windows 2K and XP honeypot that we have placed out on the Internet.  From late November through December 2008 we recorded more than 13,000 Conficker infections within our honeynet, and surveyed more than 1.5 million infected IP addresses from 206 countries.  More recently, our cumulative census of Conficker.A indicates that it has affected more than 4.7 million IP addresses, while its successor, Conficker.B, has affected 6.7M IP addresses (see SRI Appendix I: Conficker Census). Our analysis finds that the two worms are comparable in size (within a factor of 3) and  the active infection size of Conficker A and B are under 1M and 3M hosts, respectively. The numbers reported in the press are most likely overestimates.  That said, as scan and infect worms go, we have not seen such a dominating infection outbreak since Sasser [6] in 2004.  Nor have we seen such a broad spectrum of antivirus tools do such a consistently poor job at detecting malware binary variants since the Storm [4] outbreak of 2007. Yazımın devamını görüntüleyin »