An estimated seven million personal computers worldwide may have been infected by the Conficker worm, according to a report by the Conficker Working Group (CWG) at the weekend.
CWG also said it’s maintaining visual timeline and chronology of Conficker to track historical, current and future events.
The Conficker infection rate, the report also said, has remained high for B and C variants but has been on declining curve for C and E, noting that as at October 2009 snapshot by the Shadowserver Foundation, which estimated that the number of systems infected with Conficker rated as A, B, C variants were placed at approximately seven million.
The Conficker Working Group (CWG)-led by the global coordinating body for cyberspace, the Internet Corporation for Assigned Names and Numbers (ICANN) and a number of concerned entities, including Microsoft, Verisign among others, finally released the summary of its joint counter-measures to battle the dreaded worm that hit cyberspace over two years ago.
The Conficker Working Group, thus, resolved to maintain visual timeline and chronology of Conficker “to track historical, current and future events,” stressing that activities to detect Conficker variants and remediate Conficker-infected hosts would undoubtedly continue for some time, but they would relent.
“This is inevitable given the millions of infected computers and historically marginal success in remediating malware,” part of the report read.
Lessons learned during the Conficker containment period, which began since the last quarter of 2008, according to a copy of the review summary made available to ITRealms Online by the Senior Security Technologist at ICANN, Mr. Dave Piscitello, indicated that this report provides a chronology of events related to the containment of the Conficker worm.
He also said that Security and Domain Name System (DNS) communities are working to devise long-term and sustainable approaches for dealing with not only Conficker, but also future, similar threats.
On the importance of roles in Conficker Working Group, he said, that all the actions related to mitigating the Conficker worm were not directly nor entirely within the remit of any individual CWG participant, but throughout the chronology of Conficker events, all the collaborating parties performed roles that were appropriate to their organizations’ core competencies, namely the malware researchers, reverse engineered the dropper cum installer, traffic analysis engineers identified the loci of infestations.
ICANN, he said for instance, facilitated communications between registries and parties who compiled the domain lists, and registry operators blocked registrations of Conficker domains.
The collaborating parties tried to adhere to the best practices of public disclosure of security incidents and events by maintaining a low profile, protecting sensitive information, and sharing only information that the ad hoc partnership agreed to share.
Several CWG members, he said, publicly expressed their surprise and gratitude for member willingness to engage in the Conficker containment, noting that many security and registry organizations had not encountered circumstances such as those Conficker posed and thus did not have communications channels in place to coordinate containment efforts.
But members indicated that ICANN’s ability to facilitate and expedite communications with Top Level Domain (TLD) registries accelerated processes that would under other circumstances have challenging if not impossible to obtain during the windows of opportunity Conficker afforded them.
“It provides an introduction and brief description of the worm and its evolution, but its primary focus is to piece together the post-discovery and -analysis events, describe the containment measures chronologically, and describe the collaborative effort to contain the spread of the worm,” he said.
According to him, the authors tried to capture lessons learned during a containment period spanning nearly a year and described recent activities that attempt to apply the lessons learned so that the security and Domain Name Systems (DNS) communities could be better prepared for future attacks that exploit the global DNS.
He noted that members of the team includes ICANN's Security and Stability Advisory Committee (SSAC), individual security researchers, and some ICANN registries who were invited to comment or review the report.
Noting that the Conficker worm first appeared in October 2008 and quickly earned as much notoriety as Code l, Red1, Blaster 2, Sasser 3 and , SQL Slammer 4.
The infection was found in both home and business networks, including large multi-national enterprise networks and attempts to estimate the populations of Conficker infected hosts at any given time have varied widely, but all estimates exceed millions of personal computers.
ITREALMS Online ... delivering news for ICT4D
No comments:
Post a Comment