NYX (Corporation): 10/1/09

Norman.com:

W32/Conficker is a network-propagating worm family. There are several variants. The worm’s most interesting feature is that it spreads to other machines via a security vulnerability in the Windows Server Service. This vulnerability allows it to trigger a download of itself to the remote computer without the user’s knowledge.
When executed, the worm will copy itself as a randomly named DLL to the Windows System folder. It also copies itself to network shares and attempt to execute itself on the remote machines.

Spreading mechanism

File system changes

The worm copies itself to:
[System]\randomname (preferred location) or
[Program Files]\Internet Explorer\randomname or
[Program Files]\Movie Maker\randomname (50% chance of each), or
[Application Data]\randomname, or
[Temp]\randomname
It will attemp to install as a service, but if it can't it will install as a regular application from bootup.
The worm also copies itself to removable and remote drives as mentioned below.

Exploit spread

The worm generates random IP addresses, using the rand function, which it attempts to infect. These are heavily filtered - f.ex. the IP address ranges below are not attempted infected:
11.*.*.* (US Department of Defense)
127.*.*.* (Loopback)
169.254.*.* (Link Local)
172.16.*.* - 172.32.*.* (Private use networks)
192.*.*.* (Reserved, and private use networks)
198.18.*.* - 198.19.*.* (Network Interconnect Device Benchmark Testing)
224.*.*.* - 255.*.*.* (Multicast, and reserved address space)

In addition, the worm contains an address list of no less than 396 additional IP address ranges it does not attempt to infect, and does not allow an infected machine to spread to. These IP address ranges typically belong to antivirus companies.
It opens a HTTP server on a random port on the local machine, and then attacks the remote computer by sending a specially crafted packet to it. This causes vulnerable machines to connect back and download and execute a copy of the worm. If the download request does not match what the worm expects (f.ex. if the download client is wget, or reported operating system is Linux, or downloading IP is in one of the blocked address ranges), the data sent will not be the worm but randomly generated text.
It randomly connects to the following web sites in order to get its own IP address:
http://checkip.dyndns.org
http://www.whatismyip.org
http://www.whatsmyipaddress.com
http://www.getmyip.org
It randomly connects to the following web sites in order to calculate the network speed before infection attempts:
aol.com
cnn.com
ebay.com
msn.com
myspace.com

Spreading to removable and remote drives

The worm scans logical drives and copies itself to writable remote and removable drives (ex. USB sticks). It creates new folders on the drive(s) on the form
[drive]:\RECYCLER\S-X-X-XX-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-XXXX\[filename].[ext] where X means a random digit (number of digits may also vary). This variation is selected 15 out of 16 times.
or
[drive]:\[random]\[random]\[filename].[ext]. This variation is used one out of 16 times.
A file named autorun.inf is created on the root folder of the drive in order to autoload the worm in many circumstances, typically when an infected removable drive is inserted and browsed to.

Registry changes

Adds the keys
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets "dl"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets "ds"
Installation of service:
HKLM\System\CurrentControlSet\Services\[randomname]
"DisplayName"=[composite name]
"Type"= 0x20
"Start"= 0x2
"ErrorControl"= 0
"ImagePath"="%SystemRoot%\system32\svchost.exe -k netsvcs"
"ObjectName"="LocalSystem"
"Description"=[random service name]
[composite name] is a name composed of two words picked from the list of names below separated by [space], f.ex. "Time Task". Identical words can not be picked:
Windows
Updated
Universal
Time
Task
System
Support
Shell
Server
Security
Network
Monitor
Microsoft
Manager
Installer
Image
Helper
Driver
Config
Center
Boot

HKLM\System\CurrentControlSet\Services\[randomname]\Parameters "ServiceDll"= Path to worm executable.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost" "netsvcs"= list of installed services + [randomname]
If unable to install as service, it installs in run keys:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run = rundll32.exe malwarepath randomchars
HKLM\Software\Microsoft\Windows\CurrentVersion\Run = rundll32.exe malwarepath randomchars
Baca Selengkapnya dengan klik disini.
Baca Artikel Terkait dengan klik disini.
Sumber: http://www.norman.com/