Conficker update

[unixronin]

A brief capsule summary:  Conficker update traffic has been detected on various networks; it’s now switched into a more active update mode in which, instead of checking 250 domains for updated code, it is using a set of 50,000 domains of which it tries a randomly selected 500 per day.  So far, it does not appear that the Conficker creators have put up any update for Conficker to retrieve.  There’s still no clue as to what the update will do when delivered, and no indication yet of any active use of the botnet.

Meanwhile, IBM has cracked the work’s P2P communication and developed a way for ISPs to detect infected customer machines by listening in on their P2P traffic.

Comments

[databeast.livejournal.com]

ISS, acting like a bunch of lying cunts. Business as usual.

Different owners, same bullshit.

[unixronin.livejournal.com]

Oh? They haven't cracked it? Or they're taking credit for someone else's work?

[databeast.livejournal.com]

ISS are a bunch of script kiddie shitbags.. I want third party verification that the shit works..

I'm working on my own detection of the P2P traffic, and so far I havent seen any need to 'crack' it.

Half the stories pushed from IBM imply they've got access to the P2P messages (bullshit), not just that they can reasonably detect it (I can do that now, just from the information already available)

[databeast.livejournal.com]

Let's just say that their behaviour over the whole nondisclosure thing here, and the furious amount of weasel-words in it, make me believe that this is just more of ISS's standard "we are l33t3r th4n y0u' shit.

Kaminsky's work, implying their may be a sploit against conficker itself, was far more dangerous a public release than this ISS 'discovery'.

Still, if they publish complete technical details, I'll be prepared to eat my words.

[ithildae.livejournal.com]

At one point, we were talking about having IBM do some work for the company I was working for. The sales and technical folk they sent out to gather specs never did understand the problem, let alone how we needed it fixed. We sent them packing. They seem to always be losing their best people.

[unixronin.livejournal.com]

That bodes ill for Sun...

[databeast.livejournal.com]

yeah they've "cracked the code" it in terms of a reliable way to detect it. Well that's nothing, my version of that almost works too, and I'll be happy to share that with anyone once it does (I'm just using the already avilable information though to create my own implementation of looking for it).

ALl their press releases however seem to try and implicate they've "Cracked it and now have access to the content of all conficker's P2P traffic", which I call bullshit on.