Conflicker virus highlights risk to PC security
The spread of the Conflicker worm virus has highlighted the importance of patching computers to protect IT networks.
The latest Microsoft security bulletin for March 2009 addresses three vulnerabilities in Microsoft Windows products, one critical and two important and advises users to patch their IT systems. The server vulnerabilities could allow a remote attacker to redirect network traffic intended for systems on the internet to the attacker's own systems.
The Conflicker worm targets the Microsoft Windows operating system. The worm, also known as Downandup and Kido, is spreading despite the release of patches. First released in October 2008, two further versions have also been released. It is estimated to have affected 12 million computers around the world.
The worm exploits the system at various entry points, attempting to embed itself on target machines, hack user passwords and copy itself to removable drives.
Sunbelt Software CEO Alex Eckelberry said: "Conficker is a network worm, which exploits a long-patched hole in Windows, and spreads itself in all sorts of ways. These include via USB sticks, brute force attacks, autorun/autoplay, and, of course, its use of a vulnerability that was patched in late October 2008. It highlights the need for better passwords, disabling logins after a small number of unsuccessful attempts; device control policies; and locking down autorun, which should always be disabled in an enterprise environment.
"Variants of the Conficker worm shut down known security software programs and block access to the sites of antivirus vendors. They also employ a revised algorithm to generate domains used to host payloads and store sensitive data harvested from compromised PCs."
There are concerns that 1 April 2009 will be the next time point for a Conflicker attack.
Experts say users should update antivirus software and install Microsoft's MS08-067 patch. The continuing spread of the virus shows that companies and individual users are failing to apply regular patches to enforce their security. If access to the Microsoft patch is blocked, this means your system has been infected.
"The best advice for end-users is simply to make sure they are protected, and to be proactive in keeping their PCs up to date. Users who are dealing with previously infested PCs are advised not only to update to the latest definitions of their antivirus program but to download and use Sunbelt's free Conficker removal tool."
To protect your system, Sunbelt recommends:
- Make sure your computer is fully patched with the latest Windows updates Conficker can only get on your machine if you have not run updates
- Make sure you are using strong passwords. Conficker tries to access other machines by guessing at passwords. Prevent this by using non-dictionary words and including numbers and symbols within the password
- Use the Microsoft Malicious Software removal tool to scan your system. This will show if you are infected and remove the offending files
- Ensure your antivirus is up to date
Another problem area is where users' computers contain old versions of software which is not up to date or no longer being used. Security experts at F-Secure say that out of date software can make computers vulnerable to malicious exploits.
Sean Sullivan from F-Secure Labs said: "A lot of the software on users' computers has been updated and patched to make it safe. People are using these new versions, but if they do not delete the old or unused versions from their computers, they may still be open to exploits. F-Secure's data shows that people have lots of old software lying about on their PCs, unused, and creating possible problems.
"The best way to keep your PC safe from exploits is to make sure your software is updated with the latest patches. Many software applications will do this automatically. You should also make sure you only have programs you actually use installed on your computer. Old versions or unused programs should simply be removed."
To download the latest Microsoft security patches, http://www.microsoft.com/technet/security/bulletin/ms09-mar.mspx
Sunbelt Conficker Removal Tool http://www.sunbeltsecurity.com/Downloads.aspx
Printed from http://www.whattobuyforbusiness.com/news/11242/Conflicker_virus_highlights_risk_to_PC_security.html