Microsoft, Symantec, VeriSign join forces to fight Downadup worm

Microsoft offers $250,000 for info on hackers; ICANN involved in effort, too.

Nearly 20 technology companies and organizations are combining forces to disrupt the command-and-control infrastructure of the rapidly-spreading "Downadup" worm, prompted by infection rates of nearly 2.2 million machines each day.

Firms including Microsoft, Symantec and VeriSign have joined with ICANN, the nonprofit group that manages the Internet Domain Name System, to preemptively register and remove from circulation the Internet addresses that the worm's controllers use to maintain their hold on infected machines, said Gerry Egan, director of product management in Symantec's security response group.

Separately, Microsoft has offered a US$250,000 reward for information that results in the arrest and conviction of the hackers who created and launched the worm.

Although Microsoft debuted its hacker bounty program in 2003, it's rarely used the US$5 million it set aside at the time. The last time it offered a reward was in 2004, when it posted a quarter-million-dollar bounty on the maker of the "Sasser" worm. A German teenager was arrested in May 2004, and charged with creating Sasser. The following year, Microsoft paid out the reward to two people who helped identify the hacker.

Perhaps not coincidentally, security researchers -- including those at Symantec -- have recently drawn comparisons between Downadup, which also goes by the name "Conficker," and Sasser. Much of those comparisons relate to the size of the current attack, as well as the fact that the worm targets a wide-scale Microsoft vulnerability.

To stymie Downadup, the coalition plans to either pre-register or remove from circulation as many of the 250 different domains that the worm uses as possible, said Egan. "We're working with the domain registrars to take them out," he said. "It's a combination of registering the domains and removing them from circulation."

Once it has infected a PC, Downadup generates a list of 250 possible domains -- the list changes daily -- selects one, then uses that URL to reach a malicious server from which it downloads additional malware to install on the hijacked computer. Symantec and other security vendors, including Helsinki-based F-Secure Corp., have been preemptively registering some of those domains for weeks. They have then monitored the domains to get an idea of the worm's back-end processes, and to track its spread. Symantec has used that approach to gauge the current strength of the worm. According to Egan, over the last five days, Symantec has monitored an average of 453,000 different IP addresses infected per day with Downadup.a, the original November version, and 1.74 million more IP addresses infected per day with Downadup.b, the more virulent variant that debuted in late December 2008.

Together, the two versions have infected an average of nearly 2.2 million PCs daily.

Egan declined to say whether the group would be able to completely disable the worm's control mechanism, but said the consortium's formation does not mean that researchers have new information about what malicious tasks the infected PCs might be told to perform. "We have no indication of its purpose as of yet," he said.

Even so, Symantec sounded worried.

"The millions of systems infected by Downadup pose a risk to Internet users as well as to the infrastructure of the Internet," the company said in a long post to its security blog . "Under the control of attackers, the millions of infected systems could be used to launch distributed denial-of-service (DDoS) attacks against specific users or organizations, crippling their ability to function on the Internet. Additionally, the infected systems could be used to deploy further threats, such as seeding a new worm that targets a more recent or undisclosed vulnerability."

Last month, Microsoft refreshed its Malicious Software Removal Tool (MSRT), the anti-malware utility that cleans infected Windows PCs, with a signature for Downadup. Microsoft rarely reacts with a new MSRT signature as fast as it did in January.

The company has not responded to a questions about how many PCs the MSRT has scrubbed of Downadup.

While Downadup uses several attack strategies -- including using USB storage devices, such as flash drives, to spread -- one of its primary infection vectors is by exploiting a Microsoft vulnerability that the company patched with an "out-of-cycle" update in late October 2008.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags worm

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?