The worm activated on April Fool’s Day might turn at any moment


Thursday, April 2nd, 2009

Conficker may have infected 50 million computers

Tiffany Crawford
Sun

Wednesday was D-Day for malicious Conficker, the super-worm that was supposed to be eating its way through computers worldwide, but no systems crashed despite sensationalized fears the latest scourge would wreak havoc on the Internet.

The worm was activated on April Fool’s Day, but experts said Wednesday that although nothing noticeable had occurred computer users are not off the hook.

As the worm slithered through millions of infected machines running Microsoft’s Windows operating systems, computers were expected to try and phone home to a master control centre by logging on to thousands of Internet domain names.

Patrik Runald, chief security adviser for F-Secure, estimated more than 50 million computers were infected worldwide, meaning the worm could still be lurking on computers. “That is happening right now,” he said on Wednesday. “Obviously April 1st has already hit Asia so we’ve had over 24 hours of these computers reaching out to these websites and nothing has happened.”

The worm infects computers by taking control of the operating system. Then it spreads like cancer, ravaging security services by attacking vulnerabilities in the Windows system and blocking access to security websites.

Runald, whose company works as part of an industry alliance of security companies and Internet service providers called the Conficker Working Group, anticipated the worm will continue for weeks.

“Just because nothing happened today doesn’t mean the danger is over and we can relax because something could happen at any moment.”

But just what will happen baffles even the most tech-savvy individuals.

No one knows who created it but the president of Canada‘s Internet Registration Authority says it’s likely a group of elite hackers whose motivation is old-fashioned greed rather than something like bringing down the Internet.

The hackers could be collecting credit card numbers stored in confidential documents on infected computers, which could generate millions of dollars, said Byron Holland.

He added there is no doubt in his mind the worm’s authors picked April Fool’s Day intentionally to launch the worm to create a smokescreen by making people think it’s a prank, thereby lulling people into a false sense of security.

“This particular piece of code is extremely sophisticated, clearly written by software engineers,” he said. “This is not an unconscious decision. The fact is it gets people wondering if it’s a joke, creates confusion and people don’t take it seriously.”

© Copyright (c) The Vancouver Sun



Comments are closed.