SoylentNews

Arthur T Knackerbracket writes:

From Computerworld:

In late 2008, a worm called Conficker began infecting millions of computers, startling the computer security community into action.

Conficker's quick spread was so alarming that an organization was formed called the Conficker Working Group that was tasked with stopping the botnet and finding its creators.

Many countries also formed their own groups that worked with Internet service providers to remove infections from users' computers. But seven years later, there are still about 1 million computers around the world infected with the malware despite the years-long cleanup effort.

Researchers in the Netherlands have analyzed those efforts and tried to figure out what went right and wrong in order to guide future botnet-fighting efforts. Their research paper will be presented next week at the 24th USENIX Security Symposium in Washington, D.C.

"These people that [have computers which] remain infected -- they might remain infected forever," said Hadi Asghari, assistant professor at Delft University of Technology in the Netherlands.

Hadi Asghari, assistant professor at Delft University of Technology.

In December 2008, Microsoft patched the vulnerability in Windows XP used by Conficker that allowed remote files to be executed if file-sharing was enabled. But Conficker's worm capabilities made it surprisingly resilient, and it continued to infect computers even when researchers took over the botnet's command-and-control system.

Special efforts by individual countries to control Conficker's spread, such as in Finland, helped keep a check on it, Asghari said. Some other advanced countries, including Norway and Sweden, did not have Conficker remediation programs but still managed to keep it under control, he said.

Researchers are still monitoring Conficker-infected computers since they took over control of the botnet years ago. Asghari said his team saw more than 1 million IP addresses of infected machines calling home to a sinkhole for instructions, but it's difficult to figure out what type of machines those are and why they may still be infected.

Asghari said it's likely many computers are probably running Windows XP without automatic updates installed. It's also possible that some of them may be rarely updated or abandoned embedded systems.

Original Submission