Have agencies scrubbed the Conficker worm from their systems?

A company that has been tracking the scanning activity of the prolific Conficker worm says that traffic from infected government systems has dropped off significantly in recent months, which could indicate a successful effort to remediate infections.

“We started to notice a decrease over the last two or three months,” said Rodney Joffe, senior vice president and technologist at Neustar Inc., a directory services provider that administers the domain name registry for the .US country code top level domain for the Commerce Department.

Joffe said that Conficker appeared to have been present in tens of thousands of government systems at its peak. “Now they are down to less than 40 systems in the entire U.S. federal network,” he said.

But a spokesman at the Homeland Security Department, which runs the U.S. Computer Emergency Readiness Team (US-CERT), said the worm never had been widespread. "There have been minimal indications of Conficker infections to the US Government thus far,” the spokesman said. “Departments have been taking the appropriate actions when infections are discovered.

DHS said that the removal was the result of an integrated defense in-depth strategy that includes partnerships between agencies, US-CERT, the Joint Analysis Coordination and Knowledge Exchange and the Botnet Threat Focus Cell within the National Cyber Investigative Joint Task Force. “We are not focusing on a single threat but all hazards,” the spokesman said. “This approach has dramatically helped us on Conficker."

Joffe, who also is director of the Conficker Working Group, said the apparently successful eradication of a worm that has proved to be surprisingly resilient for more than a year is good news.

“For the first time the government is taking the lead in a technical security issue, rather than lagging,” he said. “If they can do it, there is no excuse for other enterprises not to. It is obviously possible to remediate.”

Joffe said the working group hopes to have details of the government effort available for a “lessons learned” paper the group plans to publish in the coming months.

The worm, also known as W32.Downadup, has infected more than 10 million computers since its appearance in late 2008, and although the infected machines do not appear to have engaged in large scale malicious activity, the worm is troublesome because of its ability to update itself and morph into new forms. It also can disable security features of infected computers such as Windows Update and antivirus tools.

“It is incredibly robust,” Joffe said. “It doesn’t seem to get remediated successfully and there continue to be outbreaks.”

He said the worm has a good command of Windows internals and network layer traffic, and also has developed the unusual ability to download and execute code without rebooting the infected system, a feat that Joffe likened to changing the tires on a moving car.

The original W32.Downadup.A exploited only the MS08-067 vulnerability in Windows XP Service Pack 2 and Windows 2003 Service Pack 1 operating systems, for which Microsoft issued an unusual patch outside of its regular monthly patching cycle. A subsequent .B variant added password guessing and the ability to copy itself to USB drives to its bag of exploits, and a .C variant added an additional layer of protection.

The worm uses an algorithm to generate a pseudo-random list of domains for its command and control network, which its infected clients check daily for instructions. Security analysts said the .C variant uses a new algorithm to determine what domains to contact. It went from generating 500 domains a day to 50,000 domains with the new algorithm. Because a command and control server can be a weak spot whose elimination can disable a botnet, this could make Conficker more difficult to attack.

A later version, .E, uses peer-to-peer networking for command and control. “At that point we lost visibility into infected machines,” Joffe said. But an estimated 6.5 million machines remain infected by earlier versions that use daily call-ups that can be tracked. It is that traffic that indicates a federal clean-up, he said.

“We see the check-in every day,” he said. “It appears they have across the entire federal government been remediating Conficker. We’re pretty sure the federal government has done something no one else has.”