Conficker Group Offers Roadmap For Stopping Worm
How do you nuke a worm? That was the question posed by the Conficker Working Group, which from late 2008 until mid-2009 explored a variety of techniques for stopping the Conficker worm, which by some estimates infected 15 million computers at its peak.
On Monday, the Rendon Group released a report, funded by the Department of Homeland Security, rounding up the 15-person-strong working group's "lessons learned." The report highlighted the group's biggest achievement: "preventing the author of Conficker from gaining control of the botnet." Doing so, however, required coordinating with organizations in more than 100 countries to block the more than 50,000 domains per day generated by the Conficker C worm.
The group's legacy includes processes for coordinating with the Internet Corporation for Assigned Names and Numbers (ICANN) and country code top-level domains (ccTLDs), the report said. "Without these organizations, the group would have been able to do little to scale the registration of international domains to block Conficker C from using domains to update."
