Researchers find way to detect Conficker
Researchers and network-scanning companies scrambled over the weekend to add a technique for detecting Conficker-infected computers, after two members of the Honeynet Project discovered a way to detect machines compromised with the widespread worm.
In a yet-to-be-released paper, the two researchers — Felix Leder and Tillmann Werner — described flaws in the way that Conficker changes compromised systems, according to well-known researcher Dan Kaminsky. While reading the paper during the review process, Kaminsky hit upon the idea to use their research as part of a general network scanner to detect the worm without having access rights to the system.
"You can literally ask a server if it's infected with Conficker, and it will tell you," said Kaminsky, who is the director of penetration testing for security firm IOActive. "It is taking a advantage of a quirk in Conficker that blocks legitimate requests."
