Risk: Informational
Members of the Honeynet Project have discovered a way to detect machines compromised with the widespread Conficker worm.
In a yet-to-be-released paper, the two researchers, Felix Leder and Tillmann Werner, described flaws in the way that Conficker changes compromised systems, according to well-known researcher Dan Kaminsky. While reading the paper during the review process, Kaminsky hit upon the idea to use their research as part of a general network scanner to detect the worm without having access rights to the system.
"You can literally ask a server if it's infected with Conficker, and it will tell you," said Kaminsky, who is the director of penetration testing for security firm IOActive. "It is taking advantage of a quirk in Conficker that blocks legitimate requests."