Conficker on April 1st: Eve of destruction or big joke?

Page 2 of 2

There's certainly skepticism in some quarters that Conficker.C will be looking more like a bad April Fool's Day joke.

"The most recent variant is designed to do something on April 1, which most likely will be to contact one of the 50,000 or so URLs it creates," comments Andy Hayter, antimalware program manager for ICSA Labs, which tests security products. But he adds he doubts Conficker will "take over the world on April 1."

SecureWorks says Conficker would be able to use its own peer-to-peer protocol to allow infected nodes to update each other without the use of a centralized command-and-control-server. No updates would be accepted by Conficker unless they are signed by the Conficker author's private encryption key.

But in spite of these ominous signs, SecureWorks research Joe Stewart says he's skeptical that anything at all will happen April 1.

"My personal opinion is that the April 1 activation of the new algorithm may simply be a distraction, a kind of practical joke on the part of the worm author[s]," Stewart says. He thinks there's been a surfeit of press hype about Conficker.C.

"We don't think it will cause anything visible on April 1 and the reason for that is everyone expects that something will happen on April 1," says Patrik Runald, chief security advisor at antimalware firm F-Secure. "It would be pretty stupid if they did a major change that day. And unfortunately for what we're seen so far, the people behind Conficker are anything but stupid."

Derek Manky, threat researcher at Fortinet, says he for one, would be more concerned about what might happen after April 1. "It's still active," he points out.