The IT Security Attaché

The Conficker Worm – my review

There have been many articles, reviews, information and posting about the Conf*ker as many people have started calling it. Depending on who you talk with you can replace the * with anything that suits your feelings towards it. The most interesting thing about this threat isn’t the fact that it’s neither a new one nor a new attack form, it’s the same old attackers doing the nefarious things they do but with a bit more sophistication. For me as an IT guy looking at all this, i’m getting the wow factor from some of the new developments and traits of the threat. So my take today will not be to overwhelm you with all the techno jargon and high level breakdown of the threat but just to speak on it in the most basic form so that even those who are non technical can grasp the severity of it.

So here goes.

If you get infected with the Conficker worm you’re screwed. Bottom line.

If this is a system that is on a business network it must be removed, quarantined, disinfected by any means necessary. Take no chances with this threat.

Get my drift?

Is this basic enough to understand?

Ok, let’s take it from another angle.

This worm is a blended (virus, worm, rootkit, botnet, adware, malware and the what else factor) threat in a blended threat with blended characteristics. It’s like catching a cold and getting a headache, ear ache, stomach ache, backache and chest pains all in one. It starts with a simple cold but quickly spreads to other critical areas of the body causing serious effects and harm. This threat is in a class by itself as it deploys various additional agents around the system that causes complete successful removal to be unclear.

If you have been infected with the worm you’re only real option is to completely wipe the system. Unplug, power down, power drain, complete power loss to all storage capacities of the system. This is a very serious threat.

As for those who have been asking about which anti-virus solution is best to protect against this, there isn’t one. Anti-Virus alone is not going to protect you from this threat and the blended effects. It will take a number of things to make this happen and here’s my list.

1.      System must be fully patched from all angles, the operating system, the applications, services, devices and drivers. When patching the Microsoft Windows operating system many people have auto update enabled but in different settings. Some have alert me of new updates but never apply the new updates. Some have it set to download and wait for my approval and they never approve the installation of the updates. Some have it set to download and install all updates. This is a good option to have. When patching the OS one must be prudent so as not to only apply critical patches but all software, severe and high updates as well. So I recommend if you’re doing the built in auto update please use the download and apply all. If doing it manually do a custom update which will reveal all the patches and updates needed.

2.      Anti-Virus alone will not protect you from this worm and most of the new threats in the IT Security Threats Landscape today and tomorrow. The need for an anti-malware solution is critical to combine the protective layers of web/content filtering, IDS/IPS, anomaly/heuristics based detection, network and proactive threat protections. This is a backup to the patching already performed on the system. A fully patched system can still be compromised if a targeted malicious code is allowed to reach it.

3.      Common sense if the name of the game and the winner of all security practices. Adding to the patching of the system and having the needed security solution comes the best practice of all, the user’s common sense in using the system effectively. As the person using the system one needs to pay very close attention to details in their messaging, web browsing and IM practices. Opening emails from known and unknown sources requires due diligence in thinking about the nature of the message, the contents and what is its relevance to you. A message from a known source may not have been sent by them but could have been the result of an infection on their system(s). This is the same for email and IMs. There are many IM worms that will hijack your IM client and send out messages to everyone in your contact list pointing them to a website for them to get a drive-by-download. Many people think very little of web based attacks while they are the fastest growing today because of the ease of infection and the delivery of the payload.

4.      User education and awareness. This is a very critical issue as many seem to think that these issues are a corporate or industry problem. When a threat like Conficker goes into the wild it is not targeting specific systems in specific industries only, it is doing a general attack across all systems within its path. IT Security is a people problem and we are all in its path whether we like it or not and no matter what OS vendor platform you’re on/running.

5.      Enable your built in firewall or get a third party one to put up some form of perimeter defenses.

6.      There are security suite solutions that bundles multiple security technologies and features in one suite. That may be a more viable option for you because of the integration and management options.

The fact of the matter is, we have these issues at the level they should have been years ago, in the media and across all industries as a people problem, not an industry one. I take the same approach to Conficker as I do to rogue Anti-Virus 2008/9 threat, if detected, wipe, clean, rebuild, reimage.

This isn’t something to play around with what is or if it is cleaned. The only way to be sure is to wipe it all out.

Thank you and have a great day,

~Brett A. Scudder~

The IT Security Attaché

Hey guys,

I just got final confirmation from Mr. Evan Fromberg, Director of Sales, Channel Partners at Fortinet, that they will be presenting their new FortiOS version 4 to us at our local group meeting in NYC on April 9^th at 6pm. He and his engineer will be there to present the OS and answer our technical questions. Sweet, i’m excited.

FortiOS provides the foundation for the operation of all FortiGate appliances, from the core kernel functions to the security processing feature sets. FortiOS provides multiple layers of security for a variety of applications and content including Web, Email, FTP, IM/P2P, NNTP, and others. The main security features of FortiOS include Firewall, Virtual Private Networking (IPsec and SSL VPN), Antivirus, Intrusion Prevention, Web filtering, and Antispam.

With the release of FortiOS 4.0, Fortinet has redefined network security again by extending the scope of consolidated security and networking capabilities within FortiGate® multi-threat network security platforms. With over 40 new features, FortiOS 4.0 delivers on its mission to enable secure business communications while offering the best security, performance, and total cost of ownership possible.

New in FortiOS 4.0

WAN Optimization
WAN optimization provides acceleration for applications traversing slower network connections – which are typically WANs. The combination of multi-threat security, traffic optimization, and VPN technologies provides cleaned, accelerated, and secured communications.

Application Control
Application control uses our dynamic application identification engine that recognizes applications based on their behavior. By coupling application control policies with sophisticated security features, administrators can achieve comprehensive protection with granular and more meaningful policies.

Data Leakage Prevention (DLP)
DLP uses a sophisticated pattern-matching and regular-expression engine to identify then prevent the communication of sensitive information outside of the network perimeter. In addition, DLP technology also provides audit trails for data and files, which can aid in legislative compliance.

SSL Inspection
SSL inspection ensures protection from malware infection that is camouflaged by secured protocols, allowing the FortiGate to decrypt the data passing through the SSL-encrypted connection. Once decrypted, the data can be passed to FortiOS security engines for inspection.

More info on the new OS here http://www.fortinet.com/products/fortios/.

Registration is open here http://www.clicktoattend.com/invitation.aspx?code=137146 and the meeting page will be available with details shortly.

Many thanks to Mr. Fromberg for accepting my invite/request and I look forward to the meeting.

~Brett A. Scudder~

IT Security Attaché