Microsoft puts $250,000 bounty on Conficker coder

 

Gallery

By Stuart Turton

Posted on 13 Feb 2009 at 08:27

Microsoft is offering $250,000 to the person who hands it information leading to the conviction of the creators of the Conficker Worm.

Conficker, also known as Downadup, exploits a flaw in Windows Server that was patched by Microsoft back in October.

The infection rate has been staggering with experts suggesting that over ten million machines have now been affected, especially in countries where unpatched software is prevalent such as India and Brazil.

The most interesting part about Conficker-infested machines is that, unlike other botnets which contact a single domain to download their malicious software, Conficker cycles through 250 fluctuating domains, only one of which contains the malware payload.

"This makes it impossible and/or impractical for us good guys to shut them all down - most of them are never registered in the first place," noted F-Secure last month.

However, in an effort to combat this Microsoft has teamed up with other industry heavyweights such as Symantec and ICANN to grab these potential domain registrations before the bad guys can. Anybody who attempts to register one of Conficker's targeted domains before the group does will be investigated.

All of which sounds like a step in the right direction, though Microsoft was typically obtuse in describing its plan.

"As part of Microsoft's ongoing security efforts, we constantly look for ways to use a diverse set of tools and develop methodologies to protect our customers," says George Stathakopoulos, general manager of the Trustworthy Computing Group at Microsoft.

"By combining our expertise with that of the broader community we can expand the boundaries of defence to better protect people worldwide."

Anybody with information about the worm needs to "contact their international law enforcement agencies," Microsoft warns.