Group finds a way to thwart Conficker (no thanks to government)

The efforts of a public/private working group to combat the fast-spreading Conficker worm offer a model for future cyber defense, but the federal government made little contribution, according to a study commissioned by the Homeland Security Department.

The Conficker Working Group is an ad hoc organization of more than 30 companies and Internet registrars, universities and government agencies, including the FBI and Homeland Security Department. They came together in early 2009 to combat what has been described as one of the largest and most serious cybersecurity threats of the past decade.

The group reported success in preventing Conficker’s author from gaining control of its botnet, although the group was unsuccessful in remediating the millions of infected computers.

DHS’ Science and Technology Directorate commissioned a report on lessons learned from the effort to help identify best practices. The study was conducted by Rendon Group and completed in June, but the report was only recently released publicly.

“In coordinating to stop the botnet threat, the CWG became a model for cyber defense,” the report concludes. “Thanks to this effort, we can glean a number of valuable lessons to guide how future efforts may be initiated, organized and managed.”

Related coverage:

Has Conficker spurred a new model for security response?

But federal collaboration was found lacking. One person interviewed for the report described the government’s participation as “zero involvement, zero activity, zero knowledge.” Information sharing was described as one-way, with information going to the government and little returning. Any real information sharing between the working group and government generally was on a personal basis between individuals rather than at an organizational level.

Nevertheless, the government did fund some reverse engineering efforts on the malware.

Conficker appeared in 2008 and gained attention because of its rapid rate of infection and use of advanced techniques to spread and communicate, taking advantage of things such as the Domain Name System, encrypted peer-to-peer communications and auto-run capabilities. It appeared to be a well-designed piece of malicious code. Although it was intended to create a botnet that continually upgraded itself, its ultimate purpose and its author are still not known.

One of the working group's early actions was to register or block domains that the worm would use for command and control. As part of that effort, the Internet Corporation for Assigned Names and Numbers, a working group member, for the first time agreed to waive mandatory registration fees for Conficker domains so that the working group could preempt the command and control system. That cooperation was cited as one of the primary reasons for the working group’s success.

“The Conficker Working Group sees its biggest success as preventing the author of Conficker from gaining control of the botnet,” the report states. “Nearly every person interviewed for this report said this aspect of the effort has been successful. The blocking of domains continues and the Working Group has indicated they will maintain their effort.”

The group’s biggest failure was its inability to remediate infected computers and eliminate the botnet. In spite of remediation efforts, millions of computers remain infected.

According to the responses of the working group, the elements that worked included:

• Private-sector collaboration. The working group structure was a successful example of private-sector collaboration and a model for future efforts, according to most of the members.
• Informal organization. Although the lack of formal organization might appear to be a negative, many members of the group said the informal structure, including "the meritocracy and self-policing," were positives.
• Strong social networks that facilitate trust. The informal social networks that brought the group together appeared to work for most of the people in the core group. However, they also resulted in unintended omission of other potential stakeholders from which the group could have benefited.
• Subgroup structure. The subgroup organization was successful and is already being used as a model for future groups.
• Data sinkholing. Much of the data from infected computers attempting to contact command and control servers was sinkholed on servers and shared with most who requested access.
• Cooperation from ICANN and top-level domains. Members of the working group viewed this cooperation as a precedent that will help future efforts and discourage malware authors from believing they can easily exploit that portion of DNS.

Elements that did not work, in addition to the lack of effective federal cooperation, included:

• Remediation. The ability of the group to remediate infected computers was limited in its success and was not a central goal of the group when it was created.
• Communication with ISPs. Several people pointed to uncoordinated communication between the working group and Internet service providers as a weakness.
• Public relations. Public relations efforts at times did more to increase hype than help deliver pertinent information.
• Lack of accountability. Groups must be prepared for error, hold people accountable and have backup systems in place. However, because the group was composed primarily of volunteers, many of whom had full-time jobs, it was hard to find time to doublecheck lists and to establish and enforce accountability.

The Conficker Working Group still is in operation and continues to block tens of thousands of domains per day to disrupt the Conficker command systems. One member told interviewers the group “will remain in place while the threat is out there.”