OK, so by now you have probably read a 100 articles on Conflicker and the spread of the worm. I warned of impending trouble from the worm, which, thankfully did not emerge over the weekend. I really thought the traffic levels would be of importance, but indeed, there was little impact on global traffic levels. This is one of those cases where I am really glad I was wrong!

Now that the majority of the scanning and traffic spikes are over, we are waiting for the other shoe to drop on this attack. The initial worm spread and compromise was likely only the first phase of the attacker’s plans. They now have an immense network of bot-infected hosts at their command. What they will do with them and how they will focus these systems on compromise remains to be seen. Given the sophistication of Conflicker and the “intelligence” of its design and scanning code, the forthcoming use could be a pretty creative and powerful threat vector. We may well see some new form of attack or probe that we have not encountered before.

It is, of course, critical that organizations and individuals move to identify and mitigate any infected hosts. The less bot-infected hosts for the attackers to command, the better. The problem is that many of the compromised systems are in locales with limited IT knowledge resource levels. In many of the countries where infected systems are concentrated, IT admins and tech savvy users are difficult to locate and even harder to afford. This means that while some of the systems may get cleaned up, there is still likely to be a significant army of infected zombies for the bot-herder(s) to wield.

In general, in this case, other than mitigating compromised hosts, there is little you can do beyond standard security practices. You can deploy detective capabilities around logging and vision-enhancement tools like HoneyPoint, but other than the usual, there is little focused risk minimization you can do for this one.

My best advice is to remain vigilant, keep up to date and keep working to better the security across your organization. Eventually, the other shoe will drop, and when it does, we will have to do our best to turn aside whatever happens.