Millions of computers worldwide running Microsoft Windows are under assault by a multistage worm attack, reports The New York Times.
"In recent weeks a worm, a malicious software program, has swept through corporate, educational and public computer networks around the world. Known as Conficker or Downadup, it is spread by a recently discovered Microsoft Windows vulnerability, by guessing network passwords and by hand-carried consumer gadgets like USB keys.
Experts say it is the worst infection since the Slammer worm exploded through the Internet in January 2003, and it may have infected as many as nine million personal computers around the world.
Worms like Conficker not only ricochet around the Internet at lightning speed, they harness infected computers into unified systems called botnets, which can then accept programming instructions from their clandestine masters. “If you’re looking for a digital Pearl Harbor, we now have the Japanese ships steaming toward us on the horizon,” said Rick Wesson, chief executive of Support Intelligence, a computer security consulting firm based in San Francisco."
Security researchers at F-Secure say the worm is proliferating at a rate of 1 million machines a day and some security experts say it may have already infected more than 10 million machines, reports the Telegraph.
Another interesting wrinkle is that the worm can be spread much like HIV can be among needle users. Via the Telegraph again:
"Security experts say that the virus is being unwittingly spread by computer users who are using USB memory sticks. The virus is easily transferred from an infected machine to a clean machine if the same USB stick is plugged into each."
As the infection continues to spread, security researchers do not yet know rationale behind the botnet: Will it send spam? Will it infect other computers? Or will it steal personal information?
Windows has provided a patch to plug up the vulnerability but Qaulys estimates 30 percent of computers running Microsoft Windows have yet to download it.
Mike Wendland, a technology columnist for the Detroit Free Press, however, is skeptical of security firms that report security flaws and also sell security software.
"[I]t's believed to be one of those worms that will allow a master hacker somewhere to turn the infected machines into so-called botnets, or a vast army of zombie-like computers, able to be controlled and unleashed to do some even greater harm."
Heard it all before, haven't we?
In fact, I've heard it so many times that the cynical reporter part of me starts to wonder if the anti-virus software makers don't have a financial need to somehow get together and get everybody so worked out that they rush out to buy more software.
But still, Wendland says everyone should do everything they can to protect themselves. His "same old advice:" make sure you download all Microsoft security patches; make sure you have antivirus software and keep it up-to-date; and change your passwords and make them more difficult to crack.