Conficker: the rest is probably not silence

So, nothing happened?

Well, yes. Our labs, who’ve been monitoring carefully, note that Conficker changed communication protocols, just as the code said it would.

No doubt in the fullness of time, the botnet will start doing what botnets do: it would be bizarre to put this much effort into a project and then not try to make some profit out of it. And we’ll still be watching.

In the meantime, I suspect, based on past experience, that two things will happen.

• The very people outside this industry who hyped the issue out of all proportion will now dismiss it as vendor hype, and may even suggest that the whole thing is an urban myth. I do wonder whether by acknowledging and trying to counter the hype, we nevertheless fed it, but the alternative would have been to allow the panic merchants a clear field.
• A few people within this industry, especially those with one of those products that is going to mean the death of antivirus (again), will claim credit for our dodging some sort of bullet.

And life will go on. Whatever. I’m on my way to Cambridge, so any controversies today will have to start without me.

Have a nice day, and don’t pay too much attention to the April Fools.

David Harley BA CISSP FBCS CITP
Director of Malware Intelligence