Conficker/Downadup news

[SysAdMini]

There is one thing which has not mentioned in all the reports about Downadup.

Downadup doesn't use domain names in HTTP requests. It does a DNS lookup first
and then uses the IP address for the request.

This makes blacklisting of domain names on a proxy server completely useless.
I made this experience myself.

[SysAdMini]

Some tricks from Conficker's bag
http://isc.sans.org/diary.html?storyid=5830

[SysAdMini]

Kaspersky, OpenDNS Collaborate to Slow Conficker Worm
http://www.pcworld.com/businesscenter/article/159165/kaspersky_opendns_collaborate_to_slow_conficker_worm.html

[SysAdMini]

Downadup: Playing with Universal Plug and Play
https://forums.symantec.com/t5/Malicious-Code/Downadup-Playing-with-Universal-Plug-and-Play/ba-p/383244#A234

[SysAdMini]

More tricks from Conficker and VM detection
http://isc.sans.org/diary.html?storyid=5842

[SysAdMini]

Coalition Formed in Response to W32.Downadup
https://forums.symantec.com/t5/Malicious-Code/Coalition-Formed-in-Response-to-W32-Downadup/ba-p/388129

[Serg]

Microsoft offers $250,000 reward for Conficker arrest and conviction.
http://www.microsoft.com/Presspass/press/2009/feb09/02-12ConfickerPR.mspx?rss_fdn=Press%20Releases
 PS. Sorry for my stupid paint brush

[SysAdMini]

PS. Sorry for my stupid paint brush

Nice. 

[SysAdMini]

Conficker links by isc.sans.org
http://isc.sans.org/diary.html?storyid=5860

[SysAdMini]

An Analysis of Conficker's Logic and Rendezvous Points
http://mtc.sri.com/Conficker/

[SysAdMini]

Downadup: Locking Itself Out
https://forums.symantec.com/t5/Malicious-Code/Downadup-Locking-Itself-Out/ba-p/389837

[SysAdMini]

Making Conficker Cough Up the Goods
http://vrt-sourcefire.blogspot.com/2009/02/making-conficker-cough-up-goods.html

[SysAdMini]

Downadup—Advanced Crypto Protection
https://forums.symantec.com/t5/Malicious-Code/Downadup-Advanced-Crypto-Protection/ba-p/391311

[SysAdMini]

Conficker Collateral Damage for March 2009
http://www.sophos.com/security/blog/2009/03/3457.html

[SysAdMini]

Downadup/Conficker/Kido Infection-traffic analysis
http://annysoft.wordpress.com/2009/02/01/downadupconfickerkido-infection-traffic-analysis/