Ending this module I'd like to show you a specific case study this case study will indicate the methods
for dealing with a disaster let's assume that this disaster is for example a virus outbreak.
We'll talk about the Conficker virus.
The picture below shows you the propagation speed of the virus Conficker spread automatically and without
the need of user interaction.
To infect a computer the virus did not require a user to behave in a certain manner.
One of the propagating vectors for configure was the security bug found in the Windows system.
It was detected and an update fixing the bug was created a month before the outbreak.
But this was just one method in which the virus spread.
The software manufacturer in this case Microsoft to find an effective procedure preventing the escalation
of the virus after the problem was detected.
It was documented in a knowledgebase article.
The company also set up a reward of $250000 for helping to identify the authors of the virus.
Conficker had five known versions.
It's rather interesting that the versions would update quickly.
For example if you were infected with Version A It would almost immediately update itself to version
C.
Let's find out what should be done if Conficker attacked us.
The first step is to detect it detection methods was covered in the previous part of the lecture configure
and other viruses are relatively simple to detect.
It is enough to know that basic vectors and spreading techniques configure made regular connections
to five hundred randomly selected domains that were chosen from a pool of over 50000 domains after they
were infected the virus moved on to infect other machines.
Web applications in effect affected machines would practically shut down configure used 100 percent
of the bandwidth for its own purposes.
It's hard to miss this symptom.
The virus also spread through cracking passwords if you unable to count lockouts after 50 incorrect
attempts a recognizable attack symptom was the message that users can't log into their accounts because
a limit of unsuccessful logging attempts has been reached.
Assume that we've detected the attack already.
Of course in the end a virus scanner should have helped this in that.
Now we need to determine the scope of the attack.
You might remember that the most important question that we need to answer is what resources have been
or could have been accessed by attackers.
We also need to find a way to prevent the attack from spreading.
In the case of Configure you could use dedicated tools for this purpose.
Such countermeasures were developed because the problem was global in scope.
You could also use the knowledge on the virus vectors and try to remove it manually.