Conficker virus authors blamed for Valentine’s scam

The hackers behind the Conficker virus may also be responsible for a worm which takes advantage of Valentine’s Day. Speculation about the link comes as security experts continue to wonder when the Conficker creators will exploit the network of infected computers.

The new worm, dubbed Waladec, is a true old-school virus: it spreads through exploiting human gullibility more than system bugs. The scam involves people receiving e-mails, supposedly from people they know, which direct them to a Web page containing a selection of 12 different images of hearts.

The recipient then has to guess which one is for them. When they guess correctly (and it appears every guess is correct) they win a prize. Unfortunately this prize takes the form of an executable file and running it leaves you with an infected computer rather than flowers and chocolates. It’s stunning that such primitive tactics still work today, but at one stage this week the virus was responsible for 15 percent of all e-mails worldwide.

Security firm MXLogic suspects the virus is being spread by the same gang which was behind the Storm network, one of the largest networks of hijacked computers that had been infected through similar tactics.

Paul Ferguson, a researcher at Trend Micro, agrees with this theory and says the coding behind the virus suggests the offenders are also responsible for the Conficker virus which has now infected 10 million Windows machines.

Despite the scale of Conficker, there’s still no sign of the people behind the virus actually using the control they have over the machines. That’s particularly surprising as the virus appears to have just passed its peaked, with infected users now removing it quicker than new users are getting infected.

The hope is that the hackers simply screwed up the coding of the virus and there’s a technical reason stopping them exploiting it. But the fear is that they are simply biding their time before unleashing havoc. And the chances are they more interested in fraud than mischief, for example through installing spyware on infected machines to capture credit card details.

There’s also a theory the people behind Conficker don’t intend exploiting it themselves and are instead looking to sell access to the network to other criminals.

• April Fools’ Day deadline may be diversion for Conficker virus
• Microsoft puts 250k bounty on Conficker virus creators
• BitDefender claims it has Conficker killer
• Conficker targeting of Southwest Airlines a red herring
• More details on the Conficker virus