"Anyone who knows the algorithm for generating the domains can reserve one ahead of time and host software that would be uploaded to every instance of the worm. This amounts to a ticking time bomb, said Thomas Cross".. This is plain wrong. It has been discovered/known that Conficker uses signed updates. See the SRI report diagram:

http://mtc.sri.com/Conficker/#fig-validator

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11546/35333#35333