Conficker använder MD6

Den nyss fastställda standarden MD6 från NIST (uppföljaren till MD5) används av den skadliga koden Conficker samt 4096-bit RSA. Den eller de personer som tagit fram Conficker har mycket god kunskap om kryptografi vilket kan bevisas genom att den första implementationen av Conficker innehöll en brist som även MD6 hade men som sedan korrigerades av Dr. Rivest:s grupp som har tagit fram MD6 och efter ett tag så korrigerades även Conficker:

In evaluating this mechanism, we find that the Conficker authors have devised a sophisticated encryption protocol that is generally robust to direct attack.  All three crypto-systems employed by Conficker’s authors (RC4, RSA, and MD-6) also have one underlying commonality.  They were all produced by Dr. Ron Rivest of MIT.  Furthermore, the use of MD-6 is a particularly unusual algorithm selection, as it represents the latest encryption hash algorithm produced to date.  The discovery of MD-6 in Conficker B is indeed highly unusual given Conficker’s own development time line.  We date the creation of Conficker A to have occurred in October 2008, roughly the same time frame that MD-6 had been publicly released by Dr. Rivest (see http://groups.csail.mit.edu/cis/md6).   While A employed SHA-1, we can now confirm that MD-6 had been integrated into Conficker B by late December 2008 (i.e., the authors chose to incorporate a hash algorithm that had literally been made publicly available only a few weeks earlier).

• Mer information om MD6: groups.csail.mit.edu/cis/md6
• Längre analys: mtc.sri.com/Conficker/addendumC