Conficker: the worm that infected millions of Windows computers

In November 2008, a worm called Conficker, also known as Downadup, began to spread. It used a flaw in Windows that Microsoft had fixed a month earlier. A worm is a program that spreads from computer to computer on its own. One year later, between 5 and 13 million computers were infected, according to the Conficker Working Group. This alliance of companies, domain registries and researchers coordinated the defense.

How it worked

Windows computers share files and printers through a part of Windows called the Server service. One of its functions tidies up file paths, the addresses of files, that arrive over the network. A crafted path overflowed a memory area of fixed size, a buffer. On Windows 2000, Windows XP and Windows Server 2003, no login was needed for this. So a single network request could run code with full system rights. Microsoft rated the flaw critical for these versions and important for Windows Vista and Windows Server 2008.

Conficker used the flaw to move from computer to computer over port 445, the network port of Windows file sharing. It preferred computers in the same local network. Later versions also guessed weak passwords of shared folders and copied themselves to USB sticks.

What made Conficker hard to stop was the way it received updates. Infected computers did not contact one fixed server. Instead, each of them computed a new list of random-looking domain names every day and looked for updates there. Domain names are the names that web addresses are made of. The first versions used 250 names a day. From April 1, 2009, a later version used 50,000 a day, of which each computer tried 500. To cut off the updates, defenders had to block or register these names all over the world before the worm’s authors could use them. A later version also let infected computers pass updates directly to each other and switched off security tools.

Reach: millions of computers

No one can count infected computers directly. Researchers estimate their number from the outside. They record the traffic that arrives at large blocks of internet addresses. Or they take over domain names that the worm contacts and log the computers that call. This method is called a sinkhole.

One year after the first version appeared, between 5 and 13 million computers were infected, the Conficker Working Group estimates. They sat behind about 6 million internet addresses. In January 2009, the security firm F-Secure had estimated 15 million. The working group says others found that figure too high, but that “nearly everyone” put the number above five million.

The methods can disagree widely. On January 25, 2009, a sinkhole logged 1.51 million infected addresses and CAIDA’s network telescope 1.27 million. Only 580,722 addresses appeared in both.

The telescope also shows how fast the worm took off. It counts the computers that try to reach Windows file sharing on its addresses:

In January 2009, three months after the fix, the security firm Qualys estimated that 30 % of computers running Windows were still unpatched. No primary source puts a figure on the damage that Conficker caused.

The fix and the response

Microsoft published the fix, security update MS08-067, on Thursday, October 23, 2008, outside its regular monthly patch day. At that time, Microsoft already knew of “limited, targeted attacks” on the flaw by a malicious program called Gimmiv.A.

On February 12, 2009, Microsoft announced that it was working with the industry to disrupt the worm. It also offered a reward of USD 250,000 for information leading to the arrest and conviction of those responsible.

The Conficker Working Group brought together Microsoft, ICANN, domain registries, antivirus vendors and researchers. ICANN coordinates domain names. The registries manage the names under endings such as .com. A later version of the worm was set to switch to 50,000 domain names a day on April 1, 2009. In less than three weeks, the group organized to coordinate with more than 100 countries and to block more than 50,000 domains per day.

This did not stop the worm entirely. The later version still reached nearly a million computers that had an earlier version. In April 2009, more than a million internet addresses were infected with it. By early December 2009, there were still 300,000 to 400,000.