Conficker: the worm that infected millions of Windows computers

In November 2008, a worm called Conficker, also known as Downadup, began to spread through a flaw in Windows that Microsoft had fixed a month earlier. A worm is a program that spreads from computer to computer on its own. One year later, between 5 and 13 million computers were infected, according to the Conficker Working Group, an alliance of companies, domain registries and researchers that coordinated the defense.

How it worked

Windows computers share files and printers through a part of Windows called the Server service. One of its functions tidies up file paths, the addresses of files, that arrive over the network. A crafted path overflowed a memory area of fixed size, a buffer. On Windows 2000, Windows XP and Windows Server 2003, no login was needed for this, so a single network request could run code with full system rights. Microsoft rated the flaw critical for these versions and important for Windows Vista and Windows Server 2008.

Conficker used the flaw to move from computer to computer over port 445, the network port of Windows file sharing, and it preferred computers in the same local network. Later versions also guessed weak passwords of shared folders and copied themselves to USB sticks.

What made Conficker hard to stop was the way it received updates. Infected computers did not contact one fixed server. Instead, every day each of them computed a new list of random-looking domain names, the names that web addresses are made of, and looked for updates there. The first versions used 250 names a day; from April 1, 2009, a later version used 50,000 a day, of which each computer tried 500. To cut off the updates, defenders had to block or register these names all over the world before the worm’s authors could use them. A later version also let infected computers pass updates directly to each other and switched off security tools.

Reach: millions of computers

No one can count infected computers directly. Researchers estimate their number from the outside: they record the traffic that arrives at large blocks of internet addresses, or they take over domain names that the worm contacts and log the computers that call, a method called a sinkhole.

The Conficker Working Group estimates that between 5 and 13 million computers, behind about 6 million internet addresses, were infected one year after the first version appeared. In January 2009, the security firm F-Secure had estimated 15 million. The working group says others found that figure too high, but that “nearly everyone” put the number above five million.

The methods can disagree widely. On January 25, 2009, a sinkhole logged 1.51 million infected addresses and CAIDA’s network telescope 1.27 million, but only 580,722 addresses appeared in both.

The telescope also shows how fast the worm took off. It counts the computers that try to reach Windows file sharing on its addresses:

In January 2009, three months after the fix, the security firm Qualys estimated that 30 % of computers running Windows were still unpatched. No primary source puts a figure on the damage that Conficker caused.

The fix and the response

Microsoft published the fix, security update MS08-067, on Thursday, October 23, 2008, outside its regular monthly patch day. At that time, Microsoft already knew of “limited, targeted attacks” on the flaw by a malicious program called Gimmiv.A.

On February 12, 2009, Microsoft announced that it was working with the industry to disrupt the worm. It also offered a reward of USD 250,000 for information leading to the arrest and conviction of those responsible.

The Conficker Working Group brought together Microsoft, ICANN, the organization that coordinates domain names, the registries that manage domain names under endings such as .com, antivirus vendors and researchers. A later version of the worm was set to switch to 50,000 domain names a day on April 1, 2009. In less than three weeks, the group organized to coordinate with more than 100 countries and to block more than 50,000 domains per day.

This did not stop the worm entirely. The later version still reached nearly a million computers that had an earlier version. In April 2009, more than a million internet addresses were infected with it; by early December 2009, there were still 300,000 to 400,000.