{"data":{"case":{"actions":{"de":["Installiere Microsofts Update **KB958644** (Bulletin MS08-067) auf jedem Windows-Computer, dem es noch fehlt; Windows 2000, XP und Server 2003 lassen sich ohne Anmeldung angreifen.","Verwende starke Passwörter für freigegebene Ordner: Spätere Versionen des Wurms errieten schwache.","Sorge dafür, dass die Windows-Dateifreigabe auf **Port 445** aus dem Internet nicht erreichbar ist.","Behandle USB-Sticks von ungepatchten Windows-Computern als möglicherweise infiziert: Spätere Versionen kopierten sich auf sie."],"en":["Install Microsoft's update **KB958644** (bulletin MS08-067) on every Windows computer that still lacks it; Windows 2000, XP and Server 2003 can be attacked without a login.","Use strong passwords for shared folders: later versions of the worm guessed weak ones.","Do not let Windows file sharing on **port 445** be reached from the internet.","Treat USB sticks from unpatched Windows computers as possibly infected: later versions copied themselves onto them."]},"criteria":{"damage":{"de":"Keine Primärquelle nennt eine Zahl zum Schaden.","en":"No primary source gives a figure for the damage.","met":false},"exploitation":{"de":"Conficker war ein Wurm, der sich selbstständig von Computer zu Computer verbreitete (Conficker Working Group).","en":"Conficker was a self-spreading worm that moved from computer to computer on its own (Conficker Working Group).","met":true},"reach":{"de":"Ein Jahr nach dem Erscheinen des Wurms waren zwischen 5 und 13 Millionen Computer infiziert (Conficker Working Group).","en":"Between 5 and 13 million computers were infected one year after the worm's release (Conficker Working Group).","met":true},"response":{"de":"Die Conficker Working Group stimmte sich mit mehr als 100 Ländern ab, um täglich mehr als 50.000 Domainnamen zu sperren (Conficker Working Group).","en":"The Conficker Working Group coordinated with more than 100 countries to block more than 50,000 domain names a day (Conficker Working Group).","met":true}},"cves":["CVE-2008-4250"],"cvss":10,"cvss_version":"2.0","cwe":"CWE-94","dates":[{"date":"2008-10-23","key":"patched"},{"date":"2008-11-21","key":"outbreak"},{"date":"2008-12-29","de":"Eine zweite Version des Wurms erscheint","en":"A second version of the worm is released"},{"date":"2009-02-12","de":"Microsoft kündigt ein gemeinsames Vorgehen mit der Branche und 250.000 US-Dollar Belohnung an","en":"Microsoft announces joint action with the industry and a USD 250,000 reward"},{"date":"2009-04-01","de":"Eine spätere Version stellt auf 50.000 Domainnamen pro Tag um","en":"A later version switches to 50,000 domain names a day"},{"date":"2026-05-20","key":"kev"}],"de":{"credit":"Nicht genannt; die Lücke wurde Microsoft vertraulich gemeldet","fixed":"Microsoft-Update MS08-067, KB958644 (23. Oktober 2008)","product":"Microsoft Windows, Serverdienst","summary":"Ein Windows-Wurm suchte täglich unter bis zu 50.000 neuen Domainnamen nach Updates; Verteidiger in über 100 Ländern sperrten diese Namen gemeinsam."},"disclosed":"2008-11-21","en":{"credit":"Not named; the flaw was reported privately to Microsoft","fixed":"Microsoft update MS08-067, KB958644 (October 23, 2008)","product":"Microsoft Windows, Server service","summary":"A Windows worm looked for updates at up to 50,000 new domain names a day, which defenders in over 100 countries worked together to block."},"figures":[{"de":"Millionen Computer ein Jahr nach dem Ausbruch infiziert","en":"million computers infected one year after the outbreak","value":"5–13"},{"de":"Länder, mit denen sich die Verteidiger abstimmten, um die Domainnamen des Wurms zu sperren","en":"countries the defenders coordinated with to block the worm's domain names","value":"100+"},{"de":"der Windows-Computer waren im Januar 2009 noch nicht gepatcht (Schätzung von Qualys)","en":"of Windows computers were still unpatched in January 2009 (estimate by Qualys)","value":"30 %"}],"kev":"2026-05-20","key":"conficker","name":"Conficker","product":"Microsoft Windows","sources":[{"de":"Microsoft-Sicherheitsbulletin MS08-067","title":"Microsoft security bulletin MS08-067","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067"},{"de":"NVD: CVE-2008-4250","title":"NVD: CVE-2008-4250","url":"https://nvd.nist.gov/vuln/detail/CVE-2008-4250"},{"de":"Conficker Working Group: Lessons Learned (2010, PDF, Spiegelkopie)","title":"Conficker Working Group: Lessons Learned (2010, PDF, mirror copy)","url":"https://cyberwar.nl/d/Conficker_Working_Group_Lessons_Learned_17_June_2010_final.pdf"},{"de":"CAIDA: Conficker aus Sicht des UCSD Network Telescope","title":"CAIDA: Conficker as seen from the UCSD Network Telescope","url":"https://www.caida.org/archive/ms08-067/conficker/"},{"de":"Microsoft: Zusammenarbeit der Branche gegen Conficker und 250.000 US-Dollar Belohnung","title":"Microsoft: industry collaboration against Conficker and a USD 250,000 reward","url":"https://news.microsoft.com/2009/02/12/microsoft-collaborates-with-industry-to-disrupt-conficker-worm/"}],"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","year":2008}},"description":"Within a year of November 2008, Conficker infected 5 to 13 million Windows computers. How it spread and how over 100 countries joined the defense.","language":"en","latest_measurement":"2026-10-23","method":"latency-v3","method_page":"https://crackthe.net/method/","source":"https://crackthe.net/","text":"In November 2008, a worm called Conficker, also known as Downadup, began to spread through a flaw in Windows that Microsoft had fixed a month earlier. A worm is a program that spreads from computer to computer on its own. One year later, between 5 and 13 million computers were infected, according to the Conficker Working Group, an alliance of companies, domain registries and researchers that coordinated the defense.\nHow it worked Windows computers share files and printers through a part of Windows called the Server service. One of its functions tidies up file paths, the addresses of files, that arrive over the network. A crafted path overflowed a memory area of fixed size, a buffer. On Windows 2000, Windows XP and Windows Server 2003, no login was needed for this, so a single network request could run code with full system rights. Microsoft rated the flaw critical for these versions and important for Windows Vista and Windows Server 2008.\nConficker used the flaw to move from computer to computer over port 445, the network port of Windows file sharing, and it preferred computers in the same local network. Later versions also guessed weak passwords of shared folders and copied themselves to USB sticks.\nWhat made Conficker hard to stop was the way it received updates. Infected computers did not contact one fixed server. Instead, every day each of them computed a new list of random-looking domain names, the names that web addresses are made of, and looked for updates there. The first versions used 250 names a day; from April 1, 2009, a later version used 50,000 a day, of which each computer tried 500. To cut off the updates, defenders had to block or register these names all over the world before the worm\u0026rsquo;s authors could use them. A later version also let infected computers pass updates directly to each other and switched off security tools.\nInfected PClooks for Windows computers on port 445 Server servicereceives a crafted file path Buffer overflowno login needed on Windows 2000, XP and Server 2003 New victimruns the worm with full system rights Domain listchecks hundreds of new names a day for updates The first four steps spread the worm. The fifth let its authors send it updates. Reach: millions of computers No one can count infected computers directly. Researchers estimate their number from the outside: they record the traffic that arrives at large blocks of internet addresses, or they take over domain names that the worm contacts and log the computers that call, a method called a sinkhole.\nThe Conficker Working Group estimates that between 5 and 13 million computers, behind about 6 million internet addresses, were infected one year after the first version appeared. In January 2009, the security firm F-Secure had estimated 15 million. The working group says others found that figure too high, but that “nearly everyone” put the number above five million.\nThe methods can disagree widely. On January 25, 2009, a sinkhole logged 1.51 million infected addresses and CAIDA\u0026rsquo;s network telescope 1.27 million, but only 580,722 addresses appeared in both.\nThe telescope also shows how fast the worm took off. It counts the computers that try to reach Windows file sharing on its addresses:\nComputers per hour scanning port 445, seen by the UCSD Network Telescope Before November 21, 2008, highest hour3,222 November 21, 2008, highest hour114,911 December 1, 2008, highest hour145,586 Conficker was first seen on November 21, 2008. The telescope sees 1/256 of all IPv4 addresses, the classic internet addresses. Source: CAIDA.\nIn January 2009, three months after the fix, the security firm Qualys estimated that 30 % of computers running Windows were still unpatched. No primary source puts a figure on the damage that Conficker caused.\nThe fix and the response Microsoft published the fix, security update MS08-067, on Thursday, October 23, 2008, outside its regular monthly patch day. At that time, Microsoft already knew of “limited, targeted attacks” on the flaw by a malicious program called Gimmiv.A.\nOn February 12, 2009, Microsoft announced that it was working with the industry to disrupt the worm. It also offered a reward of USD 250,000 for information leading to the arrest and conviction of those responsible.\nThe Conficker Working Group brought together Microsoft, ICANN, the organization that coordinates domain names, the registries that manage domain names under endings such as .com, antivirus vendors and researchers. A later version of the worm was set to switch to 50,000 domain names a day on April 1, 2009. In less than three weeks, the group organized to coordinate with more than 100 countries and to block more than 50,000 domains per day.\nDomain names the worm computed per day Earlier versions250 Later version, from April 1, 200950,000 Of the 50,000 names, each infected computer tried 500 a day. Source: Conficker Working Group.\nThis did not stop the worm entirely. The later version still reached nearly a million computers that had an earlier version. In April 2009, more than a million internet addresses were infected with it; by early December 2009, there were still 300,000 to 400,000.","title":"Conficker: the worm that infected millions of Windows computers","url":"https://crackthe.net/vulnerabilities/conficker/"}