Conficker outlived its patch and forced a coordinated industry defense

What happened

On 23 October 2008, Microsoft released a critical, out-of-cycle security bulletin for a flaw in the Windows Server service that could let an unauthenticated attacker run code on a vulnerable machine over the network. Within weeks, a worm that came to be called Conficker began exploiting the same flaw and, according to ICANN's later review of the response, continued spreading for years afterward by also guessing weak network passwords and abusing removable drives, even as security vendors and registries fought to block the domains it used to receive instructions.

Confidence and limits

The ICANN account was written by the organization's senior security technologist based on the working group's own records, and it is detailed about dates, participants and mechanics. It draws on Shadowserver Foundation tracking data for infection counts, which the report describes as estimates that vary widely and which it says remained in the millions more than a year after the initial patch. The report is explicit that it documents containment, not eradication, and it does not identify the malware's authors.

Why it mattered

Conficker's writers responded to each containment step by generating more candidate domains across more top-level domains, eventually forcing the ad hoc group, which became known as the Conficker Working Group, to coordinate with more than 100 registries. The review credits the effort with disrupting the botnet's command channel and demonstrating that competing registries, vendors and law enforcement could act together at speed, but it also records the response as heavily dependent on volunteer effort, informal trust networks and goodwill that, the report says, would not scale to a second simultaneous incident.

Defensive takeaway

Verify that any systems still running the operating system versions covered by the 2008 bulletin, if any remain in your environment for legacy reasons, are isolated from untrusted networks and removable media, since the underlying pattern, a patched flaw that persists through weak passwords and disconnected assets, recurs in later worms.

• Do you have an inventory that can tell you, within a day, which internal hosts are missing a specific critical patch?
• Are local administrator and service account passwords on your network unique per host, or could one guessed password unlock many machines?
• Would your organization notice a sudden increase in blocked outbound connections to newly registered domains, a common sign of a domain-generation-algorithm botnet?

Conficker is remembered less for what it did, since the report describes no publicly confirmed destructive payload ever being activated, than for what it required of defenders: a patch six months old was not enough on its own, and stopping the worm took a coordination structure that did not previously exist among competing registries and vendors.