Conficker: 15 Million Machines, One Unpatched Windows Vulnerability
The Conficker worm exploited a Windows buffer overflow (MS08-067), infected an estimated 15 million computers — including military networks in France, Germany, and the UK — and created a resilient botnet whose true purpose was never conclusively determined.
Background
Microsoft released a critical out-of-band patch (MS08-067) in October 2008 for a buffer overflow in Windows Server Service. The patch was urgently deployed but millions of machines — particularly in enterprise and government networks — remained unpatched. Conficker began spreading within weeks.
The Attack
Conficker.A exploited MS08-067 to spread autonomously over networks, also spreading via USB drives and network shares with weak passwords. Later variants (B, C, D, E) added increasingly sophisticated defences: it blocked access to security vendor websites, disabled Windows Automatic Updates, used domain generation algorithms (DGA) with 50,000 domains per day to make C2 blocking impractical, and used peer-to-peer communication between infected machines. Conficker reached nuclear submarines, French military aircraft, UK Ministry of Defence networks, and hospital systems.
Response
Microsoft formed the Conficker Working Group — an unprecedented public-private partnership of antivirus companies, domain registrars, and ICANN — to sinkhole Conficker's domain generation algorithm. The group registered thousands of generated domains to prevent them being used for C2. The botnet was never fully activated for an obvious criminal purpose, leading to speculation it was a nation-state tool.
Outcome
Conficker infected an estimated 15 million machines at its peak in 2009 and had approximately 1–2 million still infected as late as 2015. It pioneered domain generation algorithms, peer-to-peer C2, and botnet resilience techniques that became standard in subsequent malware. The Conficker Working Group set a precedent for public-private partnerships in botnet disruption.
Key Takeaways
- Critical Windows patches must be deployed within days, not months — Conficker specifically targeted the delay window
- USB drives are a significant infection vector in organisations where network patching is current
- Domain generation algorithms make traditional blacklist-based botnet disruption ineffective
- Public-private partnerships between security vendors, registrars, and ICANN can disrupt botnet C2 at scale