Scourge · November 21 2008

The Scourge of Conficker

Chronicle

On 21 November 2008 the first variant of Conficker was detected, exploiting the Windows Server service flaw fixed a month earlier by out-of-band bulletin MS08-067. It also spread by guessing weak admin passwords and hopping from USB stick to USB stick. To receive orders it generated fresh lists of domain names every day. It infected millions of computers in more than 190 countries, including military and government networks: the largest worm outbreak since Slammer.

Lesson learned

It prompted the Conficker Working Group, an unprecedented alliance of companies, domain registries and researchers that became a model for many later operations.

Prayer of reparation

O Conficker, who changed address every day, deliver us from "admin123" passwords and from USB sticks found in the car park. Amen.

How it is remembered

Remembered by disabling AutoRun on removable media, enforcing strong passwords on admin accounts and installing out-of-band patches on the day they ship.