Conficker: The Worm That Exploited Windows Flaw MS08-067

On October 23, 2008, Microsoft did something rare: it released a patch outside its monthly cycle, without waiting for the next Patch Tuesday. Bulletin MS08-067 fixed a flaw in the Windows Server service, and the company warned that attack code was already in the wild. About a month later came the worm that turned that flaw into an epidemic: Conficker. Nearly twenty years on, it is still cited in security reports as the price of leaving machines unpatched.

What the MS08-067 flaw was

The vulnerability sat in the Server service, which Windows uses to share files and printers over the network, and was triggered by a specially crafted RPC request. The result: unauthenticated remote code execution. On systems such as Windows 2000, XP and Server 2003, a machine only had to be reachable on the network to be attacked, with no user click required.

According to Microsoft itself, the patch went out of band precisely because of active exploitation. A public exploit appeared shortly after, and Conficker began circulating in November 2008.

What is Conficker?

Conficker (also called Downadup or Kido) is a Windows worm that spreads across networks by exploiting MS08-067 and turns infected machines into a botnet. Being a worm, it copies itself from machine to machine without relying on attachments or clicks.

How it spread and hid

The first versions attacked only through the RPC flaw. Later variants, such as Conficker B, gained other paths: USB drives with AutoRun and network shares protected by weak passwords, guessed from a list. If your fleet used the same administrator password on many machines, the worm took advantage.

To avoid being taken down, it also defended itself: it blocked access to antivirus vendor sites and Windows Update, making cleanup harder on exactly the machines that needed the patch.

Why was the botnet so hard to take down?

Because Conficker did not depend on a fixed server: each infected machine generated, by algorithm, a list of domains to fetch instructions from. This is the domain generation algorithm (DGA) concept. The botnet's controllers only had to register one of those domains at the right moment. Defenders had to predict and block the domains for every single day.

That is what the response group formed around the worm tried to do. On February 12, 2009, Microsoft announced a partnership with industry and organizations, including ICANN, Symantec, VeriSign and F-Secure, and offered US$250,000 for information leading to the arrest and conviction of those responsible. The variant set to change its domain pattern from April 1, 2009 generated huge press expectations, and the day passed without the promised apocalypse.

How many machines were infected?

There is no exact number, and estimates vary by source and year. Researchers in the response group reported millions of infected machines, and a 2010 ESET analysis still spoke of about 6.5 million hosts. The key point is not the exact figure: the flaw had a patch available since October 2008, and the worm thrived anyway. A year later, Computerworld reported that around 10% of systems were still missing the fix.

What you can do today

Conficker itself is practically retired, but the attack pattern repeats. The same logic of an exposed, unpatched SMB service showed up in WannaCry in 2017. Practical steps:

• Update Windows and retire anything that no longer gets patches. Unsupported systems are permanent targets.
• Never expose SMB (ports 139 and 445) to the internet, and segment the internal network so one infected machine cannot reach all the others.
• Use unique local administrator passwords on every machine. Reused passwords are this kind of worm's favorite propagation route.
• Disable AutoRun for removable media and distrust any USB drive you find lying around, as in the BadUSB case.
• Monitor unusual DNS traffic: many queries for random, nonexistent domains is the typical trail of a DGA.

The bigger lesson

Conficker did not need an unknown flaw. It needed a known and fixed flaw that millions of machines were slow to receive. The same goes for the Morris Worm of 1988, the first internet worm: security history is, in large part, the history of patches that were never applied.

If you want to keep going on the same track, read about Sasser, another worm that took down Windows XP through a no-click flaw.

Sources: Microsoft (bulletin MS08-067 and the Feb 12, 2009 announcement on the Conficker response), Help Net Security, Computerworld and ESET/WeLiveSecurity.