Conficker (AKA Downadup or Kido) Infections Skyrocket To An Estimate 9 Million

There hasn’t been a viral outbreak of this scale for quite some time, Conficker or Downadup as it’s known was only fairly recently discovered (Oct 2008) and has already infected an estimated 9 million machines!

It’s spreading fast though and it auto-updates itself via downloads from random domains making it almost impossible to stop as whatever countermeasures come out, it can just download itself the latest version and bypass them.

It also has multiple infection vectors including traveling via USB drives.

Infections of a worm that spreads through low security networks, memory sticks, and PCs without the latest security updates is “skyrocketing”.

The malicious program, known as Conficker, Downadup, or Kido was first discovered in October 2008. Anti-virus firm F-Secure estimates there are now 8.9m machines infected. Experts warn this figure could be far higher and say users should have up-to-date anti-virus software and install Microsoft’s MS08-067 patch. In its security blog, F-Secure said that the number of infections based on its calculations was “skyrocketing” and that the situation was “getting worse”.

Speaking to the BBC, Graham Cluley, senior technology consultant with anti-virus firm Sophos, said the outbreak was of a scale they had not seen for some time.

The virus targets the services.exe process (Server service) by exploiting the vulnerability associated with the MS08-067 patch.

This was a serious remote execution flaw carried out by making a malformed RPC request, apparently it was reported ‘privately’. But now it seems that perhaps the details of the exploit weren’t that private after all.

According to Microsoft, the worm works by searching for a Windows executable file called “services.exe” and then becomes part of that code.

It then copies itself into the Windows system folder as a random file of a type known as a “dll”. It gives itself a 5-8 character name, such as piftoc.dll, and then modifies the Registry, which lists key Windows settings, to run the infected dll file as a service.

Once the worm is up and running, it creates an HTTP server, resets a machine’s System Restore point (making it far harder to recover the infected system) and then downloads files from the hacker’s web site. Most malware uses one of a handful of sites to download files from, making them fairly easy to locate, target, and shut down. But Conficker does things differently.

It quite advanced even taking system restore out of the picture and downloading new files to update itself and to infect the machine further. It’s sneaky as it downloads from a bunch of seemingly randomly generated URLs making it very difficult to track and stop.

Many machines are infected in China, Brazil, Russia, and India – personally I think this is because piracy is rife in these areas and Microsoft doesn’t allow pirated copies of Windows to use Windows Update (especially with the WGA tool or Windows Genuine Advantage).

Source: BBC News (Thanks Navin)

Posted in: Malware

, , , , ,

Latest Posts:

APT-Hunter - Threat Hunting Tool via Windows Event Log APT-Hunter – Threat Hunting Tool via Windows Event Log
APT-Hunter is a threat hunting tool for windows event logs made from the perspective of the purple team mindset to provide detection for APT movements hidden in the sea of windows event logs.
GitLab Watchman - Audit Gitlab For Sensitive Data & Credentials GitLab Watchman – Audit Gitlab For Sensitive Data & Credentials
GitLab Watchman is an app that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally, this includes code, commits, wikis etc
GKE Auditor - Detect Google Kubernetes Engine Misconfigurations GKE Auditor – Detect Google Kubernetes Engine Misconfigurations
GKE Auditor is a Java-based tool to detect Google Kubernetes Engine misconfigurations, it aims to help security & dev teams streamline the configuration process
zANTI - Android Wireless Hacking Tool Free Download zANTI – Android Wireless Hacking Tool Free Download
zANTI is an Android Wireless Hacking Tool that functions as a mobile penetration testing toolkit that lets you assess the risk level of a network using mobile.
HELK - Open Source Threat Hunting Platform HELK – Open Source Threat Hunting Platform
The Hunting ELK or simply the HELK is an Open-Source Threat Hunting Platform with advanced analytics capabilities such as SQL declarative language, graphing etc
trape - OSINT Analysis Tool For People Tracking Trape – OSINT Analysis Tool For People Tracking
Trape is an OSINT analysis tool, which allows people to track and execute intelligent social engineering attacks in real-time.

7 Responses to Conficker (AKA Downadup or Kido) Infections Skyrocket To An Estimate 9 Million

  1. navin January 19, 2009 at 5:15 pm #

    cheers!! :)

  2. Bogwitch January 19, 2009 at 8:00 pm #

    There appears to be some discrepancies at to the true number of infected machines, with some reports citing 500,000 unique IP addresses infected.

    I don’t think it matters too much whether it was reported privately or not; once the hotfix is released it will be diffed to see what was fixed from the previous version. From there it is not difficult to work out how to exploit the vulnerability.

    I am not suprised that such a large number of machines are unpatched, given the WGA. Microsoft is damned if they do and damned if they don’t. If all Windows was patched, there would be little effect from this but that would mean Microsoft would have to accept that there are unlicensed copies out there. As it is, there is now more ammo for the ‘Microsoft is insecure’ brigade due to the fact that Microsoft won’t allow patches for rogue systems.
    That said, I was talking to a guy whose organisation had been hit and their copies of Windows were licensed unfortunately, their patching policy was ‘ineffective’!

  3. Morgan Storey January 20, 2009 at 11:39 pm #

    I am of the opinion if you can’t afford/don’t want to pay for windows then go Linux. At least then you get updates, and will have less issues. Windows is good, but if you don’t get updates due to a cracked version then you are part of the problem.
    All my windows machines have this update, and I have seen this virus in the wild on a USB stick, it is a nasty one.

  4. Olafur January 21, 2009 at 10:31 am #

    I must say that hackers to day, that do this are insanly smart :P

    But this virus, and every virus. Can they travel to your computer for no reason (saying you didn’t click on a download), like finding your IP and just going into your computer ?
    Just wondering because I haven’t had a virus protection on my computer for the last year and not a single virus, just simple cookies ?

  5. Extremesecurity January 23, 2009 at 10:31 am #

    Did Downadup/conficker attack your network? I’ve created a batch file for system administrators to clean/patch/cure infected systems in their networks.

    check it out here:

  6. Jhon January 23, 2009 at 5:36 pm #

    I have a few friends who have caught this virus as they have found files on their USB that just appeared but when it gets inside your computer as the article says it alters itself. Apparently it uses a complex algorithm that is able to mutate or change makeing it hard to track. But according to the BBC the worst is yet to come. If the hackers decide to use the virus they can take full control over the systems. Thats if they choose to do it.

  7. dblackshell January 25, 2009 at 6:05 pm #


    Apparently it uses a complex algorithm that is able to mutate or change makeing it hard to track

    When I read stuff like this it makes me laugh, because If malware authors would have to learn something from virus authors, than they should have learned Polymorphism, Metamorphism.

    As for this case, I quite wonder of the “complexity” of the algorithm. I’m no algorithm guru, but have studied some polymorphic viruses till now, so I would be hardly surprised.