Conficker (AKA Downadup or Kido) Infections Skyrocket To An Estimate 9 Million

There hasn’t been a viral outbreak of this scale for quite some time, Conficker or Downadup as it’s known was only fairly recently discovered (Oct 2008) and has already infected an estimated 9 million machines!

It’s spreading fast though and it auto-updates itself via downloads from random domains making it almost impossible to stop as whatever countermeasures come out, it can just download itself the latest version and bypass them.

It also has multiple infection vectors including traveling via USB drives.

Infections of a worm that spreads through low security networks, memory sticks, and PCs without the latest security updates is “skyrocketing”.

The malicious program, known as Conficker, Downadup, or Kido was first discovered in October 2008. Anti-virus firm F-Secure estimates there are now 8.9m machines infected. Experts warn this figure could be far higher and say users should have up-to-date anti-virus software and install Microsoft’s MS08-067 patch. In its security blog, F-Secure said that the number of infections based on its calculations was “skyrocketing” and that the situation was “getting worse”.

Speaking to the BBC, Graham Cluley, senior technology consultant with anti-virus firm Sophos, said the outbreak was of a scale they had not seen for some time.

The virus targets the services.exe process (Server service) by exploiting the vulnerability associated with the MS08-067 patch.

This was a serious remote execution flaw carried out by making a malformed RPC request, apparently it was reported ‘privately’. But now it seems that perhaps the details of the exploit weren’t that private after all.

According to Microsoft, the worm works by searching for a Windows executable file called “services.exe” and then becomes part of that code.

It then copies itself into the Windows system folder as a random file of a type known as a “dll”. It gives itself a 5-8 character name, such as piftoc.dll, and then modifies the Registry, which lists key Windows settings, to run the infected dll file as a service.

Once the worm is up and running, it creates an HTTP server, resets a machine’s System Restore point (making it far harder to recover the infected system) and then downloads files from the hacker’s web site. Most malware uses one of a handful of sites to download files from, making them fairly easy to locate, target, and shut down. But Conficker does things differently.

It quite advanced even taking system restore out of the picture and downloading new files to update itself and to infect the machine further. It’s sneaky as it downloads from a bunch of seemingly randomly generated URLs making it very difficult to track and stop.

Many machines are infected in China, Brazil, Russia, and India – personally I think this is because piracy is rife in these areas and Microsoft doesn’t allow pirated copies of Windows to use Windows Update (especially with the WGA tool or Windows Genuine Advantage).

Source: BBC News (Thanks Navin)

Posted in: Malware

, , , , ,

Latest Posts:

tko-subs - Detect & Takeover Subdomains With Dead DNS Records tko-subs – Detect & Takeover Subdomains With Dead DNS Records
tko-subs is a tool that helps you to detect & takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services and more.
Arcane - Tool To Backdoor iOS Packages (iPhone ARM) Arcane – Tool To Backdoor iOS Packages (iPhone ARM)
Arcane is a simple script tool to backdoor iOS packages (iPhone ARM) and create the necessary resources for APT repositories.
SharpHose - Asynchronous Password Spraying Tool SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
Axiom - Pen-Testing Server For Collecting Bug Bounties Axiom – Pen-Testing Server For Collecting Bug Bounties
Project Axiom is a set of utilities for managing a small dynamic infrastructure setup for bug bounty, basically a pen-testing server out of the box with 1-line.
Quasar RAT - Windows Remote Administration Tool Quasar RAT – Windows Remote Administration Tool
Quasar is a fast and light-weight Windows remote administration tool coded in C#. Used for user support through day-to-day administrative work to monitoring.
Pingcastle - Active Directory Security Assessment Tool Pingcastle – Active Directory Security Assessment Tool
PingCastle is a Active Directory Security Assessment Tool designed to quickly assess the Active Directory security level based on a risk and maturity framework.

7 Responses to Conficker (AKA Downadup or Kido) Infections Skyrocket To An Estimate 9 Million

  1. navin January 19, 2009 at 5:15 pm #

    cheers!! :)

  2. Bogwitch January 19, 2009 at 8:00 pm #

    There appears to be some discrepancies at to the true number of infected machines, with some reports citing 500,000 unique IP addresses infected.

    I don’t think it matters too much whether it was reported privately or not; once the hotfix is released it will be diffed to see what was fixed from the previous version. From there it is not difficult to work out how to exploit the vulnerability.

    I am not suprised that such a large number of machines are unpatched, given the WGA. Microsoft is damned if they do and damned if they don’t. If all Windows was patched, there would be little effect from this but that would mean Microsoft would have to accept that there are unlicensed copies out there. As it is, there is now more ammo for the ‘Microsoft is insecure’ brigade due to the fact that Microsoft won’t allow patches for rogue systems.
    That said, I was talking to a guy whose organisation had been hit and their copies of Windows were licensed unfortunately, their patching policy was ‘ineffective’!

  3. Morgan Storey January 20, 2009 at 11:39 pm #

    I am of the opinion if you can’t afford/don’t want to pay for windows then go Linux. At least then you get updates, and will have less issues. Windows is good, but if you don’t get updates due to a cracked version then you are part of the problem.
    All my windows machines have this update, and I have seen this virus in the wild on a USB stick, it is a nasty one.

  4. Olafur January 21, 2009 at 10:31 am #

    I must say that hackers to day, that do this are insanly smart :P

    But this virus, and every virus. Can they travel to your computer for no reason (saying you didn’t click on a download), like finding your IP and just going into your computer ?
    Just wondering because I haven’t had a virus protection on my computer for the last year and not a single virus, just simple cookies ?

  5. Extremesecurity January 23, 2009 at 10:31 am #

    Did Downadup/conficker attack your network? I’ve created a batch file for system administrators to clean/patch/cure infected systems in their networks.

    check it out here:

  6. Jhon January 23, 2009 at 5:36 pm #

    I have a few friends who have caught this virus as they have found files on their USB that just appeared but when it gets inside your computer as the article says it alters itself. Apparently it uses a complex algorithm that is able to mutate or change makeing it hard to track. But according to the BBC the worst is yet to come. If the hackers decide to use the virus they can take full control over the systems. Thats if they choose to do it.

  7. dblackshell January 25, 2009 at 6:05 pm #


    Apparently it uses a complex algorithm that is able to mutate or change makeing it hard to track

    When I read stuff like this it makes me laugh, because If malware authors would have to learn something from virus authors, than they should have learned Polymorphism, Metamorphism.

    As for this case, I quite wonder of the “complexity” of the algorithm. I’m no algorithm guru, but have studied some polymorphic viruses till now, so I would be hardly surprised.