History and stories
Conficker: the worm that infected millions and then waited
Conficker spread to millions of computers in more than 190 countries. Researchers spent months waiting to see what it would do.
1 min readStory
The short version
In late 2008, a worm spread to millions of Windows computers through a known flaw and weak administrator passwords. Then it mostly did nothing.
The story
Conficker was first spotted in November 2008. It spread through a Windows flaw that Microsoft had fixed in an emergency update the month before. Inside networks, it also tried guessing administrator passwords from a list of common ones, and it copied itself onto USB drives.
It became the largest worm infection since 2003, reaching millions of government, business and home computers. Police in some countries, a few hospitals and parts of the UK and French militaries reported infections.
Conficker linked infected computers into a network its authors could control. Security companies, internet registries and researchers formed a group to block the web addresses it used to call home. A date in its code, April 1, 2009, caused worldwide worry. On the day, almost nothing happened.
Why it mattered
Despite its size, Conficker did little visible damage. It still took enormous effort to clean up, and infected computers were found for years afterward.
The lesson today
The two ways it spread are still the most common: missing updates and weak passwords on administrator accounts. Install updates promptly, give administrator accounts strong unique passwords, and limit who has them.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.