Conficker Summary and Review

This report [PDF, 388 KB] provides a chronology of events related to the containment of the Conficker worm. It provides an introduction and brief description of the worm and its evolution, but its primary focus is to piece together the post-discovery and -analysis events, describe the containment measures chronologically, and describe the collaborative effort to contain the spread of the worm. The author captures lessons learned during a containment period spanning nearly a year and describes recent activities that attempt to apply the lessons learned so that the security and DNS communities can be better prepared for future attacks that exploit the global DNS.