Counting Confickers
Now that the ambiguity about what is going to happen on April 1 (nothing) is behind us, the next question that seems to be on everyone's mind is how many infections are really out there. We've been holding off on releasing our numbers because we keep seeing the numbers climb considerably each day.
Context & Ripple Effects
Two weeks after Bits framed the April 1 activation question as either joke or disaster, the answer arrived as an anticlimax: Conficker's anticipated switch-flip produced no visible effect. What did change was the measurement problem — with the deadline passed, attention shifted from what the worm would do to how many machines it already holds.
IBM Internet Security Systems says it delayed publishing its infection estimate because counts keep climbing considerably each day, while Zero Day picked up the same story, noting eyeball-based techniques like eye-charts and maps. That follows Ars Technica's new Conficker detection method debuted on March 31 — the industry now has both better instruments and no agreed denominator, which is why vendor numbers diverge.
First-order effects
- Security vendors are racing to publish infection counts on a moving target — IBM ISS withholding its figure daily rather than stake credibility on a number that climbs considerably each day.
- Enterprises that braced for April 1 get no all-clear signal from the non-event itself; the only usable risk metric is an infection census nobody has finalized.
Second-order effects
- Detection tooling becomes the competitive battleground: whoever ships a reliable remote-counting method, like the eye-chart technique Zero Day describes, gains the de facto authority over how big Conficker is reported to be.
- Divergent vendor estimates force customers to triangulate between firms rather than trust any single count, raising the stakes on whose methodology gets cited in mainstream coverage.
Third-order effects
- If botnet sizing stays contested, the industry drifts toward standardized remote-detection methods as infrastructure — less about cleaning infected hosts than about measuring them, with the largest installed-base estimates shaping policy and insurance conversations.
- A worm whose payload underdelivers but whose population keeps growing reframes the threat model: dormant scale matters more than activation day, pushing monitoring toward continuous enumeration of compromised machines.
The trend: Botnet incidents are becoming measurement contests, where the vendors who can count infections remotely define the story more than the malware's own behavior does.