Slashdot Mirror
Fully Automated IM Worms on the Way?
nanycow writes "The sudden appearance of a rootkit file in a spyware-laden IM worm attack has set off new fears that malicious hackers are sophisticated enough to launch a fully automated worm attack against instant messaging networks. Researchers say the stage is set for a worm writer to use an unpatched buffer overflow in an IM app to unleash a worm that is capable of infecting millions or users without the use of malicious URLs that require a click."
We need to use Jabber. It will prevent against things like this. Oh wait. It won't. Still, use Jabber anyway, for it is Open Source goodness.
Get your own free personal location tracker
I love all worms, rootkits and virii... shows what crap the microcomputer world has turned into. vm/370 forever!
How is this any different any other services attached to a port on your computer? Whenever a listening program has an overflow vulerability there is the potential for "A fully automated worm." Granted there is a lot of IM software out there, but there have been plenty of ports and services on Windows that have been exploited in a fully automated way in the past. At least IM software is a _bit_ more heterogeneous than Windows.
Spencer Ogden
This was my favorite part.
I use Adium. Should I be worried?
This would mean that people wouldn't be able to instant message each other!
OMFG wut 2 do? u r about 2 c wut i mean cuz the end is near!
Interesting. In humans, a virus may be able to adapt to antibiotics or vaccines over time and continue to survive. Looks like it can happen with computer viruses too.
Is it me or did the article not really explain how the users can become infected without some sort of user interaction? If not, I think the best way to combat this is user education. I know AOL IM can send out "system" instant messages that could be very useful in telling people to avoid these links.
:)
It glosses over good old fashioned buffer overflows, but not much else. Then again, what else do you need?
Is the 'administrator' account privilege - which a majority of Windows user accounts are - not an equivalent to root?
No social engineering by seducing (l)users to click on a link. Real virus multiply themselves!
So what is the issue with this?
My wife's sketchblog Blob[p]: Gastrono-me
If you take into account the Small world phenomenon, this means that these worms will infect everyone in the world in at most six or seven hops.
Send email from the afterlife! Write your e-will at Dead Man's Switch.
If, for example, Microsoft could be held accountable for security problems in their software, such problems would quickly disappear.
And that will happen - whether it's 5 years or 50, people will eventually demand quality software with real warranties.
Its a shame that AIM is so widly used in the workplace even though is so vunerable .... ....
I know our IT department frowns upon it but walking around you still see it used
Its only a matter of time until something like this came out that has the potential to severly damage both corporate and private networks
Can it find Sarah Connor?
Wooooo! Fully automated! Ahhhhh! *runs and screams* Run for your life!
Wasn't Halloween yesterday?
- Kevin
The less confident you are, the more serious you have to act.
This particular payload is awful -- automated rootkit install.
Maybe one day we'll get a series of destructive worms that will render hardware unusable (e.g. no boot, disk overwritten, fan turned off and processor cranked up to do permanent damage, boot flash cleared) -- resulting in successive waves of hardware replacement.
I talked to a guy at a computer store about the aftermath of a worm that cleared the bootflash -- they sold so many new computers!
At that point, I figure Micr$oft will be in big trouble; after you buy your fifth motheboard in a row (and try to recover your data) after "Bukk@keB1ll" versions A through X hit you, you'll consider getting a Mac so you can get work done.
http://www.thebricktestament.com/the_law/when_to_
The editors usage of the term rootkit is correct, and proper. You may as well argue that the usage of 'cockpit' for the pilot seat and control area of an airplane is incorrect. From the relevent wikipedia article.
.exes and registry entries.
Generally now the term is not restricted to Unix based operating systems, as tools that perform a similar set of tasks now exist for non-Unix operating systems such as Microsoft Windows (even though such operating systems may not have a "root" account).
Rootkit is no longer a term restricted to gaining "root" user access. The term now stands for any suite of hack and/or programs (the "kit") that enables the malware to disguise its presence in the OS in a more sophistocated manner than simply having obscurely named
Furthermore, in my entirely humble and sincerely personal opinion, the term is an appropriate, apt, and succinct way of decribing these types of malicious programs, both in distinguishing them from the less deeply embedded malware types, and in emphasising the increased security threat these programs pose.
May the Maths Be with you!
Gee, wiz, a "fully automated" worm using a different attack vector.
Let me ask you something, what *doesn't* constitute a "fully automated" worm? Was there some guy in a back room somewhere, individually infecting people with Code Red?
And IM services are hardly a new vector. If anything, this story should be about how long it has taken these people to figure out that services like AIM and ICQ are used by people with little or no computer knowledge, who will randomly click on things. You know, sorta like email. That's the real new nugget out of all of this, and hardly worth the two pages of ads to read about.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
lol :/
Seriously, it was only a matter of time, and I bet that this really isn't the first example of such activity.
I for one welcome the day that my instant messenging software was added to the list of software I have to periodically get security updates for
With new hardware and operating systems supporting NX (no execute), wouldn't the effects of a buffer overflow be minimized? I may be crazy, but I thought that this was the entire point behind NX.
What is going on here? Who is in charge? I want to make a complaint.
Simply IM me at w0rMzH0seTer and I'll give you all the details...
Don't anthropomorphize computers: they hate that.
Is the 'administrator' account privilege - which a majority of Windows user accounts are - not an equivalent to root?
Strictly speaking the Windows equivalent of 'root' is the hidden 'LocalSystem' account.
According to the Slashdotter's god, Wikipedia:
Generally now the term is not restricted to Unix based operating systems, as tools that perform a similar set of tasks now exist for non-Unix operating systems such as Microsoft Windows (even though such operating systems may not have a "root" account).
I work in the IT department at my college, and in the last week, have encountered two machines infected with this worm. Easily detected as it may be to the expert user, it is a rootkit, hiding from detection. If I had not recognized it, it would have been undetected, as the automated scanning tools did not report it.
OSS or alternative clients like GAIM, Miranda or Trillian are not as widespread, but make it into headlines a few times every year because of security issues, i.e. the last few releases of GAIM patched some vulnerabilities. Maybe it's time to re-emerge this Gentoo as hardened ...
I for one welcome our new hacker overlords (well folks, please but your names below)
It seems to me that a well designed OS should NEVER let a piece of code be invisible. There should be some part of the OS that knows what is running, what invoked it, what file it came from, etc. A well designed OS would know the provenance of every segment of code. This information should be read-only to anything outside of this protected monitoring function. Thus ALL running code would be visible to the user and anti-malware software. And if you add hash-code locks on installed software, then malware wouldn't be able to masquerade as some other normal bit of code or damage anti-malware apps. Malware could still hide in a user-downloaded software, but the tracking function would aid the detection and removal of any unwanted code.
Is there ever a good reason to let software be invisible?
Two wrongs don't make a right, but three lefts do.
When dealing with a worm, always remember: You must not fear. Fear is the mind-killer. Fear is the little-death that brings total obliteration.
If a baby duck is a "duckling," why would anyone want to eat "dumplings?"
Ahh.
So you must be the dude in our engineering dept. that is a unix g0d that takes showers at work because he's too cheap to pay for his hot water.. How ya doin Ron? How's the hot water downstairs?
by the time you manage to re-emerge your gentoo system you will have to do another update because everything will be out of date :)
Re:energy is liberated through blasphemy
woo, I don't need that second cup of coffee this morning. Thanks!
Trolling is a art,
So,
Any developers out there looking to create a mod_msn_chroot ?
"This rootkit hides itself from the user and anti-malware. Why should any software be allowed to run invisibly? ...It seems to me that a well designed OS should NEVER let a piece of code be invisible."
The point of a rootkit is that it alters the behaviour of the OS. Sure, a pre-rootkit kernel wouldn't have let just any code run. But once the rootkit gets in (one way or another), it alters the OS's behaviour. Just like the Sony audio CD rootkit (mentioned in a previous Slashdot article) alters the behaviour of Windows to keep certain kinds of files invisible.
He who lights his taper at mine, receives light without darkening me.
I've been looking for some time for a OSS based transparent filter that would scan for viruses/malware on IM ports. It would alleviate a lot of these problems, anyone seen or heard of anything like that?
It's never a good idea to annoy any UNIX admin or engineer anywhere, ever. We're all watching, always.
Muahaha. hah.
Another vector. Big deal....move along...nothing more to see here. g2g..just got an IM from "37337Hax0r 06" gotta see what this dude wan...shi.uh.oh........
i think a bigger part of the problem, and hopefully this will open their eyes, is that thus far, the big anti-virus companies (symantec and mcafee) will not include IM worms in their definitions. this means that even if you have the most up-to-date windows security patches, and the most up-to-date anti-virus software, you can still be infected by the IM worm. i don't understand why they won't include them as they are, in my opinion, just as dangerous and propogate on their own just like normal email viruses. i deal with the "AIM virus" on a near-daily basis. i keep sending people to download AIMFix. this guy is getting some serious hits to his site, and he's not getting paid for it... these are real viruses, since the definition of a virus is that it gets onto your computer and propogates on it's own. this just doesn't use traditional means (email, network ports). even if you uninstall instant messenger, it's still there waiting to send itself to everyone on yoru buddy list.
please me, have no regrets.
The Saxons feel left out, you insensitive clod!
Oh brother. This is largely splitting hairs, people. In the general sense, admin equivilents are about as root like as they come. You're comparing two different systems so being precise is an impossibility.
A cheap albeit incomplete solution, one which will make the virus-writers work much harder:
1. Encourage people to use non-high-profile clients. It's a lot easier to "take over the world" if 90% of the people are using the same client with the same vulnerabilities than if 30% are using client A, 20% each are using clients B, C, and D, and the remaining 10% are using a variety of other clients.
2. Put a firewall between the application and the network. Again, don't have 90% of the world use the same firewall. It's best if at least part of the firewall sits in front of the OS, i.e. a hardware firewall or a "host-OS-based" firewall in virtual/emulated-hardware environment.
Here's what I see happening in a few years time, when virtualization becomes the norm:
1) everyone has a hardware firewall built into their cable/dsl/whatever box
2) PCs boot into a hypervisor, see #4 below
3) apps run in different security contexts, each having the network, memory, and disk-access privilages that they need and no more. For example, Solitaire will have no disk or network access. A Web browser will have very limited disk access and outgoing-only network access only over certain ports. A "local-only" web browser will be available for reading local html files.
4) The user will be encouraged to run certain applications like web browsers in a "lock box" which will in reality be a virtual machine, with its own firewall mechanism. Multiple VM implimentations or VM-hardening-products will be available so no single VM-related exploit will be shared by "90% of the world." The user will be able to "reset" his lock box at any time, erasing any viruses and malware that have infected it but which haven't "escaped" the VM environment.
Yes, the user can still be infected and yes, he can still be contagious, but instead of "everyone" being vulnerable only a part of the world will be. Furthermore, if people use the VM-lockboxes, they can "cure" themselves quite easily from the most common problems. They'll still need security software for the really nasty stuff, and they'll always need a "boot CD" or equivalent to do a full scan of their system for rootkits and such.
Remember: The goal isn't to wipe out viruses - that's practically impossible. It's to reduce your risk and decrease your recovery time.
Here's an example of how #4 can reduce exposure for web browsing:
Say 90% of people run Windows-2010 or whatever. When they run their web browser, they get to pick from:
IE under Windows VM
Opera under Windows VM
Opera under {pick one of many} Linux VMs
Opera under {pick one of many} BSD VMs
Firefox under {pick one of many} {pick Linux, Windows, or BSD} VMs
{insert other web browser here} under {insert operating system here} VM.
The VM would be bare-bones, just having essential services - including a built-in firewall - and a "screen" that just displayed the web browser. The user wouldn't necessarily see he was under a VM if he was merely browsing. If the web-browser screen output were "exported" to the "main" OS a la X, so much the better, assuming that didn't introduce security holes of its own.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Just because you are only using the program to chat doesn't make it any different than anything else network facing. All any network application does is send data back and forth, it's what that program does with the data that makes it unique.
Well, at least with virtually every IM client, you can block messages from everyone that's not on your buddy list.
I do use AIM (with DeadAIM) because so many folks use it, and AdiumX on my Mac. I don't expect anyone to IM me at random, so I'm simply going to block IMs from anyone not on my list.
Don't be so quick to judge a lot of people I know bicycle to work and then take a shower once they get there.... me being one of them, its good exercise =x
Q: Can I get a virus through AIM? How do I safely share files with AIM? A: Viruses can't be transferred through an Instant Message itself, but it is possible that files attached to an IM may contain viruses or trojans. Also, links sent in an IM may point to webpages that contain viruses and trojans. Even if you know who is sending you a file or a link, you should use caution in opening it. Some viruses/trojans can send harmful links that appear to be from a buddy you know. You should always use good virus protection software, such as McAfee VirusScan, for automatic scanning of all attachments. See AOL Keyword: AOL Virus Protection Center for more information or visit McAfee's Website.
Erm... rootkits (the definition of which I usually think includes "set of tools/OS patches that hide specific files/processes from the sight of users") have just about nothing to do with "root" account as such. I don't know why the heck they're even called that - maybe it was "the k1t that you install after you get r00t".
If you want to call them "kernel modules and userland tool replacements for hiding files and processes", that's just fine with me, but also call them that on Unix as well then, too =)
ANY network-facing application with an exploit should be presumed vulnerable to an automated attack until proven otherwise.
ANY network-facing application should be presumed to be exploitable until proven otherwise.
ANY application should be presumed to be network-facing until proven otherwise.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I might as well take this opportunity to plug my open-source "IM" system (CMC), Gangplank, which doesn't require an IM client.
Gangplank was written to support the standard TELNET protocol, meaning any standard TELNET client can be used to connect to the system. Despite not using a custom client, the server supports remote character echo, full (RFC-compliant) TELNET protocol support, Emacs-style line editing, input redrawing when output occurs, and a full input history buffer -- all in a nonblocking, single-process server driven by a select() loop. The system lacks some features (like file transfer), but it is well-suited for a community of people to communicate with each other via text messages. The server is fast and efficient, and it should be able to support thousands of users on a single server. (I've never been able to test the limits of the server, but it uses negligible CPU time...)
And to stay on topic, using a TELNET client should protect you against "IM worms" since there are a wide variety of independent TELNET client implementations on various operating systems, TELNET has been around for decades and standard clients are probably fairly well debugged by now...
Deven
"Simple things should be simple, and complex things should be possible." - Alan Kay
Uh, hands up who didn't see this coming? No-one?
Its a service used by a large amount of computer illiterate people, has ports open to the net and an easily accessable list of other users to attack. Seriously, what makes this news that someone is exploiting it? Kinda obvious tbh.
Grammar, you moron.
Wouldn't it be possible to send a specially crafted audio stream to VoIP programs such as Skype to explore eventual vulnerabilities on the audio codec routines?
I know it sounds far-fetched, but you know, jpegs were once safe too. Skype had its vulnerabilities (even on Linux), but were there any on the audio codec?
I hate these "must-have-a-firewall-passage" kind of programs, and I've so far managed to keep them out of my network, but now I'm trying hard to convince my boss not to install Skype on a CAD user's PC "because a customer wants to talk with him"!! CAN'T HE USE A PHONE??!
Of course, quoting that (or any) Wikipedia article is trivial, since you might have just changed it to say that.
Damn you, Wikipedia!
This would be really cool if it supporte ASCII based Video chat! Ofcourse that would probably require specialized clients and all...
Randy.Flood@RHCE2B.COM
When you sail in a colander, you should not be surprised to see water leaking through.
1) telnet is insecure. there is no way i would ever open up the telnet ports on my machines. i dont care if you tell me that inside the telnet port is a stash of delicious candies. dont go there girl!
2) It uses "emacs style line editing" not vi style, which would clearly be the superior choice
result: you fail it!
Gee, I didn't know there was such a demand for ASCII-based video chat. Feel free to write the client for that yourself...
I didn't say that the system won't ever have a client of its own -- one of these days, it will. However, I'll make sure that it continues to remain usable from a plain TELNET client, at least for the basic functionality that is already supported. Obviously, fancier features will likely require a client. If you want the fancy features, you take more risk of a security hole. If you want tried-and-true, you can stick with the traditional TELNET client and be sure that you're pretty safe...
There's always trade-offs. My system certainly isn't perfect, but at least it doesn't require a user to install a client. I'm not aware of any other IM system that actually targets TELNET as a client protocol. (Yes, I know that you can make certain systems work with TELNET clients, but it's not the preferred client, and not designed to be a powerful, user-friendly interface.)
Deven
"Simple things should be simple, and complex things should be possible." - Alan Kay
Sometimes I pray for an actual competent anarchist malware writer. Someone who can get the rootkits installed and wait a while for the infection to spread. THEN tell all the infected machines to fry the MOBO and/or the MBR on the HD.
Only then will you see Microsoft and Joe Sixpack get serious about security.
I speak from experience when I tell you that educating users will not solve the world's computing ills. Some users can't/won't be educated.
Again.
Any programmer who let a buffer-overflow bug slip through should be sacked. On the spot. And his boss, too. As well as the numbskull bean-counter who declined the ressources to do proper checking, and the marketoid who ordered the work done by last monday should be be drawn and quartered.
I did some research and I think you could do it with this live-cd:
http://ascii.dyne.org/?info=description
-I haven't tried it, but I'm guessing that there is probably a telnet client on there.
-Ftp push technology is supported, to publish your hascii feed on your online webserver: that is implemented using a simple C code which wraps execution of your unix ftp client.
-It can output to an HTML page with a meta-refresh tag so that it is constantly updating the image.
So, then theoretically, people could even view your webcam with lynx!
P.S. I was mostly kidding about the ASCII webcam feature. But it would be pretty funny to support this, now wouldn't it...
Randy.Flood@RHCE2B.COM
No, your ASCII video is useless against this worm onslaught.
The only way we'll get through this is when people smarten up, and start using an XML based IM.
help me i've cloned myself and can't remember which one I am
Gaim isn't connecting to MSn right now. Has it already happened?
From some people I know. (of course, I (a) am not a bonehead, and (b) am running linux), so it didn't affect me.
But, here's what I saw about it: If others have seen the same thing, I would appreciate info about it:
1) The IM message is:amazing...look http://myspace2k.100free.com/picture22.com
2) The file you get from there is 107008 bytes long, and has a md5sum of a922f6a495c6f62e065a0713fc3ddf75 (that server's been giving the same thing since 9AM or so this morning, just checked it a few minutes ago).
3) Infected computers seem to reconnect to AIM, and also make a connection to 72.20.22.86 port 5238, which as of an hour or so ago, was accepting connections..
4) Neither McaFee, Grisoft, clamav, or trendmicro detect the picture22.com file as being malware: And I'm not really looking forward to infecting a machine on the net myself to see what happens after it's deployed.
I'm not sure where to go next to help these people clean up..
Anyone else got this one? Or know where's the best place for discusssion?
I knew you were kidding, so I'm surprised you even bothered to research it. Of course, I've seen even stranger things, like feeding the video from a TV tuner into an ASCII translation. Incredibly, the example I saw was much more watchable than you would expect, considering the circumstances...
In any event, I don't have a webcam, so it's all moot. And supporting an ASCII webcam would be more of a joke feature than anything. Gangplank is a serious system -- it's designed to perform a basic communication function for its users, and perform it well. What it lacks in bells and whistles, it makes up for in simplicity, efficiency and stability. Convincing people to use it, that's another thing...
Deven
"Simple things should be simple, and complex things should be possible." - Alan Kay
I shouldn't say this but there are already backdoors in AIM. They will backdoor your system after you click on a sound and open your "drives" for sharing without your knowledge.It's a glitch where you can fake the link and cause them to run an exe instead of the wave file. Anyone that connects has full acess.
100 million or so users run the AIM client. How many do you think will switch?
:(
100 million use AOL client. Of those:
90 million see bad press about killer virus
70 million see press recommending specific alternatives
40 million get 0wned and have to repair their computers, 40 more million know someone who did.
10 million corporate users get it banned by their IT people.
Now what was the question again?
Then again you may be right, if IE's 80+% market share in the face of bad press and constant infections is any example.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
=8^[)] I love you! ::cheek pinch::
http://www.hasbro.com/candyland/
Fortunately, the client I use (sirc) is unpopular, low on features, and written in Perl. Good luck trying to exploit that.
Please correct me if I got my facts wrong.
Syric 2005: im going 2 lern 2 tipe 2nite 2
prettykittikat: what?
Syric 2005: Exactly
This is my sig. There are many like it but this one is mine.
Not quite what he ment...
m
en.wikipedia.org/wiki/ASCII_art
www.geocities.com/SouthBeach/Marina/4942/ascii.ht
www.asciiartfarts.com/
Required reading for internet skeptics
Furthermore, Let's get the timeline rolling right now: Start building a Lego robot factory out of... Legos. Don't forget to incoporate building-block manufacturing and recycling units. (This oversight plagued the first few versions of the project. Lego cannibalism is not pretty.) If you fail to do so, I will begin to fade away like Michael J. Fox in Back to the Future.
OK, why would you not use a hard-coded buffer for a chat program? Simply allocate 256 characters (that'd fill about ten lines in a chat; more than enough), then keep reading and discarding characters until you get EOF. Am I missing something? I've never written a chat program, I'm rusty as heck on C/C++ in general, been a while. But don't I remember that this is very easy to avoid? What concept am I missing?
I'll be the first to say "Thanks sony!" wow.. they really do innovate in new areas!
Without competition within the network, there is no incentive to spend money auditing the code. And without openness, nobody else is going to do it.
And on top of that, you get homogenious networks where everyone has the same vulnerability. That's asking for trouble. You've got to be insane to run that stuff.
Contrast that to Jabber. Good luck writing a Jabber worm that goes anywhere, considering everyone is using a different client. (And someone can write their own client, totally overflow-proof in a language like Python or perl, in maybe an hour?) Your only hope is to find a bug in in some commonly-used library like zlib or something, but over the years, that stuff just keeps getting cleaner and cleaner.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
..just checking your damn email every couple of minutes? Also, with the slight delay, maybe - though probably not - people will start typing in semi-coherent sentences again.
If you REALLY neeed to have a conversation with someone in real time, pick up the goddamn phone.
Fucking IM.
s'wut i sed.
Imagine system that can spread malicious code world-wide. System that can bypass all firewalls, antivirus software and locked-down accounts. System that can install any code without much suspition. Imagine Windows Update.
Interesting use of anagrams.
If AOL logs all IM conversations or at least who-messaged-whom type of data, the origin of any worm that spreads via buddy lists can be traced to a single account.