Slashdot Mirror
Fully Automated IM Worms on the Way?
nanycow writes "The sudden appearance of a rootkit file in a spyware-laden IM worm attack has set off new fears that malicious hackers are sophisticated enough to launch a fully automated worm attack against instant messaging networks. Researchers say the stage is set for a worm writer to use an unpatched buffer overflow in an IM app to unleash a worm that is capable of infecting millions or users without the use of malicious URLs that require a click."
How is this any different any other services attached to a port on your computer? Whenever a listening program has an overflow vulerability there is the potential for "A fully automated worm." Granted there is a lot of IM software out there, but there have been plenty of ports and services on Windows that have been exploited in a fully automated way in the past. At least IM software is a _bit_ more heterogeneous than Windows.
Spencer Ogden
Its a shame that AIM is so widly used in the workplace even though is so vunerable .... ....
I know our IT department frowns upon it but walking around you still see it used
Its only a matter of time until something like this came out that has the potential to severly damage both corporate and private networks
This particular payload is awful -- automated rootkit install.
Maybe one day we'll get a series of destructive worms that will render hardware unusable (e.g. no boot, disk overwritten, fan turned off and processor cranked up to do permanent damage, boot flash cleared) -- resulting in successive waves of hardware replacement.
I talked to a guy at a computer store about the aftermath of a worm that cleared the bootflash -- they sold so many new computers!
At that point, I figure Micr$oft will be in big trouble; after you buy your fifth motheboard in a row (and try to recover your data) after "Bukk@keB1ll" versions A through X hit you, you'll consider getting a Mac so you can get work done.
http://www.thebricktestament.com/the_law/when_to_
Not quite. Biological viruses evolve. Computer viruses, however, are products of intelligent design, for certain values of 'intelligent'.
Computer viruses aren't a force of nature. Behind every one of them is a malicious programmer.
Eventually, I imagine we'll see polymorphic and self-modifying code reach the point where it can evolve in the same way as biological viruses, but that's probably quite a way off. The nearest I've heard of to that is viruses programmed to alter their appearance to avoid detection.
Real Daleks don't climb stairs - they level the building.
The editors usage of the term rootkit is correct, and proper. You may as well argue that the usage of 'cockpit' for the pilot seat and control area of an airplane is incorrect. From the relevent wikipedia article.
.exes and registry entries.
Generally now the term is not restricted to Unix based operating systems, as tools that perform a similar set of tasks now exist for non-Unix operating systems such as Microsoft Windows (even though such operating systems may not have a "root" account).
Rootkit is no longer a term restricted to gaining "root" user access. The term now stands for any suite of hack and/or programs (the "kit") that enables the malware to disguise its presence in the OS in a more sophistocated manner than simply having obscurely named
Furthermore, in my entirely humble and sincerely personal opinion, the term is an appropriate, apt, and succinct way of decribing these types of malicious programs, both in distinguishing them from the less deeply embedded malware types, and in emphasising the increased security threat these programs pose.
May the Maths Be with you!
Gee, wiz, a "fully automated" worm using a different attack vector.
Let me ask you something, what *doesn't* constitute a "fully automated" worm? Was there some guy in a back room somewhere, individually infecting people with Code Red?
And IM services are hardly a new vector. If anything, this story should be about how long it has taken these people to figure out that services like AIM and ICQ are used by people with little or no computer knowledge, who will randomly click on things. You know, sorta like email. That's the real new nugget out of all of this, and hardly worth the two pages of ads to read about.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
I was actually going to suggest the same thing. AFAIK, it's not IM protocol that are insecure to the point of allowing worms to propogate, it's the client. Jabber is a standardized protocol, allowing for a multitude of different clients.
Different clients are unlikely to share the same vulnerabilities, so, with a wide variety of clients in use, you're not going to have one single worm that can infect a huge portion of the network.
tasks(723) drafts(105) languages(484) examples(29106)
With new hardware and operating systems supporting NX (no execute), wouldn't the effects of a buffer overflow be minimized? I may be crazy, but I thought that this was the entire point behind NX.
Intelligence is such a relative term isn't it?
It seems to me that a well designed OS should NEVER let a piece of code be invisible. There should be some part of the OS that knows what is running, what invoked it, what file it came from, etc. A well designed OS would know the provenance of every segment of code. This information should be read-only to anything outside of this protected monitoring function. Thus ALL running code would be visible to the user and anti-malware software. And if you add hash-code locks on installed software, then malware wouldn't be able to masquerade as some other normal bit of code or damage anti-malware apps. Malware could still hide in a user-downloaded software, but the tracking function would aid the detection and removal of any unwanted code.
Is there ever a good reason to let software be invisible?
Two wrongs don't make a right, but three lefts do.
"This rootkit hides itself from the user and anti-malware. Why should any software be allowed to run invisibly? ...It seems to me that a well designed OS should NEVER let a piece of code be invisible."
The point of a rootkit is that it alters the behaviour of the OS. Sure, a pre-rootkit kernel wouldn't have let just any code run. But once the rootkit gets in (one way or another), it alters the OS's behaviour. Just like the Sony audio CD rootkit (mentioned in a previous Slashdot article) alters the behaviour of Windows to keep certain kinds of files invisible.
He who lights his taper at mine, receives light without darkening me.
What's stopping MS from implementing a Unix-style security model?
Your mom. Litereally.
I understand users/groups/file permissions. I assume you do too. What about your parents?
--You will rephrase your request for me to go to hell. Goto statements are not acceptable programming constructs
I understand users/groups/file permissions. I assume you do too. What about your parents?
What would they need to know? There's a separate password to access the "administrator" account. When you buy the computer (presumably preloaded with Windows) you set that password and create accounts for everybody in your family. From that point on you only use that password to install software for everybody to use.
It shouldn't even be required to use that password to install software for just yourself. If I go out and buy Sim City 4000 and I only want to be able to use it on my user account, then why should I need admin rights to install it? This would be the same behavior as --prefix on Unix -- but a lot more user friendly.
You'd still have the problem of social engineering (download our new screensaver!!!!) but it would be a lot easier to tell people to never enter that password when prompted by a website then it would be to block access to bad scripts or ActiveX controls.
They will try it in the next version of Windows apparently. I don't see what's stopping it from being in XP SP3 (or why it wasn't in SP2 for that matter). That would be even better because it would give software publishers time to get used to the model before Vista is released.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
Unless it exploits another remote or local security hole that hasn't been patched.
Besides, your statement about Windows is rather generic and so incorrect. I logon as a normal (i.e. limited) user, so unless there's an unknown security hole (every exploit known so far uses a known security hole and I patch quickly) then my whole system will not be compromised. My local account might be affected, but that concept applies to OS X too.
I shouldn't say this but there are already backdoors in AIM. They will backdoor your system after you click on a sound and open your "drives" for sharing without your knowledge.It's a glitch where you can fake the link and cause them to run an exe instead of the wave file. Anyone that connects has full acess.