Fully Automated IM Worms on the Way?

nanycow writes "The sudden appearance of a rootkit file in a spyware-laden IM worm attack has set off new fears that malicious hackers are sophisticated enough to launch a fully automated worm attack against instant messaging networks. Researchers say the stage is set for a worm writer to use an unpatched buffer overflow in an IM app to unleash a worm that is capable of infecting millions or users without the use of malicious URLs that require a click."

Comments

Different from other open ports?

[spencerogden]

How is this any different any other services attached to a port on your computer? Whenever a listening program has an overflow vulerability there is the potential for "A fully automated worm." Granted there is a lot of IM software out there, but there have been plenty of ports and services on Windows that have been exploited in a fully automated way in the past. At least IM software is a _bit_ more heterogeneous than Windows.

Re:Different from other open ports?

[ColaMan]

At least IM software is a _bit_ more heterogeneous than Windows.

In this case it doesn't really matter.
Consider a exploit that can get the buddy list out of MSN for example.
Now as most IM's only have one client used by the bulk of people, it becomes trivial to send a copy of the exploit to each person on your list and have a high proportion of them become infected, to progress outwards to friends
  geometrically (unless you have no friends)

This is a hell of a lot more sucessful than your usual pick-a-random-ip-and-hope-it's-exploitable method.

Re:Different from other open ports?

[cowscows]

It's not entirely different, but it's still interesting. Partially because a lot of people are running IM clients. Also interesting is the fact that an IM client generally has a built in list of other vulnerable machines, via a buddy list. Having this list of people could be pretty handy if the worm can manage to spread through the IM protocols themselves, since it could allow infections to spread without relying on sending out masses of random traffic looking for vulnerable machines. That could just make this sort of thing that much more efficient and harder to detect, because the offending traffic might not look all that different than normal IM chatter.

But then again, I don't know much specific about how this all is supposed to work, so I may be wrong.

That is a how a worm or virus should be!

[jurt1235]

No social engineering by seducing (l)users to click on a link. Real virus multiply themselves!
So what is the issue with this?

Very infectious.

[Poromenos1]

If you take into account the Small world phenomenon, this means that these worms will infect everyone in the world in at most six or seven hops.

Re:Very infectious.

[Minwee]

Wow. Just think of how many times Kevin Bacon would get hit by that.

Workplace

[GoodOmens]

Its a shame that AIM is so widly used in the workplace even though is so vunerable
I know our IT department frowns upon it but walking around you still see it used ....
Its only a matter of time until something like this came out that has the potential to severly damage both corporate and private networks ....

Re:Evolution baby

[stinerman]

Ahh... not so fast.

These viruses seem to be intelligently designed. ;-)

The Disease is Awful

[putko]

This particular payload is awful -- automated rootkit install.

Maybe one day we'll get a series of destructive worms that will render hardware unusable (e.g. no boot, disk overwritten, fan turned off and processor cranked up to do permanent damage, boot flash cleared) -- resulting in successive waves of hardware replacement.

I talked to a guy at a computer store about the aftermath of a worm that cleared the bootflash -- they sold so many new computers!

At that point, I figure Micr$oft will be in big trouble; after you buy your fifth motheboard in a row (and try to recover your data) after "Bukk@keB1ll" versions A through X hit you, you'll consider getting a Mac so you can get work done.

Re:Evolution baby

[meringuoid]

In humans, a virus may be able to adapt to antibiotics or vaccines over time and continue to survive. Looks like it can happen with computer viruses too.

Not quite. Biological viruses evolve. Computer viruses, however, are products of intelligent design, for certain values of 'intelligent'.

Computer viruses aren't a force of nature. Behind every one of them is a malicious programmer.

Eventually, I imagine we'll see polymorphic and self-modifying code reach the point where it can evolve in the same way as biological viruses, but that's probably quite a way off. The nearest I've heard of to that is viruses programmed to alter their appearance to avoid detection.

Re:Infection

[LordSnooty]

AOL IM can send out "system" instant messages that could be very useful in telling people to avoid these links.

I do hope you are being humourous, they are exactly the kind of unannounced "system" pop-ups which can lead to user confusion & miseduaction at best, or system infections at worst. Think of Windows Messanger - not IM - with its "you are leaking your address onto the Internet!". Or think of web banner pop-ups masquerading as OS messages. It's no surprise the average user has no understanding of what's a real message and what's malicious.

Re:I cant take any more of this

[ObsessiveMathsFreak]

The editors usage of the term rootkit is correct, and proper. You may as well argue that the usage of 'cockpit' for the pilot seat and control area of an airplane is incorrect. From the relevent wikipedia article.

Generally now the term is not restricted to Unix based operating systems, as tools that perform a similar set of tasks now exist for non-Unix operating systems such as Microsoft Windows (even though such operating systems may not have a "root" account).

Rootkit is no longer a term restricted to gaining "root" user access. The term now stands for any suite of hack and/or programs (the "kit") that enables the malware to disguise its presence in the OS in a more sophistocated manner than simply having obscurely named .exes and registry entries.

Furthermore, in my entirely humble and sincerely personal opinion, the term is an appropriate, apt, and succinct way of decribing these types of malicious programs, both in distinguishing them from the less deeply embedded malware types, and in emphasising the increased security threat these programs pose.

The sky is falling! ( again )

[grasshoppa]

Gee, wiz, a "fully automated" worm using a different attack vector.

Let me ask you something, what *doesn't* constitute a "fully automated" worm? Was there some guy in a back room somewhere, individually infecting people with Code Red?

And IM services are hardly a new vector. If anything, this story should be about how long it has taken these people to figure out that services like AIM and ICQ are used by people with little or no computer knowledge, who will randomly click on things. You know, sorta like email. That's the real new nugget out of all of this, and hardly worth the two pages of ads to read about.

Re:I cant take any more of this

[Darkon]

Is the 'administrator' account privilege - which a majority of Windows user accounts are - not an equivalent to root?

Strictly speaking the Windows equivalent of 'root' is the hidden 'LocalSystem' account.

Re:Do these things affect non-AIM apps?

[wvitXpert]

Your safe. Not because Adium can't be compromised, but because no one cares enough to do it.

Re:Infection

[Red Flayer]

From the summary:

"Researchers say the stage is set for a worm writer to use an unpatched buffer overflow in an IM app to unleash a worm that is capable of infecting millions or users without the use of malicious URLs that require a click."

FTA "'We've already seen documentation for some serious code-execution vulnerabilities in IM applications. If you put it all together, you'll see we're not that far away from an automated IM attack where infections don't require the user to click on anything,' Wells said."

User education won't help if propagation occurs without any action by them.

Why does the OS let software be invisble?

[G4from128k]

This rootkit hides itself from the user and anti-malware. Why should any software be allowed to run invisibly? I really want to know.

It seems to me that a well designed OS should NEVER let a piece of code be invisible. There should be some part of the OS that knows what is running, what invoked it, what file it came from, etc. A well designed OS would know the provenance of every segment of code. This information should be read-only to anything outside of this protected monitoring function. Thus ALL running code would be visible to the user and anti-malware software. And if you add hash-code locks on installed software, then malware wouldn't be able to masquerade as some other normal bit of code or damage anti-malware apps. Malware could still hide in a user-downloaded software, but the tracking function would aid the detection and removal of any unwanted code.

Is there ever a good reason to let software be invisible?

Re:Why does the OS let software be invisble?

[SSalvatore]

That's the beauty of rootkits. They modify the normal operation of an OS; yes, even one that does not allow "invisible processes" (to give it some same). Here is a short and informal explanation (where there is probably an accuracy compromise for simplification purposes):

At a user level, to "see" a process, you would open the task manager (Windows) or use the PS command in Unix. But you must note that these are merely applications that ultimately make a call to a OS level API and request this information; then they display whatever this API returns them.

The OS level API is just a piece of code that will have access to the internal OS data structures that hold the information for the processes. This code would piece together a response with the processes names, etc. and return this "list".

So, what would happen if I go and modify the code that pieces together this list of processes and omit the "worm.exe" process everytime? Well, that's pretty much a rootkit virus strategy.

The result is that you wouldn't be able to see the process anywhere. Any program that uses this OS API call would not see the process, be it ps, the Task Manager or an Antivirus.

So . . . why not providing every program with a direct access to the running processes structures so that they can "see" all the information there and "figure out" by themselves whether there is a virus or not.

Well . . . that's a disaster from a security standpoint since it would provide an avenue for viruses to exploit. And this "direct access" is never direct, it is always through another OS API that may in turn be modified to hide the virus . . .

So . . . why not scanning the disk?, I mean, the virus must be stored somewhere if it will run.

Well . . . file access is done by an OS call that may be modified to hide the virus.

So . . . why not doing an OS module that performs an CRC check and make sure that the OS APIs have not been modified?

Well . . . this too can be modified not to include the file that you infected in the first place.

So . . . why not making OSs "unmodifiable".

Well . . . how would you then install it in the first place? (that is pretty much a modification) or install security updates? (that's another modification).

So . . . Well . . . ad infinutum.

I think I made my point.

Anyways, the bottom line is that you can only do all those modifications *if* you have privileges to modify system files. You have to have "root" access for that. So once you have broken the security of an OS to the point where your virus can modify OS system files, you are pretty much doomed.

Ideally, the solution is a secure operating system, where regularly you run your user programs with an account whose privileges do not include modifying OS files and any processes that you start cannot breach that security (again *ideally*). You would only use the root account to do OS installs and updates (if the virus gets you while you are at it, you are doomed again, so shut down AIM!).

That's why Windows is so dangerous, because the normal XP user is running with an Administrator account (similar to having root privileges), so any application that is infected can potentially cause a root-level infection.

And then, no matter how much you program securely, the missing piece as usual is education. At some point, even in the ideal OS, the user would have to log in with the root account to do OS changes or at least explicitly authorize in some manual way the modification of system files (that would be my choice just to make things easier to learn for everyone in the real world).

Re:Do these things affect non-AIM apps?

[Rocketship Underpant]

"I use Adium. Should I be worried?"

I doubt it, because any malicious program that wants to alter OS X's settings is going to have to prompt you for an administrator password (unlike Windows). Besides, it's likely that any such worm will target official IM clients rather than third-party apps.

IM worms go undetected

[rizzo420]

i think a bigger part of the problem, and hopefully this will open their eyes, is that thus far, the big anti-virus companies (symantec and mcafee) will not include IM worms in their definitions. this means that even if you have the most up-to-date windows security patches, and the most up-to-date anti-virus software, you can still be infected by the IM worm. i don't understand why they won't include them as they are, in my opinion, just as dangerous and propogate on their own just like normal email viruses. i deal with the "AIM virus" on a near-daily basis. i keep sending people to download AIMFix. this guy is getting some serious hits to his site, and he's not getting paid for it... these are real viruses, since the definition of a virus is that it gets onto your computer and propogates on it's own. this just doesn't use traditional means (email, network ports). even if you uninstall instant messenger, it's still there waiting to send itself to everyone on yoru buddy list.

Partial cheap solutions: low-profile + firewall

[davidwr]

A cheap albeit incomplete solution, one which will make the virus-writers work much harder:

1. Encourage people to use non-high-profile clients. It's a lot easier to "take over the world" if 90% of the people are using the same client with the same vulnerabilities than if 30% are using client A, 20% each are using clients B, C, and D, and the remaining 10% are using a variety of other clients.

2. Put a firewall between the application and the network. Again, don't have 90% of the world use the same firewall. It's best if at least part of the firewall sits in front of the OS, i.e. a hardware firewall or a "host-OS-based" firewall in virtual/emulated-hardware environment.

Here's what I see happening in a few years time, when virtualization becomes the norm:

1) everyone has a hardware firewall built into their cable/dsl/whatever box
2) PCs boot into a hypervisor, see #4 below
3) apps run in different security contexts, each having the network, memory, and disk-access privilages that they need and no more. For example, Solitaire will have no disk or network access. A Web browser will have very limited disk access and outgoing-only network access only over certain ports. A "local-only" web browser will be available for reading local html files.
4) The user will be encouraged to run certain applications like web browsers in a "lock box" which will in reality be a virtual machine, with its own firewall mechanism. Multiple VM implimentations or VM-hardening-products will be available so no single VM-related exploit will be shared by "90% of the world." The user will be able to "reset" his lock box at any time, erasing any viruses and malware that have infected it but which haven't "escaped" the VM environment.

Yes, the user can still be infected and yes, he can still be contagious, but instead of "everyone" being vulnerable only a part of the world will be. Furthermore, if people use the VM-lockboxes, they can "cure" themselves quite easily from the most common problems. They'll still need security software for the really nasty stuff, and they'll always need a "boot CD" or equivalent to do a full scan of their system for rootkits and such.

Remember: The goal isn't to wipe out viruses - that's practically impossible. It's to reduce your risk and decrease your recovery time.

Here's an example of how #4 can reduce exposure for web browsing:
Say 90% of people run Windows-2010 or whatever. When they run their web browser, they get to pick from:
IE under Windows VM
Opera under Windows VM
Opera under {pick one of many} Linux VMs
Opera under {pick one of many} BSD VMs
Firefox under {pick one of many} {pick Linux, Windows, or BSD} VMs
{insert other web browser here} under {insert operating system here} VM.

The VM would be bare-bones, just having essential services - including a built-in firewall - and a "screen" that just displayed the web browser. The user wouldn't necessarily see he was under a VM if he was merely browsing. If the web-browser screen output were "exported" to the "main" OS a la X, so much the better, assuming that didn't introduce security holes of its own.

Re:Jabber!

[Misch]

What's stopping MS from implementing a Unix-style security model?

Your mom. Litereally.

I understand users/groups/file permissions. I assume you do too. What about your parents?

Re:Jabber!

[Shakrai]

I understand users/groups/file permissions. I assume you do too. What about your parents?

What would they need to know? There's a separate password to access the "administrator" account. When you buy the computer (presumably preloaded with Windows) you set that password and create accounts for everybody in your family. From that point on you only use that password to install software for everybody to use.

It shouldn't even be required to use that password to install software for just yourself. If I go out and buy Sim City 4000 and I only want to be able to use it on my user account, then why should I need admin rights to install it? This would be the same behavior as --prefix on Unix -- but a lot more user friendly.

You'd still have the problem of social engineering (download our new screensaver!!!!) but it would be a lot easier to tell people to never enter that password when prompted by a website then it would be to block access to bad scripts or ActiveX controls.

They will try it in the next version of Windows apparently. I don't see what's stopping it from being in XP SP3 (or why it wasn't in SP2 for that matter). That would be even better because it would give software publishers time to get used to the model before Vista is released.