Slashdot Mirror
New Worm Chats with Users on AIM
goldseries writes "CNet is reporting that a new
IM worm chats with users to get them to down load a file containing a virus. The virus replicates its self and sends its self out to user's buddy lists. The virus will reply 'lol no this is not a virus.' The virus hides users from seeing the messages sent out to members of their buddy list. Viruses are evolving; now they will even talk to you."
Honestly (and no, I'm not a programmer), the potential here scares me. It seems to me that "interactive" automated intrusion is going to be a serious issue for security. Yes, the truly prudent are (as usual) safe, but the gap between the "luser" and people like me and my co-workers is going to get smaller.
I really do have some of our local users using vmplayer virtual machines to access the internet (the ones with Windows laptops) - and a lot of services shut down (chat, in particular) that some would like to use.
Those who know more than I (most of you) - any comments?
Using plain ol' text since 1968
wouldn't an unknown new name on the buddy list sending you a package with the message "lol no its not a virus" be a dead giveaway?
My sig has been answered.
Only on /. could you find stuff like "down load" then shortly followed by "its self". Somebody there doesn't like to put words together, probably...
My friends, we are fighting a war: a war on stupidity.
And clearly, we are losing.
- lol no this is not a virus
So it will sound like almost every other meat-head out there using instant messaging? It will blend right in! I have received less comprehendable IMs from people who would consider it a mortal sin to be anything other than professional in person or on paper.Why does all respect for grammar and spelling (and not sounding like a 12 year old) go out the window when instant messaging technology is involed (especially in a business setting)?
These are the same people who also don't know and don't care that they allowed music disks to install rootkits and backdoors on their computers.
The frightening thing is, that would probably be pretty easy to code. The net is full of freely-available pornographic stories; extract a whole bunch of phrases from those, use an Eliza-like system to select the right one for the circumstances and incorporate elements of what the user just said into your response...
You could write up a pretty effective cybersex bot, and you could program it to offer to send across 'cam pix' once in a while. Which would, of course, be virus-ridden.
Better yet, once you've written it you could have it communicate with sad lusers via SMS at, oh, 20p per message. And make a killing. Excuse me, I have an Eliza-bot to hack up with some pornography. bbl, d00dz.
Real Daleks don't climb stairs - they level the building.
Windows needs to be fixed so that executables renamed as PIF are NOT executed. God that's stupid.
How about fixing windows so that it uses execute bit in the filesystem, rather then the extension of the file to decide whether to execute something or not?
My pics.
So people can send out executable jpegs? No thanks.
euthanizing AOL users
No. just deny them use of computers until after rehabilitation. Now those who get broadband access AND STILL BUY AOL because it's the Internet, those are the ones to use your tactics on.
Or just end up being a fully functionaly Zombie.
And that's all we need. Another 144 Million Zombie Bot-net.
Yeah, it'll sort itself out...when we get our "Interneational Reformat, FDISK-MBR, and Re-Install Day"
Apple also hide file extensions by default. It's amazingly annoying, but I never here anyone complain about that, only about MS doing it. Weird.
-- Cheers!
No, PIFs are now legacy.
.LNK file (the actual shortcut).
On 2000,XP and 2003 DOS apps settings are now held in two places, the registry and inside the
However, PIFs are still supported execution-wise in the OS to maintain backwards compatiblity - something that *shuold* have been eradicated/managed-out with XPs SP2 and all it's 'security' updates - something along the lines of:
'You've have tried to run the file CelineDionNaked.jpg.pif, this may not be a legitimate application. Choose Run to run the file, Delete to delete the file, and Update to convert to a Windows XP icon.'
-Jar.
Together, We Can Make Slashdot Better. I Do NOT Mod ACs. - Check Me Out
If this technique keeps on working after a while, virus writers will have effectively passed the Turing test. Though as predicted, the Turing test will end up saying more about itself (and us) than AI. Perhaps there should be a Turing Test++ that identifies AI as intelligence capable of distinguishing a human from a virus bot soley by communication over IM.
We have users that are already downloading zip files, opening then, running the executable and getting infected. Is it really that much harder to also check a box in order to get infected? I don't think it would make a difference.
Don't take life so seriously. No one makes it out alive.
I've been getting spam messages and some really bad bot messages on Yahoo! messenger for quite awhile. Most of them start out asking if you'd like to chat, then send you a link for their webcam site. Quite a few chat sites on the internet have become bot havens, with rooms filled with more bots than people trying to fish for people stupid enough to click on links. Also, on sites such as MySpace, there are bots that will create profiles that look real and then send messages out asking for people to visit and click on their homesite. I'm not terribly surprised that a worm found its way into AIM. Although it does rely on the same thing all the others do: gullibility.
"You've have tried to run the file CelineDionNaked.jpg.pif, this may not be a legitimate application. Choose Run to run the file, Delete to delete the file, and Update to convert to a Windows XP icon."
For many people, that sentence would mean nothing other than "hit run to proceed".
Anyone that would even be remotely interested in clicking on a file that was labeled CelineDionNaked.* has more immediate and serious issues than their pWn3d w1nbl03s box.
---
I think the problem is that you would still have 90% of the people running something.jpg.exe even if they saw the extention. Most people still have no clue what '.exe' is, but since there is a '.jpg' they would still double click it thinking its a picture.
You are all a bunch of idots.
This user that somehow managed to Run Explorer, clicked Tools ... Folder Options, clicked the View tab and unticked "Hide file extensions of known file types".
(we'll ignore the WTF of unhiding something by unticking it)
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
The Turing test is turning out not to be a test of artificial intelligence, but of human stupidity.
This should be moderated 'Insightful', not 'Funny'.
Seriously, the problem is user education. People believe ANYTHING that appears on their computer screens, much in the same way people believe ANYTHING that appears on the TV news.
The problem we have is that too many people lack the critical thinking skills necessary to operate a computer (or watch the TV news).
My blog
I wrote and maintain a free AIM / IM specific antivirus tool called AIMFix that removes these two worms in several variations. I've been working with this stuff since 2003 (AIMFix is used by dozens of Universities as part of official cleaning procedure and recommendations, see the users page for details). In particular, these two worms have been eating all of my free time for the last three or four days with several variants and some new behavior (installing as services only, rather than registry keys all over the place, etc). They're also hiding as Windows filenames, but in different directories, like C:\Windows\svchost.exe (instead of system32), C:\Windows\taskmgr.exe, etc.
It is so incredibly weird seeing these stories in the media. I've been so deep into researching them and writing updates to AIMFix to keep abreast of everything that it comes as a total surprise to see a media outlet cover them. I've gotten countless emails from people who got hit by these two worms, and I've become quite familiar with the symptoms over the past few days, yet at the same time I'm uniquely ignorant of the rest of the story (the AI aspect, etc) because I only end up dealing with the nitty gritty that happens on the symptoms and removal level. Go figure.
-Jay
Sure...and they could also put a big fat warning symbol next to urls that end in executables and tell people "this is a program!" before they download it.
;) But the honest truth is that they don't care unless they have to. When it comes to the scale of priorities, welfare of the users hardly even registers for AOL. What matters is revenue, and unless the virus(es) directly impact revenue, they could care less.
They could probably even set up filters to prevent blacklisted urls from even being transmitted. Hell, with AOL's money and power it's highly likely they could get most of the virus sites shut down much faster than you or I can.
But if there's one thing I've learned in the years I've been fighting the IM virus battle, it's that AOL doesn't do a damn thing until it's so huge that they *have* to do something, or the media gets involved enough to make it an issue. I deal with this crap every single day. I create definitions for new virus variants for my AIMFix software, answer hundreds of emails from (usually virus infected) users, and analyze various bits and pieces of the malware themselves. Hell, I've even tracked the authors down to their home address & phone in a couple of cases. It's not like AOL couldn't take care of all of this if they really wanted to. Hell, they could even just pay me to do it full time - I work cheap
It's often frustrating to me that a relatively minor investment on the part of AOL (and other parties, I might add) could make my life a lot less busy and make the life of a virus writer that much more difficult. It's hard to see dozens of people email me in one weekend because they had their passwords stolen and their account hijacked, or hear from thousands of frustrated and upset people whose computer is suddenly a mess of spyware and ads. I can't even imagine what it'd be like to have your screen name sending out IMs to all of your friends, infecting them with the very same unpleasantness while you sit there helpless. Sure, much of that can be attributed to the end user, but AOL sits in a position to help save a lot of these people from themselves and they just aren't interested.
-Jay