Slashdot Mirror
Santa IM Worm Hits AOL, MSN and Yahoo
elmtree95 writes "CNET News reports A Santa Claus worm is attempting to trick America Online, Microsoft MSN and Yahoo instant-messaging users into clicking on a file that delivers unwanted software to a victim's computer.
The IM.GiftCom.All worm attempts to dupe IM users into thinking an acquaintance has sent them a link to a harmless Santa Claus file. IM security vendor ELMTree Software has released a patch to their ChatPatrol (www.chatpatrol.com) product to address this issue."
"lol, it's not a virus."
Oh boy! A Bonzi Buddy! Just what I wanted. Thank you, Santa.
"Strangers have the best candy" -Me
Gee, first post.
As a Mac user I feel really lonely.
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
elmtree95 writes.... IM security vendor ELMTree Software has released a patch to their ChatPatrol
'nuff said
Please, please don't bring me any gifts. The bicycle you fired at me last year from your bicycle gun really tore up my insides.
-- AIM user
Since the user has to click on a link, I assume the browser type matters?
better !pout !cry /etc/passwd >list
better watchout
lpr why
santa claus town
cat
ncheck list
ncheck list
cat list | grep naughty >nogiftlist
cat list | grep nice >giftlist
santa claus town
who | grep sleeping
who | grep awake
who | egrep 'bad|good'
for (goodness sake) {
be good
}
Dang, I guess he really meant the last three lines!!
This message printed on 100% post-consumer recycled electrons.
Harmless Santa Claus file? More like insubordinate Claus file.
Paul Grosfield - the quicker picker upper.
And an advertisement, all in one convenient package!
Do you have ESP?
HO HO HO! Merrrrrrrrrry Christmas!
(Finally, a reason for me to say that!)
With spending like this, exactly what are "conservatives" conserving?
Anyone who catches this is at fault.
what happens is you get an IM message with a link. if you click it, it's your fault when it downloads.
When it downloads it is still just nothing but a file on your disk. If you accidentally click it you have a chance not to run it. Second luck, if you like.
If you then open that file and become infected, it is your own fault.
It is like being warned two times not to put your tongue on a 110v wire chasss. If you still do it you have nobody else to blame.
As they say, take the warnings off everything and let nature sort out the idiots.
The article says that "it delivers unwanted software to a victim's computer"...
Um, no. It delivers unwanted software only to hapless users of microsoft OSes. Those running OSX, Linux, BSD etc are completely unaffected.
Maybe we can push the Sony root kit out via IM to all of Sony's employees. Anyone know if they have a corporate IM server?
2 cents,
Queen B
HDGary secures my bank
It delivers it to anyone... it only works on Windows.
Sorry but if you want to nitpick, be prepared to receive the same.
Microsoft provides this URL for users to immediately get rid of the latest Malware: Remove Malware
You've never heard of a .Claus file? You can open it with Stuffit Expander.
(Yeah, I never have it installed, either)
The theory of relativity doesn't work right in Arkansas.
how ironic seeing as its the holiday season and people are susceptible
I don't think that word means what you think it means...
Oh, you better watch out,
You better not cry,
You better not chat,
I'm telling you why:
Santa Worm is coming to town!
Good, inexpensive web hosting
So... can I get the source to this blatant ripoff of gaim?
Elmtree must be the stupidest company I've seen. They rip off gaim, and then write a post to slashdot: the place where the users are most likely to call them on their infringement!
Probably don't want no wino Santa at my house anyhow. I'll stuff my own stockings, thanks.
Don't click on links in strange IMs!!!
Does anyone listen? No. You know who gets these things? Sad and lonely people, and at this time of year, they are especially vulnerable.
GetOuttaMySpace - The Anti-Social Network
I can't believe there's an article on /. that mentions Yahoo, MSN, and AOL, but not Google. They must feel so left out.
Did someone finally impose a Google limit on /.?
He who does not have anti-virus software nor the common sense not to click on the link nor the common sense not to run the file deserves what's coming to them.
This really isn't any different from the morons who message random people telling them to download sub 7.
-1 disagree is not a modifier for a reason. -1 troll, flaimbait, redundant, overrated are NOT acceptable substitutes.
You guys are the lucky ones as you can just ignore this lump of coal. Us poor Linux users will be up all Christmas night hacking away at wine to get this worm emulated so we don't feel left out.
:(
Convincing the Windows crowd that we are compatible is such a pain...
I ate your fish.
The thought crossed my mind that the "delivers unwanted software" hyperlink would be a hotlink to the virus. I know if I were sadistic enough I would have done it in samzenpus's place.....
In undeveloped countries, the consumer controls the market. In capitalist America, the market controls you.
This doesn't bode well. I think AOLers are just now getting up to speed on the "good times" virus.
So is slashdot running paid stories now? How much to I have to pay to have a story of my choice run and mention my company like this?
We can have that warm, fuzzy maliscious app feeling too... just download IE for Mac!
Please read this post regarding IM Logic: http://security-protocols.com/modules.php?name=New s&file=article&sid=3135
"If you have been looking for more details on the IM.GiftCom.All threat, you won't find them. Why, you ask? Two reasons, first, IM Logic didn't release any and second, you are most likely not an IM Logic customer.
IM Logic withholds details of Santa Claus worm, unless you're a customer IM Logic withholds details of Santa Claus worm, unless you're a customer On Dec. 19th IM Logic released an advisory about a worm spreading through all major IM clients. See advisory for details, or lack thereof. You will need to search for IM.GiftCom.All at http://www.imlogic.com/im_threat_center/index.asp If you have been looking for more details on the IM.GiftCom.All threat you won't find them. Why, you ask? Two reasons, first, IM Logic didn't release any and second, you are most likely not an IM Logic customer. IM Logic did not publicly release any actionable information that would help the community at large. Not because they don't have the details, but because they only share that with paying customers, according to Tim Johnson, the Director of IM Logic's threat center. Mr. Johnson also said that "this is not unethical" and he doesn't see what all the fuss is about. All you have to do is buy the company's product and you will be protected. Johnson did mention that they have a process they follow. They first create the signatures for their products, and then they notify all the affect vendors. Don't worry; the vendors will fix it ASAP. Then they tell the antivirus vendors about what they know. Hopefully they can detect and stop any current infections, if not...your screwed. Then you as a non-customer have the opportunity to wait for a signature to come out by your antivirus vendor so that you can tell if a hacker has a rootkit loaded in your environment. Oh wait, darn it, I almost forgot, according to the official advisory, antivirus vendors can't detect Santa Claus; apparently Santa can put your antivirus to sleep. I always thought Santa knew if you were sleeping, not able to put you to sleep; but I digress. So what is the world and security community supposed to do? Well according to IM Logic, pay them the money and they will take care of it for you. Hmm, I wonder where else we find this type of behavior. Hold on guys, Toni the Bull is at my back door, brb, need 2 make my "insurance payment" AFK.... Back, sorry it took so long. I just hurt my knee; I was short on my "insurance payment" this month. Anyway, haven't we been down this road before? Security companies should follow the same procedures that ethical and responsible researchers follow when disclosing vulnerabilities. Most companies are responsible, those that aren't... should we reward them by purchase order? Not this security guy. "
Yes that should definitely fool the 3 people who still haven't watched the movie into clicking on the link...
They must already have your paypal account info, your Bank of America info, and your social. The words, "your account has been restricted," = we're fishing for your info. Seriously, since the days of Prodigy, people have been trying to steal your info. If you are dumb enough to fall for this, you deserve it. And my email account is still through AOL. I just saw a commercial that AOL supposedly protects against this crime. Why do I get get 10 emails a day that my account has been restricted? Because I allow Slashdot to post it, that's why.
wtf for sure. who the hell downloads a file from some random person on the internet?
and even then, you would have to be near brain dead to run it.
what are these people thinking... i think mcafee/norton/etc should get together and make some basic '10 rules to avoid viruses' bs, maybe if we add an annoying jingle to it, these people might get it. WTF
except they're not random people. You'd think they were your friends.
"A Santa Claus worm is attempting to trick America Online, Microsoft MSN and Yahoo instant-messaging users..."
Which would be about as hard as falling off a bucket.
Karma: It's all a bunch of tree-huggin' hippy crap!
Believe me. People WILL click the link. They always do.
:P
There always is one stupid person who starts it all.
i call for a "You Must be this smart to use the internet" Logo whenver you use the internet!
and on that note, cue the jingles....
Man, these people are so dumb. I asked first if it was a virus and my friend told me "lol, no its not a virus" and I just *knew* I was safe. Always ask first! ;-)
Everyone knows there is no such thing as a harmless Santa Claus file.
The Group of the Martyr Ebenezer Scrooge will soon have its revenge on this infidel.
There are legit ways to advertise on slashdot.
Check http://www.ostg.com/
It will also prevent hundreds of security professionals, system admins reading slashdot to hunt you down if you coded the lame worm or not.
I know you can call it paranoia but submitting a worm story to slashdot promoting your product can make people wonder how far you would go.
Also people concerned about that worm: Update your virus databases and get latest security patches for your OS and IM Application.
Unfortunately for your analysis, people die, and new people are born every day. There's always new people using computers, uninformed of the risks, not knowing there -is- a risk. That's hardly their fault.
How does he survive there wearing red clothes? Potential prey would spot him from miles away.
And now this worm thing..
I don't know - there are just so many things that just don't seem right with this fellow.. - But not to worry: thanks to Bush there shouldn't be a problem finding what this guy is up to.
And when you gaze long enough into the code, the code will also gaze into you.
At least they are being responsible and tracking terrorists who use the product...
"you must file a special license if you intend to reroute goods to the embargoed regions of Serbia or the Taliban controlled areas of Afghanistan"
ZDNET needs to do research (also called "journalism") before reporting sensational news...
If you're an AIM user and went and got this virus, AIMFix from jayloden.com should take care of it for you.
While you're at it, try reporting the link you downloaded the virus from so it can stop being distributed. Remember, e-mail viruses include infected attachments, while IM viruses just link off to a website creating a single point of failure.
Send offline messages on AIM with DoorManBot
I have Virtual PC running on my Mac for this express purpose!
thank god im on a mac...
Nom de dieu de putain de bordel de merde de saloperie de connard d encule de ta mere.
like when firefox in the windows version has an exploit, and it's no where in the article, just "firefox". I've seen that more than once here. I think all these exploits should always be classified as a windows problem first in the title, if that is what it is. Add the sub problem in second place, "new windows vulnerability hits instant messaging systems" would be a more accurate title for the article.
I agree!