Slashdot Mirror
Pipeline Worm Floods AIM With Botnet Drones
Several reader write about a new AIM threat
dubbed the "AIM Pipeline Worm" that uses a sophisticated network of "chained" executables to attack the end user. Security Focus has a brief note. One anonymous reader writes: "Using this method, there is no starting point for the attack — a malicious link via IM can send you to any given file, at which point the path of infection you take depends entirely on the file you start off with. The hackers can then decide which order to install malicious software, depending on their needs at the time. At a bare minimum, you will become a Botnet Zombie — if you're really lucky, you might be Trojaned, have a Rootkit installed on your PC, and be used for spam, file storage, and DOS attacks. Unlike similar attacks that have been attempted in the past, the removal of a file from the chain will not stop the attack — you will simply end up with something else installed instead, in the form of a randomly named executable dumped in your system32 folder. You'll still spam an infection link to all your contacts."
the internet is a wonderful place
Don't anthropomorphize computers: they hate that.
Don't use IM software unless it's part of a closed, managed network. For example: www.omnipod.com is what we use for inter-office IM here. It's a closed network, and all files sent are automatically virus scanned before they can be received. Safe and effective, and keeps our employees from IM-ing with people outside the company.
Official Heretic from the "Church of Global Warming". Proven right thanks to whistle blowers. AGW = Flat Earth Theory
QUOTE (emphasis mine): How does this infection start off? As always, it begins with a seemingly innocent web address passed to you via Instant Messaging. Click the link and allow the file to execute and your day will quickly go bad."
The method used after that sound interresting, but nothing beat "trusting" executable being sent by any source, anonym or not , on email or AIM. Do that and SOONER or later your day will turn bad.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
1- Don't run as an administrator.
2- Back up your profile regularly.
If you ever get bitten by something like this, it's easy to recover from.
It seems this is no different then someone sending you
an executable via smtp and the user clicks on it..
imagine a person sending you a link in a msg box,
you click it and another box pops up asking if you
want to run this program...
sounds like a silly thing to me that deserves little attention
from a security standpoint and has more to do with user education.
... because it's a well known fact that most AOL users have higher than average internet savvy.
Now I have more reason than ever to install trillian/gaim on newb computers.
"I can not bring myself to believe that if knowledge presents danger, the solution is ignorance" - Isaac Asimov
Wake me up when this crap can affect my Linux comnputer.
It's a Pipeline Worm. It's a good thing the internet is made up of tubes instead of pipes or we'd all be screwed!
What if the Hokey Pokey really is what it's all about?
Sometimes I hate Spotlight, I'm trying to find that folder so I can look for unwanted executables but it's coming back with no results. Did the OP spell it correctly?
And if you don't guess who they'll call first about how their computer has gotten SLOW again.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
using aim is like being kicked in the balls
i support the right to offend.
Desolator144 wrote it!
.Net framework installed, and if you happen to see any worms trying to download it, turn your computer off.
Just make sure you don't have the
Of course, he "The Best Programmer in the World", so we're probably all screwed.
It's free and open source. It's scaleable. It's easy to install and manage. It runs entirely on your own infrastructure so your messages aren't vulnerable to prying eyes and bored sysadmins of some other company. You can set it up to interoperate with any other IM system if you want to. There's a ton of open source clients available. Safe and effective, and keeps people from spending money on crap "solutions" that aren't.
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
on Linux?
And the definition of Tubeworm probably needs to be rewritten.
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
Actually, jabber was one of the options I explored. We didn't go with it because omnipod was already in use by one of our larger branches, and it was simpler to just extend the use of the product. No servers to setup, no additional hardware needed, and low licensing costs. Omnipod worked great for us. For others it might not work so great, but it was our best option.
Oh, and yes, AIM (and YIM, MSN, ICQ and IRC) is blocked at the firewall. Most IM clients are also prevented from being installed by AD policy. I also regularly audit the PC's for unauthorized software.
Our users do actually get alot of latitude with thier machines (programming shop, they have to have it) but there are certain things we do not allow. Public IM networks are one of them.
Official Heretic from the "Church of Global Warming". Proven right thanks to whistle blowers. AGW = Flat Earth Theory
I'm a student employed by the university to fix students' computers in my dorm building. Everyone will click on these links, some more than once. But why do I love these attacks? The hot chicks that will inevitably click the link. I love this job.
Not totally true. Almost all of these exploits revolve around getting the user to click on an executable file which is disguised as something else.
For example, you take an executable ("TROJAN.COM") and rename it ("FUNNY.JPG") and for reasons that have never been clear to me, the brainiacs at Microsoft designed their OS so that it will execute the latter file when you double-click on it. This seems pretty retardate; clicking on a file shouldn't imply "open or execute," it either means "open," or it means "execute," but rarely does it mean "do either one." Whether the user is trying to open the file or execute it, is pretty easy to determine from context. If the GUI is displaying "JPG" at the end of the file name, it shouldn't be executed -- period. If they really want to execute it, they can change the file name.
The best solution would just be to make the system to refuse to execute code that's not identified in the filesystem as being an executable, say with the suffix and a special icon. A MacOS-style warning the first time any executable is run would also be helpful.
On Linux, you could pretty easily create these safeguards using the execute bit, and linking that to a visible flag in the GUI on the file, and by making all files download by default with the execute-bit set off. It still wouldn't prevent PEBKAC vulnerabilities completely (because if people think there are naked pictures of Angelina Jolie inside, they're going to override any warning you give them), but it would be a big improvement.
At least part of the fault for these exploits lie squarely with Microsoft and the tendency of Windows to coddle users one instant and then throw them to the wolves the next.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Um...This won't affect my Mac one bit :P *yawn* I kinda feel bad for PeeCee users though. Well not really. You get what you pay for. It's just unfortunate that you chose the cheap route. It's kinda like eating at McDonald's and expecting to stay healthy.
Apparently you don't allow people to have social lives. Apparently, you think all your workers need to be mindless drones while at work. Guess what -- people work better when they can let their minds wander a bit when they need to during the day.
I guess that's against corporate policy, too, then, since it's quite possible to block file transfers while still allowing people to socialize.
But then, it's so much easier to use "security" as an excuse to clamp down on imagined "productivity threats".
i am a soviet space shuttle
Well, in your case it makes sense to use omnipod, if a large part of your company is already using it. I guess it would also make sense for firms that don't have the time, inclination, or technical know-how to do it themselves. I'm not that much of an open-source zealot that I can't see there is a place for other solutions. I just finished setting up jabber where I work, so I'm kinda on a jabber kick is all. Instant messaging is really a great thing for business. Many time people have a really quick question that doesn't warrant a phone call but email would take too long. IM is perfect. After setting it up here, everyone I've talked to says they use it on a daily, if not hourly basis.
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
These types of stories make me think of the new Battlestar Galactica. One "infection" in the wrong place, and everything important gets taken over. Unfortunately, we don't need to be seduced a hot blonde, just a link to something that we find interesting from somebody we think we can trust. You have to wonder if the real world result might be the same as the show......
ur users do actually get alot of latitude with thier machines (programming shop, they have to have it) but there are certain things we do not allow. Public IM networks are one of them.
Having worked at a number of programming shops, that doesn't sound like a lot of latitude to me. If you can't install arbitrary software because of an AD policy and you audit people's machines it sounds like a very authoritarian place that does not trust the workers very much. Here we get a choice of computer brand (1 of 3), laptop or tower, any OS we want, and any software we feel like. We're also responsible for keeping our machines moderately secure. We have internal IRC servers and any IM we want is fine. Shop talk is encrypted by policy, either over Jabber or on top of a public network like AIM.
I think it is pretty darn useful. I have a lot of friends and colleagues on both of the aforementioned IM networks who I regularly consult and vice versus. This provides me with an additional resource as well as makes for a more relaxed atmosphere, like when I want to see if my girlfriend wants to meet me for lunch, or just want to chat with old college buddies. I think the fact that my company trusts me is a lot more valuable than tight security policies. Most serious compromises come from within. Because they trust me I'm happier and I'm also a lot less likely to sell them out. Contrary to what you may have heard, studies show the most effective motivation for not exploiting an employer is not fear of punishment or being fired or jail, but an ethical desire to not hurt those who trust you. If your company does not trust you (audits, arbitrary restrictions) then that motivation is removed.
You must've not heard of http://www.oldversion.com./ I use version 5.1.3036 myself.
Within the reach of a normal person, shift-right-click and Run As... will get you temporary and per-process administrator privileges without the insanity of running Internet Explorer as root.
Within the reach of an expert, RegMon and FileMon can point you to the isolated places where changing ACLs will allow the stupid program to run. The most frequent bug is for a program to try to write to one or a few protected locations.
I don't know all the file types this does and doesn't work for but I know that if the execute bit is turned on for an open office document I get the following message:
"Do you want to run "Daily notes and messages.doc", or display its contents?" - "Daily notes and messages.doc" is an executable text file.
Quite handy. I just click on "Display" instead of "Run" and it's all good. Even with PEBKAC the user wants their pr0n "displayed" and they might hit the right button. If the execute bit is off then it just opens in OOo. This doesn't work for all files (I tried with a gif and it opened without prompting about executing) so I don't know how much protection this affords but it's in the right direction at least.
Being their pastor / guidance councilor might make the situation awkward. We often have unrealistic expectations that these people will remain pure in thought. Also going through several cases a week during sex-education seminars might give a bad impression.
(I am not a pastor/concilor but a close relative ran an STD clinic that went through a couple cases a week. A bit awkward at times, especially in the bible belt. As a female people assume that you are a prostitute if you buy in that kind of bulk.)
Microsoft insists that Users should have access to key system files...to maintain functionality.
ugh..
http://lists.freedesktop.org/archives/xdg/2006-Apr il/008012.htmlr il/008025.html
http://lists.freedesktop.org/archives/xdg/2006-Ap
http://lwn.net/Articles/178411/
http://lwn.net/Articles/178409/
lessee... /, bin, boot, debootstrap, dev, etc, home, initrd, lib, media, mnt, opt, proc, root, sbin, srv, sys, tmp, usr, var - nope, it's GONE!
Sacred cows make the best burgers.
do the viruses run on linux? or should we file a bug report for that?
you will simply end up with something else installed instead, in the form of a randomly named executable dumped in your system32 folder.
/etc or /usr/local? :)
I've looked everywhere - is the system32 folder in
MjM
XKCD:Xeric Knowledge Comically Dispen
Boyd likened the technique to the fight combos common in martial arts video games.
:-)
Now all we need is a nice graphical interface and a joystick control system, and the fun can really begin
Ha ha, it's a joke. I set up a linux box for my sisters kids to use, and kept an eye on the logs. One of the first things they tried to install was AIM. Ooops, too bad. Some kind ***soul was even trying to help them to do it while chatting though GAIM. Which is kind of funny as there is a plugin for AIM in GAIM.
Don't click on any links in AIM unless you asked for the link yourself. Then check the link and make sure it is from a trusted domain name. I think I'm telling the wrong crowd though. /. users should know this.
Funny createSig(Witty remark, Odd reference)
{
return (Funny)remark + (Funny)reference;
}
Doesn't firefox prevent install on demand? and I mean trillian instead of aim...
Social lives, mind wandering = not at work.
I'd welcome my employees to take 30min off for a walk, take a nap, whatever. A break will help productiviy. This doesn't include chatting through a typical messenger client, or taking more than about 5 or 6 personal calls each day. Work isn't the place for socializing with anything other than fellow employees. Do that on your own time.
Social lives, mind wandering = not at work.
Funny, I thought that when I was sitting at my desk, I was at work. What I'm actually doing at my desk has nothing to do with whether or not I am at work.
Oh, and by the way, open your eyes and read this:
What's Next: Stupid Productivity Tricks
You say you don't care if people walk around for a bit? Eat your words:
"recreational Web surfing has become a kind of mental floss for workers who spend their days sucking in a stream of work-related data that now comes in at a firehose pace--it's the information age equivalent of a walk around the block."
i am a soviet space shuttle
Does anybody have a suggestion on a *nix based livefilesystem that can be used to clean up after this mess
(drill would be yank the net cable shutdown the system and reboot using a Rom)
it of course would need proper NTFS support and an antivirus/anti#deleted#ware program and a way to update the pattern files (kind of like Puppy Multisession)
send suggestions to name at googles mail domain
Any person using FTFY or editing my postings agrees to a US$50.00 charge
I would love to read these studies you speak of.
Yes, at some developer's desk.
Some brilliant programmer asked: What if the user of my messenger application, clicks on something? And his answer was: well, if it's a URL, download the file. [Ok, so far, so good. A little risky, but not totally stupid at first glance.]
Then the followup question was: what if the file turns out to be an executable program? And his answer was: execute it, of course! Oh, and with the same privileges as the user.
?!?! A problem between keyboard and chair, indeed.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
It's not paticularly easy at this point, but any experianced Linux geek should be able to figure it out in a evening. Use a lightweight VM.
0 3.html
Not like Xen of VMware, but a lightweight container virtualization system like Linux-jail, Vserver, or OpenVZ.
1. So setup a chroot jail or one of those OpenVZ or whatnot.
http://www.gentoo.org/doc/en/vserver-howto.xml for example.
2. Install Debian Testing via Debootstrap. A minimal install is about 250 megs or so. You can reduce it further.
Here is how to install Debian from any Linux distro, this guide is for AMD64 in paticular, but it'll be about the same for any support arch.
http://d-i.alioth.debian.org/manual/en.amd64/apds
2b. If you want a 'deleteable' setup use UnionFS (ala Knoppix) to setup a read-only file system and then a layered rw file system over that. Setup everything on the Read-only portion how you like it then just purge the rw version periodicly.
http://www.am-utils.org/project-unionfs.html
3. Install all your favorite apps and such that you use to interact with the internet, browser, email, IM, etc in your deb install.
4. start up the VM container, setup ssh keys so you can ssh in without a password (but obviously you don't want to be able to ssh back out without a password.
4b. Setup a shared folder like ~/Downloads so you can access files from your container outside of that container. Maybe use mount --bind to do that.
5. Run your internet-accessing applications from that a ssh session in a xterm, or from scripts from application launchers.
The worst a hacker could do would be to take over that VM and maybe setup a file server or whatnot as a user, or maybe issue a fork bomb to try to DOS your system. A purge of the 'rw portion' will fix that.
From the article: What's smart about this attack is that it doesn't matter if you get a file "out of step" - if you start off with a particular file out of sequence, you'll just end up somewhere else in the chain instead. There is no right or wrong place to start with this one - the hackers will make sure you get your fill of infection files!
The basic idea of using multiple, completely unrelated vulnerabilities and attacks to achieve total control is not exactly that new. In fact, the ideas that feel so obvious to us today were quite novel back in the turn of the century. Michael Zalewski described a worm prototype that worked in somewhat similar manner more than six years ago.
On the occasions that I get to give lectures about computer security, I try to illustrate these very ideas. The rule #1: There are no local exploits; All vulnerabilities are remote, some may just require a piggy-bag step of first delivering extra code via other holes.
There is no such thing as good luck. There is only misfortune and its occasional absence.
A quick glance at the headline and stuff like this stands out: At a bare minimum, you will become a Botnet Zombie -- if you're really lucky, you might be Trojaned, have a Rootkit installed on your PC, and be used for spam, file storage, and DOS attacks. Excessive use of capitalized jargon like that always indicates that it's going to be a nothing story, and sure enough, that's exactly what it is. Although, if you think the fact that your PC can be compromised by something you download on purpose is news, you're probably the right target audience for this story.
I would love to read these studies you speak of.
Do some research on corporate psychology, particularly on motivation and you'll find plenty of research. There are several good books out. Or, for a quick and dirty statistics for the layman, pick up the book "Freakonomics" and read the chapter on honesty in the workplace. It will take you all of five minutes and give you the basic concepts.
Hey, on the bright side, you get to spam your contacts without even trying! And you get new things installed everyday! :p
Cool, thanks.
make sure to installing the needed and invulnerable software to avoid the attacker attack our pc