[ news_security_news ]
AIM Flooding With Malicious Bots
David Utter
Staff Writer
2006-09-18
 Insider Reports RSS Feed
FaceTime Security Labs have reported a worm traveling over the AIM network that will place bots on unsuspecting user PCs.
(UPDATE! AOL has advised me that their security team has put measures in place to block IMs containing the URLs used in the pipeline worm attack. They have been blocking these since September 12.)
We last mentioned Paperghost, better known as Chris Boyd, during his explorations into Zango and its MySpace adware placements.
Boyd recently posted about a new worm making the rounds via AIM. This "pipeline worm" asks the recipient, "hey would it be ok if i upload this picture of you to my blog?"
Clicking the link could trigger one of several actions. In one scenario, a file hidden in a downloaded jpg image creates a file called csts.exe on a PC. That in turn likely makes the PC part of a botnet, but not in all cases.
One person has already encountered the worm and required a lot of assistance to get it off of his system. The lengthy account of what happened as posted on the TechGuy forums showed the csts.exe executable present on that victim's machine.
Several other scenarios stemming from this new attack could take place. Their seriousness is reflected in the manner in which the attackers have set up the worm to get its files onto targeted systems:
Here, the thrill for the bad guys seems to be in lining up as many of these "install chains" as possible - I keep thinking of a ten move combo on a fighting game such as Tekken...not a bad way to describe it, actually.
What's smart about this attack is that it doesn't matter if you get a file "out of step" - if you start off with a particular file out of sequence, you'll just end up somewhere else in the chain instead. There is no right or wrong place to start with this one - the hackers will make sure you get your fill of infection files!
…We think this particular group have many more executable files ready and waiting to go live, so where this one will end up is anyone's guess.
---
Tags: AIM, Bots, Spyware
Add to  Del.icio.us |  Digg |  Yahoo! My Web |  Furl
Get all the updates in RSS: 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
