Hackers building 'botnet' with AOL instant messaging worm
548461
Hackers using computer worms sneakily implanted via America Online (AOL) instant messages were building a potentially evil &quot;botnet,&quot; a Silicon Valley Internet security firm said.
132097
(InfoWorld) - A sophisticated computer worm spreading via AOL Instant Messenger (AIM) is setting up a botnet that may be difficult to combat, security researchers said. The worm, known as W32.pipeline, propagates when AIM users click on a Web link that appears to have been sent to them by someone on their buddy list. They receive a message along the lines of, "Hey, would it be okay if I upload this picture of you to my blog?" If the recipient clicks on the link, an executable file that looks like a JPEG will download into a Windows folder, according to researchers at security company FaceTime Communications Inc. The file can then execute a number of different attacks, said Chris Boyd, security research manager for FaceTime Security Labs and the researcher who discovered the worm. It can open up the email port on the PC and send out spam messages. It can also install a variant of the "hacker defender" rootkit, which is widely deployed and difficult to remove. One of the most dangerous aspects of the worm is that it can also connect to remote file upload sites, which Boyd believes the worm authors' use as sort of staging sites where they can continuously download new infections. Once a computer is infected, the program will propagate using the same instant messaging method. The worm is unique because the program seems to be able to contact a number of different sites around the globe randomly. FaceTime researchers had different results when running the same file. "Previously, where we've seen something similar to this attempted, if one file is pulled offline or removed by an ISP, the whole chain goes down," Boyd said. "But this one, if one file goes missing or gets pulled down, it will potentially make a call to another file. It has quite a random aspect to it."So far, he estimates that the botnet -- a group of similarly infected computers that are remotely controlled -- has 1,000 to 2,000 members. More computers may have been infected but not made part of the botnet. The best defense is for AIM users to be wary of clicking on links. If a user receives an unexpected link from a buddy, the user can always reply to ask if they have sent the link, to make sure it is legitimate. FaceTime has updated its virus protection software to prevent users from infection, and other antivirus vendors may do the same. AIM users that get infected can try to remove the worm but may have to wipe and reformat their drives to get rid of it.
737700
Semi-organized people just as dangerous as botnets In late April, a Russian-speaking blogger upset with recent events in Estonia posted a series of dispatches calling on like-minded people to attack government servers in that country.â¦
249634
Online criminals are exploiting human hopes and fears to spread spam and viruses.
522625
Nasty squall New features of botnets created by the infamous Storm Worm allow denial of service attacks to be launched against security defenders that attempt to interrupt its operation.â¦
98994
A new version of the worm that spread from infected Microsoft Corp. Internet Information Services (IIS) Web servers in June has been identified and is using instant messages (IMs) and infected Web sites in Russia, Uruguay and the U.S. to spread itself, according to one security company.
245354
Don't download it - as if you needed to be told... There's a new version of the Storm Trojan on the loose, disguised as an e-postcard but actually recruiting zombies for a botnet, according to the SANS Institute's Internet Storm Centre.â¦
436341
Called W32.Funner, the worm upon infection attempts to spread itself through the host&#39;s MSN Messenger contact list. Apart from altering Windows&#39; host file and adding nearly 1000 URLs, the worm also attempts
578328
(InfoWorld) - A new variant ofÂ the Stration worm, which has been plaguing Windows users for the past year, has made the jump from Skype to the ICQ and MSN Messenger networks. This latest variant popped up earlier this week, according to Chris Boyd, a researcher at FaceTime Communications, who blogs under the pseudonym "Paperghost." "They're using Skype as a jump off into other more established networks," Boyd said. "The infection will go looking for other instant messaging clients that are on the PC and then attempt to send the infection message that it initially sends through Skype through these other chat systems." For a computer to be infected, a user must first click on a link and then agree to download an executable file. In one sample provided by Boyd, the malicious link is listed below the instant message, "Check this out. Give me your opinion." Once installed, the worm will gradually start to send out messages to the victim's contacts, Boyd said. Instant message worms have spread from network-to-network in the past, but this is the first time Boyd has seen a worm jump from Skype to another network. "It's an odd system to make, because these guys have a foot in the door [in the Skype network]," he said. "You think they'd focus all their energies onto exploiting Skype." Stration is not widespread and is considered to be a low-risk infection, but it has been a tough worm to fight for some security vendors. Over the past year it has morphed into hundreds of variants, and antivirus companies have been having a hard time keeping track of its many iterations. Stration has also been called "Warezov" and "Stratio." Nobody knows who is behind the worm, but the domains that host the malicious code are registered through a Chinese Internet company, Boyd said. Â
52844
Another candidate in the growing list of exploits on instant messaging clients and servers arrived in the wild. Called W32.Funner, the worm on Monday circulated to attack on the Windows Messenger platform.
457591
Hackers revealed exploit code for JavaScript vulnerability.
513309
News.com reports that a web worm named Santy is utilizing Google to help it spread to web bulletin boards using the PHP scripting language.
392900
Spammers are suspected of hacking into and downing Lycosâs anti-spam Web site just hours after it went live. The Web site is currently inaccessible and could also be the victim of a DDoS attack.
389353
Bot software that turns PCs into zombies spreads via holes in Symantec and Microsoft products.
125692
(InfoWorld) - Skype users are under attack from aÂ new wormÂ that spreads through the peer-to-peer Internet phone application'sÂ chat feature. The attack begins when a user receives an instant message containing a link from someone in their contact list or an unknown Skype user, said Villu Arak, a Skype spokesman based in Tallinn, Estonia. There are several versions of the chat messages, which are "cleverly written" to fool users, Arak wrote on the Skype heartbeat blog. The link appears to contain a JPEG photo file, but if clicked causes the Windows run/save dialog box to appear, which asks whether the user wants to save or run a ".scr" file. The file is malicious software that can then access a user's PC via Skype's API (application programming interface). The malicious file has been named W32/Ramex.A. "Users whose computers are infected with this virus will send a chat message to other Skype users asking them to click on a web link that can infect" their computers, Arak wrote. To avoid trouble, users should not download the file. At least two security vendors, F-Secure and Kaspersky Lab, have updated their software to detect the worm, Arak wrote. Instant message programs are another way hackers can try to gain control over PCs. Access to one person's instant messenger or e-mail account can mean contact details for many others, allowing hackers to use malicious e-mails or instant messages to lure victims into downloading malicious software. Â
319998
Blog: IM directs victims to malicious Web site where they are duped into typing in their password, it then sends itself to the victims' contacts.
376640
A worm was released recently designed to break into corporate computers running Symantec Corp's security software and make them part of its botnet.