Slashdot Log In
Pipeline Worm Floods AIM With Botnet Drones
Posted by
kdawson
on Mon Sep 18, 2006 02:58 PM
from the now-that's-a-worm dept.
from the now-that's-a-worm dept.
Several reader write about a new AIM threat
dubbed the "AIM Pipeline Worm" that uses a sophisticated network of "chained" executables to attack the end user. Security Focus has a brief note. One anonymous reader writes: "Using this method, there is no starting point for the attack — a malicious link via IM can send you to any given file, at which point the path of infection you take depends entirely on the file you start off with. The hackers can then decide which order to install malicious software, depending on their needs at the time. At a bare minimum, you will become a Botnet Zombie — if you're really lucky, you might be Trojaned, have a Rootkit installed on your PC, and be used for spam, file storage, and DOS attacks. Unlike similar attacks that have been attempted in the past, the removal of a file from the chain will not stop the attack — you will simply end up with something else installed instead, in the form of a randomly named executable dumped in your system32 folder. You'll still spam an infection link to all your contacts."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
i love it... (Score:5, Funny)
the internet is a wonderful place
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Ah, the 36-count jumbo box... I believe the name for that sized box is "The don't-have-a-Family Pack".
And the lesson is... (Score:5, Insightful)
Re: (Score:3, Funny)
Which company is that? I just want to be sure to avoid working there ever.
Re: (Score:3, Informative)
Re:And the lesson is... (Score:5, Interesting)
Many, many companies block AIM at the firewall. Ask at your next interview.
There is more wrong with the above scenario than just that. Blocking AIM is usually what happens at two kinds of companies, those that somehow think it will help productivity and those who are security paranoid. At the former, the working conditions probably suck. At the latter, a competent admin will have a Jabber server that connects to AIM and filters for malware. Otherwise, technical employees are likely to bypass security by SSH tunneling their IM communications, which is a risk in and of itself.
The other thing wrong with this is paying for a propriety IM solution instead of going with a free, open, standard, interoperable, secure Jabber server. With jabber you can chat with any other Jabber server using a variety of clients on a variety of platforms. Internal communications are fully internal, running on your own server. External communications can be encrypted. Any company that pays for some other, proprietary IM server is probably run by incompetents and should be avoided.
Parent
Re: (Score:3, Informative)
Run a jabber server and filter the connections through there? GET REAL! Besides, most of these things have web based clients anyway, and admitidly I dont know exactly how this "jabber server proxy" would work but I doubt it even goes near port 80.
What I have done to combat this problem is block instant messenger with group policy,
Re: (Score:3, Insightful)
-K
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
Many, many companies block AIM at the firewall.
Should that not be "Many, many companies think they block AIM at the firewall."
Nuff said if your security people think they have it all plugged it all up.
Re:And the lesson is... (Score:4, Interesting)
Don't worry. I'm sure everyone there has installed AIM on their computers without letting the IT department know.
Parent
Re: (Score:2)
Re: (Score:2)
Well damn. I wonder if Intel, Motorola, Cisco, Vodafone, or MCI will ever get "actual" IT departments, as they all currently allow employees to IM to people outside the company, through their firewalls.
Re: (Score:3, Insightful)
Then they took a look at that cost and found that it is actually less than what they get back from increased productivity that their employees get by IMing their friends/family from work, instead of simply emailing or using a phone.
Actually I know some of the security guys at one of those companies and I can make a good guess as to how the decision was made. It was probably at a much higher level. "Well should we try to lock down each application on every desktop and have everyone trying to cram everythi
Re: (Score:3, Insightful)
A few requests out to a website for a picture would hardly be considered an anomaly. I'm pretty sure our corporate proxy sees a few dozen requests to
Depending upon whether or not their is a signature, it will be listed by worm name or as an unknown worm.
If there is no signature, how would it be listed as worm at all? Are you talking signature based on an IPS? Becau
And the lesson is, don't use omnipod, use jabber (Score:5, Insightful)
Parent
Re:And the lesson is, don't use omnipod, use jabbe (Score:5, Interesting)
ur users do actually get alot of latitude with thier machines (programming shop, they have to have it) but there are certain things we do not allow. Public IM networks are one of them.
Having worked at a number of programming shops, that doesn't sound like a lot of latitude to me. If you can't install arbitrary software because of an AD policy and you audit people's machines it sounds like a very authoritarian place that does not trust the workers very much. Here we get a choice of computer brand (1 of 3), laptop or tower, any OS we want, and any software we feel like. We're also responsible for keeping our machines moderately secure. We have internal IRC servers and any IM we want is fine. Shop talk is encrypted by policy, either over Jabber or on top of a public network like AIM.
I think it is pretty darn useful. I have a lot of friends and colleagues on both of the aforementioned IM networks who I regularly consult and vice versus. This provides me with an additional resource as well as makes for a more relaxed atmosphere, like when I want to see if my girlfriend wants to meet me for lunch, or just want to chat with old college buddies. I think the fact that my company trusts me is a lot more valuable than tight security policies. Most serious compromises come from within. Because they trust me I'm happier and I'm also a lot less likely to sell them out. Contrary to what you may have heard, studies show the most effective motivation for not exploiting an employer is not fear of punishment or being fired or jail, but an ethical desire to not hurt those who trust you. If your company does not trust you (audits, arbitrary restrictions) then that motivation is removed.
Parent
Re: (Score:3, Interesting)
Funny, I thought that when I was sitting at my desk, I was at work. What I'm actually doing at my desk has nothing to do with whether or not I am at work.
Oh, and by the way, open your eyes and read this:
What's Next: Stupid Productivity Tricks [inc.com]
You say you don't care if people walk around for a bit? Eat your words:
"recreational Web surfing has become a kind of mental floss for workers who spend their days sucking in a stream of work-related data that now comes in at a
Re: (Score:2)
No the real lesson here is don't use that half-assed excuse for an operating system for anything more than playing video games.
I am sorry if I don't yawn (Score:5, Insightful)
The method used after that sound interresting, but nothing beat "trusting" executable being sent by any source, anonym or not , on email or AIM. Do that and SOONER or later your day will turn bad.
Re: (Score:2)
But WHICH keyboard and chair? (Score:3, Insightful)
Yes, at some developer's desk.
Some brilliant programmer asked: What if the user of my messenger application, clicks on something? And his answer was: well, if it's a URL, download the file. [Ok, so far, so good. A little risky, but not totally stupid at first glance.]
Then the followup question was: what if the file turns out to be an executable program? And his answer was: execute it, of course! Oh, and with the same privileg
Re:I am sorry if I don't yawn (Score:4, Funny)
Sounds perfectly sane to me.
Parent
Simple risk mitigation (Score:3, Informative)
2- Back up your profile regularly.
If you ever get bitten by something like this, it's easy to recover from.
Re: (Score:2)
Re:Simple risk mitigation (Score:4, Funny)
Parent
Re: (Score:3, Insightful)
(3) Linux doesn't allow non-root users to install shit in vital system folders and be run at startup.
Re: (Score:3, Interesting)
The kids will often need to use MyJal to download ringtones
Re:Simple risk mitigation (Score:4, Insightful)
Now if we are talking about a work enviornment then sure, give everyone in the building (except engineering) non-admin accounts, but I would never recommend doing it to someone who didn't have a high level of computer knowledge and patience or an equivalant IT staff on hand to help out with any issues.
Parent
Re: (Score:2)
Software that requires an admin account is soooooooooo 1995. it should be considered obsolete.
When its supplier does not want to fix it, he deserves to go out of business.
Re: (Score:3, Insightful)
you right-click an executable and choose 'run as...' then the default option is to run it in an untrusted mode without giving it access to your files and settings.
The problem is, to do this you have to have set up a different user account and it has access to all of those files and settings. This is broken conceptually, and in practice for the average user does not create a second account and because the average user does not want a second account, they want run programs without letting them mess anythi
Solutions (Score:4, Informative)
Within the reach of an expert, RegMon and FileMon can point you to the isolated places where changing ACLs will allow the stupid program to run. The most frequent bug is for a program to try to write to one or a few protected locations.
Parent
Re: (Score:3, Informative)
Yep, do it all the time. Even taught the wife how to do it. See http://blogs.msdn.com/aaron_margosis/archive/2005/ 03/11/394244.aspx [msdn.com] for details, but the basic idea is to run a batch file when you want to be an admin. The batch file gives you admin privileges, starts a process (usually iexplore.exe file:///c:/ , which gives you a
Good thing it's AIM ... (Score:3, Funny)
Now I have more reason than ever to install trillian/gaim on newb computers.
Re: (Score:3, Funny)
Re: (Score:2, Interesting)
Re: (Score:2)
Re:Good thing it's AIM ... (Score:5, Informative)
www.dodgywebsite.com/really_interesting_picture.j
Note that the last part of the URL was ".com"
You gotta watch yourself
Parent
Re: (Score:3, Informative)
Not to Worry (Score:5, Funny)
Re: (Score:3, Funny)
Senator Ted Stevens responds:
Yes, but you see, the tubes are connected to pipes, and those pipes are connected to larger pipes, and then there are canals, and dams and reservoirs, and other things that are even more complex and convoluted. So you can see by my use of the words "complex" and "convoluted", that it's all terribly complicated. But you are right about one thing: thank God it's not a t
Why this is important. (Score:2)
And if you don't guess who they'll call first about how their computer has gotten SLOW again.
Re: (Score:2)
Re: (Score:2)
using aim (Score:2, Funny)
Tubes Dammit! (Score:2)
And the definition of Tubeworm [wikipedia.org] probably needs to be rewritten.
fuckers stole my system32 folder (Score:3, Funny)
This rings a bell (Score:3, Informative)
From the article: What's smart about this attack is that it doesn't matter if you get a file "out of step" - if you start off with a particular file out of sequence, you'll just end up somewhere else in the chain instead. There is no right or wrong place to start with this one - the hackers will make sure you get your fill of infection files!
The basic idea of using multiple, completely unrelated vulnerabilities and attacks to achieve total control is not exactly that new. In fact, the ideas that feel so obvious to us today were quite novel back in the turn of the century. Michael Zalewski described [coredump.cx] a worm prototype that worked in somewhat similar manner more than six years ago.
On the occasions that I get to give lectures about computer security, I try to illustrate these very ideas. The rule #1: There are no local exploits; All vulnerabilities are remote, some may just require a piggy-bag step of first delivering extra code via other holes.
Re: (Score:3, Funny)