'Frankenstein' Attack Hits AIM
Del.icio.us
Digg
Google
Spurl
Blink
Furl
Y! MyWeb
Share:
Sponsors:
John E. Dunn
A potentially destructive new worm is targeting users of the America Online instant messaging service.Called W32/Sdbot-ADD by Facetime Security Labs, the vendor that first reported its existence in a less harmful version some weeks ago, this is a worm with a troubling and innovative twist--it installs a rootkit-like backdoor on any machine it manages to infect.
Chris Boyd of Facetime, the researcher who discovered the new and dangerous W32/Sdbot-ADD malware bundle, describes it as being a low to medium risk, but one the company is publicizing because of its dangerous effects. If it infected a PC, he would consider reformatting the machine from scratch, he said.
How it Works
An attack starts with an AOL Instant Messenger (AIM) user being asked to open a link, apparently at the request of an AOL "buddy" or contact. Clicking on this initiates the infection sequence, which starts with the dropping of a number of adware files, and the rootkit software itself, lockx.exe.
Once on the PC, the malware attempts to shut down antivirus software, install software that allows the PC to be remotely controlled by IRC, and open a backdoor for future attack. It also contains an SMTP engine with which to collect e-mail addresses.
The vendor has classified it as being the first IM rootkit because of the way it attempts to hide traces of its existence. The rootkit file's use of IRC is also considered especially dangerous because it allows attackers to execute remote commands.
Mix of Methods
Facetime's Boyd says the "Frankenstein-like" malware has strange properties that mark it out. Several of the adware components it installs have been seen before, for instance. What was innovative was the mixture of many different components, the installation of such a potentially dangerous executable, and the fact it attacks through the generally unprotected channel of instant messaging.
The infection route was also by way of a link leading to a blank page, in contrast to conventional "drive-by" infections that dropped malware from real Web pages.
Facetime's tests indicated that several antivirus programs were not able to detect the malware. Equally, most antivirus programs don't monitor the IM channel, so this is not surprising. Once on a PC, the malware runs like any other unidentified executable.
"They (the malware writers) will push out many variants in order to confuse things," said Boyd, describing the new outbreak as probably a "dry-run attempt" for something to come.
Article submitted by: Webshark
Last Update: 11-02-2005
Category: Security
A potentially destructive new worm is targeting users of the America Online instant messaging service.Called W32/Sdbot-ADD by Facetime Security Labs, the vendor that first reported its existence in a less harmful version some weeks ago, this is a worm with a troubling and innovative twist--it installs a rootkit-like backdoor on any machine it manages to infect.
Chris Boyd of Facetime, the researcher who discovered the new and dangerous W32/Sdbot-ADD malware bundle, describes it as being a low to medium risk, but one the company is publicizing because of its dangerous effects. If it infected a PC, he would consider reformatting the machine from scratch, he said.
How it Works
An attack starts with an AOL Instant Messenger (AIM) user being asked to open a link, apparently at the request of an AOL "buddy" or contact. Clicking on this initiates the infection sequence, which starts with the dropping of a number of adware files, and the rootkit software itself, lockx.exe.
Once on the PC, the malware attempts to shut down antivirus software, install software that allows the PC to be remotely controlled by IRC, and open a backdoor for future attack. It also contains an SMTP engine with which to collect e-mail addresses.
The vendor has classified it as being the first IM rootkit because of the way it attempts to hide traces of its existence. The rootkit file's use of IRC is also considered especially dangerous because it allows attackers to execute remote commands.
Mix of Methods
Facetime's Boyd says the "Frankenstein-like" malware has strange properties that mark it out. Several of the adware components it installs have been seen before, for instance. What was innovative was the mixture of many different components, the installation of such a potentially dangerous executable, and the fact it attacks through the generally unprotected channel of instant messaging.
The infection route was also by way of a link leading to a blank page, in contrast to conventional "drive-by" infections that dropped malware from real Web pages.
Facetime's tests indicated that several antivirus programs were not able to detect the malware. Equally, most antivirus programs don't monitor the IM channel, so this is not surprising. Once on a PC, the malware runs like any other unidentified executable.
"They (the malware writers) will push out many variants in order to confuse things," said Boyd, describing the new outbreak as probably a "dry-run attempt" for something to come.
Article submitted by: Webshark
Last Update: 11-02-2005
Category: Security
Current rating: 5.42 by 47 users
| Would you recommend this article to a friend? |
| Not a Chance | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | Absolutely |
Related News Stories
(9,413 reads) 07-05-2008
· Fusion Security(15,104 reads) 06-02-2007
· NukeSentinel(tm)2.5.10 Critical Update(13,860 reads) 05-07-2007
· NukeSentinel(tm) 2.5.08 Maintainance Release(15,334 reads) 03-15-2007
· NukeSentinel(tm) 2.5.07 Reissued: Critical Update(13,830 reads) 03-02-2007
· NukeSentinel(tm) 2.5.06: Critical Update(14,592 reads) 01-23-2007
· NukeSentinel(tm) 2.5.05 released(14,616 reads) 12-24-2006
· NukeSentinel 2.5.04 released(14,342 reads) 11-03-2006
· NukeSentinel(tm) 2.5.03 Released(18,181 reads) 10-19-2006
· Php Nuke 8.0 Patched(14,568 reads) 10-01-2006
· ipBan Modification
Please register or sign-in to post comments.