Manage updates with the Download App
October 28, 2005 2:33 PM PDT
AIM worm plays nasty new trick
- Related Stories
-
Experts: Microsoft-Yahoo alliance is food for IM worms
October 12, 2005 -
Worms biting harder into IM, P2P
October 3, 2005 -
IM worm speaks your language
August 24, 2005 -
iTunes IM worm drops adware
July 20, 2005 -
Another worm hits AIM users
July 14, 2005
The unnamed worm delivers a cocktail of unwanted software, including a so-called rootkit, security experts at FaceTime Communications said Friday. A rootkit is a tool designed to go undetected by the security software used to lock down control of a computer after an initial hack.
"A very nasty bundle is downloaded to your machine" when you click on the worm link, said Tyler Wells, senior director of engineering at FaceTime. "This is the first time that we have seen a rootkit as part of the bundle of applications that is sent to your machine. It is a disturbing trend."
Identity theft
IM worm and malicious code attacks are happening more than ever before. The number of threats detected for instant-messaging and peer-to-peer networks rose 3,295 percent in the third quarter of 2005, compared with last year, according to a recent report from security provider IMlogic.
In addition to the "lockx.exe" rootkit file, the new worm delivers a version of the Sdbot Trojan horse, said FaceTime, which sells products to protect instant-messaging traffic. Sdbot opens a backdoor on the infected PC. The worm also places several spyware and adware applications, including 180Solutions, Zango, the Freepod Toolbar, MaxSearch, Media Gateway and SearchMiracle, the company added.
All that unwanted software can eat up system resources, slowing down the PC, Wells said. Also, the malicious applications will attempt to disable security programs and change the search page on the user's Web browser, FaceTime said.
The worm was spotted in an AOL IM chatroom and infected one of the PCs that FaceTime uses for worm bait. The company said it also has seen the pest hit other computers. "It is still out there, and it is definitely something the user should be leery of," Wells said. "The rootkit is designed to not be detected, and that is the scary part."
Worms on IM networks can spread rapidly. They appear as a message from a buddy with a link that looks innocent, but in fact points to malicious code somewhere on the Internet. Once the user clicks on the link, malicious code is installed and runs on the computer. The worm then spreads itself by sending messages to all names on the victim's contact list.
The advice to users is to be careful when clicking on links in IM messages--even when they seem to come from friends--and to use up-to-date antivirus software. When receiving a link in an instant message, the best practice is to verify with the sender if the link was sent intentionally or not.
126 comments
Join the conversation! Add your comment
and Keep your virus database up to date.
This isn't a bad idea either.
<a class="jive-link-external" href="http://www.safer-networking.org/en/download/" target="_newWindow">http://www.safer-networking.org/en/download/</a>
VERY IMPORTANT!!!! IF you have another virus scanner installed, such as Norton, UNINSTALL IT FIRST!!! Bad things will happen if you try and run two virus scanners at once.
Eliminate the common denominator, Microsoft Windows.
I did that 11 years ago and haven't looked back since.
malware programnor do I expect to ever see one. :-)
the virus, and then sit back while Tiger goes "*** am I suppposed
to do with this?"
:o)
There's a much simpler solution-don't be stupid and click on random links. But if you aren't capable of that, sure, get a Mac.
But when Apple forces you to buy a new computer every two years, that's innovation.
If I was going to sacrifice my software library on the altar of security, I'd do it to Linux and not to Apple. Then I wouldn't have to buy a new system at all. At worst, I might have to replace some hardware.
Also I'm not sure where those new $125 machines you're referring to are? Minis are $500 new, $480 for me (edu price). It's a cheapo box, but then again the basic OEM x86 boxes with no discrete video memory are too.
I don't play that many games, and there's enough available to waste lots of time, including (Unreal Tournament series, ID games, Blizzard games, Civ 3, AVP1&2, Red Faction, Sims, C&C Generals, Ghost Recon, and I don't have all day to list all of them). I really like Red Faction and AVP for LAN games, and it works fine. Games are where the platform is the weakest. If you want a toy machine, build a wintendo (I did).
Dearth of Apps? You're kidding right? How many apps do you need? I do just fine between the huge list of proprietary stuff and OSS stuff to boot. Biggest use are: Office, Fire (trillian with inline spell check), VLC, Mplayer (linux port, no windows version), Xcode, iLife suite, Audacity, iTerm (terminal with tabs), SubEtha Edit (network aware, multiple user, document/code editor), Quickbooks Pro, and much more than it's worth to mention.
I should probably mention that I work in IT. I manage windows networks. I also run XP Pro (games are 90% of what I use it for), Slackware Linux, FreeBSD, Solaris, OS9 (as a joke, my print server to prove it could be done)... My SGI is currently non-working :( I used to dual boot FreeBSD and 98.
With OSX I can use all the apps I used under windows and I have a *nix command line, and secure surfing environment all the time. While I have yet to have either my Slackware firewall hacked or my XP Pro boxes infected, they're not invulnerable. Zero-day exploits exist. If you happen across one you will be infected if you trigger it (which is easier than you might think, with an older version of Outlook/OE you could overrun a buffer in the email and infect a machine apon them recieving the message, viewing it was not required). With the XP boxen I'm very careful. When I got mailed the "I Love You" virus, I opened it up, and took a look at the virus's code, which was kinda interesting.
The old Mac hatred BS is old and getting lame. I used to call em Macintrash and all kinds of crap until a more mature friend clued me into OSX. I still hate OS9, but I hate it for valid, firsthand observed failings. Do some research into what the strengths and weaknesses of a platform is before looking stupid. Personally I hate wizards. Show the control panel/config file and leave me alone. Windows gets in my way more every year with the wizards, and that's a firsthand observation.
Apple's failing is they do cost more to get decent horsepower, and Network Management software and games are lacking. You're also more limited in hardware choice.
Windows failure is that it does everything and seemingly nothing incredibly well. It supports ten tons of hardware with poorly written drivers, ten million poor applications that can trash your registry/dlls. Building a decent box is an exercise in checking on what hardware is solid and has good drivers.
PS: Apple could not have written something as cool as OSX. It's updated NeXTstep through and through. So while it may have a candy coat, it's the same OS that was created with security in mind, which is why it was used by the CIA among other agencies.
afraid of receiving email or instant messages
from total strangers.
The box said: "Requires Windows 98/2000/XP/NT,
or better." So, I installed LINUX!
"In a world without walls and fences,
who needs windows and gates?"
Tux et bona et fortuna est. ;)
(16,000+ packages)
<a class="jive-link-external" href="http://packages.debian.org/stable/" target="_newWindow">http://packages.debian.org/stable/</a>
Debian comes with this slick install/uninstaller/update/patch tool
called synatic.
<a class="jive-link-external" href="http://www.nongnu.org/synaptic/action.html" target="_newWindow">http://www.nongnu.org/synaptic/action.html</a>
Most other Linux distros have something simmilar.
I just tried the free version of Xandros.
I has an installer that makes Microsoft Windows look pitiful.
<a class="jive-link-external" href="http://www.xandros.com/products/home/desktopoc/dsk_oc_download.html" target="_newWindow">http://www.xandros.com/products/home/desktopoc/dsk_oc_download.html</a>
Aptitude is console based, so faster but not as pretty (unless you count colourful as pretty). Nicest feature is that it will automatically uninstall things it automatically installed when you no longer need them.
I'd agree with the point on Windows Installer having had to delve into the guts of it. It is quite ugly. How many primary keys do you need to identify a product or component?
The one advantage I thought MSI had over Deb was the ability to embed dependencies, but that can be solved easily in deb. Add a CDROM or web site to Deb (and Synaptic provides a nice menu for this) and the CDROM can also include dependencies which will be autoinstalled as needed.
want to enjoy this amazing technology and
entertain themselves chatting with friends have
to put up with this virus/worm crap. The way I
see it, the only viable solution is to go to a
locked down version of BSD/Unix or Linux; only
when the number of MS Windows users drops enough
that MS stock is in the toilet, only then will
MS take this problem seriously and write an OS
which is not so vulnerable.
"go to this link, download this file and disable your Virus
protection" is the dumbest advice I've ever heard...and yes, I do
this for a living so I AM PARANOID.
This is how people on the Internet get OWNED. and how all of
their financial data gets sent to some jackass in Estonia or
Romania.
Good job, and **** Googling for this. It's all about educating
people not to blindly follow links like sheep.
way Windows was designed (user level mode vs. kernel level
mode). I'm not sure whether anti-virus tools can even scan
kernel level mode space because of the trusted nature of
everything that runs in the kernel.
One good example are device drivers that you install for
hardware support. They reside in the kernel and this is the
reason why there are security controls in WIndows to prompt for
confirmation before installing drivers.
In a nutshell, rootkits are a ***** and terrible to find.
If it's the *first time* you've seen this, how can it be a *trend*? Was that a vehicle for being able to place "disturbing" in your article? Why can't reporting done with accuracy and editing?
Never thought I would see the day when I would be defending a journalist...
Hackers tend to learn from their peer's mistakes as well as their accomplishments.
If the rootkit works, they'll exploit it.
Buying a Mac is a viable solution. It's strange that windows users generally use the Admin account(root). You'd think Microsoft would invest in something to secure their OS better.
-----
Root-kits are software specific, the fact that it's a PC (x86 machine) does not mean it's vulnerable. Linux is likewise not affected by this regardless of what the computer is. Likewise, AIM is a free service and does not make Time-Warner money directly. TW spending great deals of money on AIM is probably not in their best interests.
As far as administration; I generally prefer to administer in order of preference: Slackware, OSX (mostly from CLI), FreeBSD, some other *nix, Windows NT (2k,XP), WinDOS (95,98,ME), Classic MacOS. OS9 and OSX have virtually nothing in common, especially with regards to administration. OS9 and OSX were not even created by the same company. So talking about adminstering Macs, is like saying administering IBMs, which could mean mainframes or cheapo PCs.
What do I know of root kits and root users. The kit makes the
intended OS vunlerable.
We have no choice, its XP or else. AIM is free and because of that
we can all breath easy. Unless you put your name on it.
Look - I MUST use a Windoze machine for work, but I do ALL of my home websurfing and 100% of my internet online sales transactions on a Mac. Sorry, you mac haters out there, but my mac laptopn and desktop at home are perfectly safe - even from mac viruses, since nothing can install itself.
Seriously though, Windows needs better security from the average idiots. But, my feeling is, its like the firefox issue. As more people start using macs, the more people will look to write viruses/spyware that will affect macs.
Remember people, 90% of virus/spyware writers are doing it for the money they can make selling information. Or to further annoy Windows Users.
The true virus writer: A mac user mad that his OS is not number 1 :P
Peace
virus software. If a person with a Mac has a Windows virus
located on the hard drive, a virus checker will find it and flag it.
That DOES NOT mean that the Mac was infected. Essentially, it
was just acting as a container for the virus which was likely
received through an e-mail attachement. However, it is still
essentially "live" and can theoretically be transferred to a PC,
where it will do its damage.
program detected? I would like to know what the program detected
it as, because I too work in this field except its not just IT, I also
design software programs for UNIX (including Mac OS), Linux,
Symbian, Solaris, and Windows. Please share with all of us if you
think that Mac OS is not #1 what the virus was called, also since
you are in tech support you should also know that viruses cannot
spread on a Macintosh computer like it does with windoze if there
ever was one written for OS X.
Suse, knoppix, and whatever else he mentioned are linux distro's which would require you to reformat the whole computer and replace windows. With this, you can't run most windows based programs, granted there are free alternatives, but it is a confusing step and I'd suggest finding a forum or community where you can get support before you make the switch. I personally reside at techimo.com which is a great forum if you're looking for one, or you can find a local linux user group to help you through the switch if this is what you decide. If you're interested, try knoppix, which is a bootable cd, so you don't actually have to install...and when you get frustrated or sick of it...just pop the disk out and restart and boom...there's windows :).
2. Macs like anything else have a binary structure that is different from all other operating systems. Binaries on Windows do not affect Linux, or Mac OS X.
With these things in mind, a rootkit designed for Windows WILL NOT infect a Mac. Period.. Even if it is written in Python or Perl, how can it infect ps, netstat, etc. or replace them? If it replaces them with a Perl script or similar it would be very easy to detect = it would defeat the purpose.
Yes, there are people who have a Mac who know nothing about technology and think they're immune to everything solely because they have a Mac.. but there are a far greater amount of people who are PC-biggot ******** who trash on Mac simply because it's branded as "easy to use" for newbies and do not require technological savvyness to use.
Who's the biggot. The one stating the truth "Get a mac and you won't have virus problems." or the one saying "Yeah whatever. Mac sucks. You're stupid, any computer can get viruses and one day Mac will have them."
Apple will deal with that when it happens, but right now, the fact of the matter is that if you have a Mac, you WILL have ZERO of the problems you have when dealing with Windows, this includes:
1. Viruses
2. Spyware
3. Stupid bugs that haven't been fixed since Win95, and probably never will be
4. Having to spend 4 hours fixing some stupid thing before you can do something that would take 5 minutes otherwise
and the list goes on and on. Can you get a virus on a Mac? Of course it's POSSIBLE. but is it likely? Probably not.
So unless your motives are pure and unbiased when it comes to dissing the Mac, shut the hell up.
If you, in your Apple induced technology stupor, do not know what a R-O-O-T-K-I-T is, then I would encourage you to put down the Kool-Aid, shut your pie hole, and do some research.
Even you - YES YOU - are vulnerable to the emerging R-O-O-T-K-I-T threat.
priviledges to install itself. As soon as that dialog box shows up
asking for it, it's a dead giveaway that it's something I don't want
installed.
Come on, Microsoft, copy this small detail from Apple and rid the
world of these auto-installed menaces.
Futher, this rootkit is installed in a way that would not be possible on a Mac. Mac is using a version of Unix known as Darwin. This is a HEAVILY permissions based filesystem, that does not allow for arbitrary writing of files to the disk. In fact, in order to even ATTEMPT to install this software the user would have to type in an administrator's password, for EACH installed item. This would definately alert any Mac user that something is up. Of course, the software would have to be written to RUN on a MAC in the first place, which it is not.
Regarding your request that Mac users do some research shows that the author of the above comment is not familiar with the typical Mac user. *MOST* Mac users are former Windows users. Usually people who were completely Windows literate, but were tired of having to hold in that power button on the front of thier computers because the system FROZE. Or, people who were looking for a more intelligent computing experience, meaning, that a more efficient interface means more work gets done faster. There is also a HUGE number of Linux users (of which I am one) switching to the Mac. In the realm of knowlegable computer users, Linux users tend to rank a bit higher than your average Windows user, so to insult the Mac community by saying that we need to do some "research" simply shows that you have not done your own.
able to exploit the system first in order to install it. That's were the
difference lies--MS Windows has about 20x the vulnerabilites of a
well-run *nix system. Not only that, but as I am sure you know
(since you seem so wonderfully educated) a rootkit needs to be
designed for a specific OS. In the case of the AIM rootkit, *nix
systems are not vulnerable.
I rather do admin on a mac than a PC. You need a degree on spyware and viruses to admin a PC.
You would think that Gates and company would just buy out the spyware and virus makers considering that is what they do. But I guess that they are off spending your money on real things like AIDS. A good thing no doubt but a product of PC spending.
Here is a clunker for PC users-- your private information is in the hands of some guy in Mexico who wants your ID and your cash.
AS far as AIM is concerned. With the mass marketing of their service you would think they could patch this bug. oh, that is right PC users like to send spam inavertantly...
1) Few people use Macintoshes, comparatively speaking. This means that few people will bother writing toolkits for it.
2) Because so few people use Mac, there is less interest in spyware written for it. This article seems to indicate that one of the primary reasons for this toolkit is to deploy spyware, possibly as a means of making money for the creators of the rootkit.
3) OS X is based on the BSD kernel, and so it is less vulnerable to rootkits in general (though not impervious, I'm sure).
At any rate, you should save your hostility for the people who create worms.
user on MacOSX is disabled unless you really know how to dig
deeply into the OS and enable it. So just sit back down and scan
for this one. I'm going to have a taco:)
I'm not sure if it's the right term. Most Windows users run as root anyway, so getting root is no problem. You already have it. The naming must come from the ability to hide from antivirus software, but viruses have been trying to do that for years. I suppose the only new thing is that it comes in kit form.
open .exe files, haha... silly people! maybe my VPC drive will... but
oh well its windoze