May 1, 2006 12:15 PM PDT

AOL IM bot cloaked in encryption

Related Stories

AOL's remixed Messenger

May 12, 2005

AOL tries out new IM chat bot

January 27, 2003
AOL Instant Messenger users who click on a malicious link could find themselves the victim of a newly discovered bot that uses encryption to increase the range of its targets and make eradication more difficult.

America Online on Monday said it is blocking malicious links tied to a recently discovered bot that uses encryption to increase the range of its targets and make eradication more difficult.

The bot software, which can only infect those who click on a malicious link sent via AIM, may infect upwards of a few tens of thousands of users, said Johannes Ullrich, chief research officer at the Sans Institute. San's Internet Storm Center released a report on the issue Sunday night.

"This is one of the few times we've seen a botnet encrypted," Ullrich said. "Encryption usually takes a lot of code space, but in this case it does not. It's a leaner bot."

A computer that has bot software installed--for example through a malicious Web site or Trojan horse--is called a zombie. A network of zombies is referred to as a botnet.

The bot, which is about a third of the size of other bots that have used encryption, requires less bandwidth to infect someone's system, making it possible to infect a larger number of computers, Ullrich noted. In addition, the encryption makes it more difficult to ascertain the bot's command language, so IT administrators could have a harder time locating and removing the bot.

But AOL said it is blocking the three URLs it has identified as being tied to the bot in order to prevent its AIM users and AOL subscribers from inadvertently clicking on the link and infecting their machines.

"It is not a significant threat for our members or AIM users," said Andrew Weinstein, an AOL spokesman.

Security researchers also suspect that the bot may be using peer-to-peer techniques rather than relying on a central command control server to issue orders to a network of zombie computers. As a result of the peer-to-peer network, the malicious attacker can easily issue commands from any one of the commandeered zombie computers, and the encryption gives only the attacker control of such commands.

See more CNET content tagged:
bot, AOL Instant Messenger, encryption, SANS Institute, America Online Inc.


Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot



RSS Feeds

Add headlines from CNET News to your homepage or feedreader.