November 17, 2005 12:46 PM PST

Rootkit worm linked to hacker group in Middle East

Related Stories

AIM worm plays nasty new trick

October 28, 2005

iTunes IM worm drops adware

July 20, 2005

BitTorrent file-swapping networks face crisis

December 20, 2004
Security sleuths at FaceTime Communications say they have linked a group of hackers operating in the Middle East to a worm that began spreading last month via America Online's Instant Messenger service.

Experts at FaceTime's security unit reported Thursday that the hacker group has seized control of at least 17,000 computers across the globe. The hackers have the capability to pilfer personal information from a computer's hard drive or remotely commandeer a PC to help launch attacks against companies or networks.

FaceTime, headquartered in Foster City, Calif., has alerted the FBI and warned that the 17,000 computers were controlled by a single compromised server. There is a chance that the hacker band may control other servers and thousands more computers, according to Tyler Wells, senior director of engineering at FaceTime.

"The fact that they are using instant messaging is a disturbing trend," Wells said. "These guys are using BitTorrent...and that is getting a bit scary. They are using IRC-enabled spyware to control PCs."

BitTorrent is a freely available file-sharing network that hackers have been using to move large files more easily, Wells said.

On Oct. 28, FaceTime identified a worm that delivers a rootkit designed to go undetected by the security software used to lock down control of a computer after an initial hack.

Subsequent research has revealed that the rootkit worm piggybacking on AOL Instant Messenger acts as a back door for adding spyware, which can be used to pilfer usernames, passwords and other personal information.

A hacker can control this process through IRC, or Internet Relay Chat, communications.

Wells said FaceTime traced specific signatures within various code associated with the exploit. This gave them the ability to resolve where the exploits originated.

The FBI did not immediately respond to a request for comment.

3 comments

Join the conversation!
Add your comment (Log in or register)
Is this Copyright Propaganda
Could this story and FaceTime be stooges created and contracted out by the copyright industry? Taking the word RootKit, mixing in P2P and the Middle East could be a great story used to deter some attention away from Sony's blunder. I smell a RAT!
Posted by paul7986 (4 comments )
Reply Link Flag
No need to deter......
This is neither a rat nor propaganda and this story is far from Sony and their sinister actions. Don't lose sight on a market giant spying on it's customers when they can't grasp the forsight that Apple had with iTunes. If you are smelling a rat check your cubicle because that is the only rat here.
Posted by lifeofzero (1 comment )
Link Flag
Poor writing: BitTorrent?
And how id BitTorrent involved?

Not at all, from what I can see.

Sloppy!
Posted by 203129769353146603573853850462 (97 comments )
Reply Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

Inside CNET News

1-2 of 12

Scroll Left Scroll Right

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.

Markets

Market news, charts, SEC filings, and more

Related quotes

Time Warner (0.96%) 0.36 37.88
Dow Jones Industrials (0.57%) 72.81 12,874.04
S&P 500 (0.68%) 9.13 1,351.77
NASDAQ (0.95%) 27.51 2,931.39
CNET TECH (0.84%) 17.13 2,049.14
  Symbol Lookup