Microsoft Instant Messenger Virus Sweeps Net

Many people have reported a Warhol virus affecting users of Microsoft Instant Messenger. If you get messaged, "Go To http://www.masenko-media.net/cool.html NoW !!!", or any similar message (apparently there are several websites with the infection code), I suggest not following the link. A brief discussion follows.

Sequence: Get messaged "Go To http://www.masenko-media.net/cool.html NoW !!!" or something similar with another URL. Follow the link. That webpage contains malicious code which gets your messenger contacts and sends a similar message to your contacts. It looks like it uses a vulnerability in formmail.pl as well, although I'm not exactly sure how (I'm not an expert in ECMAscript, sorry, and I have no systems that could possibly be affected by this to test with). I'm sure some of our readers can provide more information in the comments below.

There appear to be several webpages which carried the infected code, not just masenko-media.net. Some webmasters are already taking them down.

Sophistication: moderate. Damage: only your pride.

Solution: probably the latest mega-patch for Internet Explorer will fix the Microsoft bug that allowed this.

Risks: obviously, the code could have done worse than just messaging your contacts. With Microsoft making "messaging" an integrated part of the operating system, any flaws in it can be exploited to affect millions of people instantly, so it is a high-value target. Does it have commensurate high-strength security?

Other clients?

[Geeyzus]

I assume this only affects the MSN client from Microsoft... correct? Or does this also affect other clients that can use the MSN network, like Trillian? If it is just a link to some virus code on a website, it would affect Trillian (because it actually doesn't propagate through the instant messaging program)... but if it is something that gets triggered inside MSN Instant Messenger, then Trillian users are safe...

Mark

Anyone surprised?

[Qwerpafw]

I for one, am not shocked at all :)

Anyone who is shocked is a bit of a fool. It was only a matter of time, really, until one of M$'s many security holes in messenger was exploited. Kinda sad to think what will happen in the future as OS becomes more and more integrated with the internet. Your personal data (courtesy of passport) might be spread around if you replied to a IM, or data loss.

Don't use microsoft products, so I am not vulnerable. Happy me.

Re:Forwards are evil / Virus news

[djsable]

>> Why can't one single week go by without a big annoying MSFT bug / virus being exposed?

The media loves that crap. They descend on it like a shark smelling blood. Any other product could have worse bugs, and they would be all Ho Hum, but a MS bug/virus? whooo boy, feeding frenzy!!

Also, because the people who write the Virii target MS (it might just be easier too.) because of the LARGE install base of it. You can write a Linux virus, and it nails like 100 people, but you could write the same bug targeting MS products, and you can nail 100,000! You do the math. :) which is more tempting a target.

No system is 100% secure. Period, end of story.

MS products in general, are like swiss fricking cheese though. My big complaint is the "Turn It on By default" attitude of MS Products. I had the Messenger on my system, and after adding a couple of co-workers, never used it. I got nailed by the bug today, and was quite annoyed by it. Fortunatly, the payload is non destructive, or I would have been PISSED. Leave it off by default, and IF i want it, I'll turn it on.

badger

Re:The Code

[einhverfr]

So this sends the links to your contacts in IM and takes your passport email address and sends it to the http://www.yong.f2s.com/mailform.pl (or something similar).

Damage: not just your pride-- being bombarded with lots of spam? (I guess that is TBD)

It's only a matter of time...

[Max the Merciless]

until someone unleashes a virus that does some serious damage. If I was a "terrorist" hell bent on punishing the Western world for whatever percieved sins, I'd be learning how to make, or hiring programmers, to unleash a truely destructive virus.

It's been said many times before, but I'll say it again, any monoculture is far more vulnerable to attack than a diverse system. Relying on one system, be it Microsoft or even Linux, is foolish.

The destruction of the Microsoft monopoly is not just a matter of helping improve competition, it is a serious security matter. No amount of campaign donations or legal semantics should distract the government from its task of providing security.

This is dumber than a mail worm

[J.D. Hogg]

I would be impressed to see a worm silently infect your machine and try to infect your contacts. But this one asks you a *click a url* ?? Anybody who doesn't dismiss a message with a URL or an attachment from somebody they don't know, whether it's in an instant message or an email, deserves to be infected (and also should have their computers taken away from them and a flyer explaining them why they shouldn't talk to strangers in the street given to them instead).

But /. is right, it is a Warhol virus : all the posters who reported this non-news got their 15 minutes of fame on Slashdot.

Re:Not a Messenger flaw

[RWarrior(fobw)]

"Install the patch and be done with it."

Is that why I keep getting probed with NIMDA? Because people just install the patch and are done with it?

Re:Not a Messenger flaw

[Tackhead]

> First off, this is not a virus. It's an Internet Explorer exploit allowing access to your Messenger contact list and other Messenger functions.

And while we're at it, this isn't a Warhol worm either.

I don't see the optimized scanning routine for initial propagation. I don't see a precompiled target list or any innovative ways to scan the network. And if you wanted to do maximum damage, you'd release it on a Friday night before this weekend.

Unless the spam from the formmail.pl script contains a very clever exploit to set the stage for a second round of infection, I'm calling this one a false alarm. It's an annoyance, but not a Warhol worm by any stretch of the imagination.

Re:interesting article on the reg

[targo]

And of course, MS has known about this since december :-P


Yes, and there has been a patch for this problem. So what did you expect MS to do? Spam all the IM users to install the patch? C'mon.
Btw, WindowsUpdate prompts you to install this patch, I don't see what else should have been done about it ("this bug should not have been there" rants don't count as a solution).

Re:Well, that's one less effectual site for vector

[xintegerx]

Isn't it possible that the virus itself flooded the website with many hits to it coming from just instant messenger? :)

Plus, since the topic author knew the exact URL from somewhere, it must have already been fairly widespread before it got here :)

Re:One shoe drops

[rjamestaylor]

• Don't believe me? check out the IIS curve at Netcraft [netcraft.com] . What happened after Nimda and Code Red? IIS usage INCREASED.

IT purchasing decisions are made by people who are insulated from these problems but not from IT advertising. Ergo, this kind of problem has little to no effect on the IT market.

Where is Windows Update?

[weave]

I went to Windows Update this morning looking to update my IE using that uber patch. Said no critical updates. I had to go to technet and download the patch from there.

Why the hell does it take Microsoft so long to get patches onto Windows Update, which most users use to get their updates (those that look)?

Like, when I heard about the SNMP problem yesterday, I went to rhn.redhat.com, found an update for snmp, did a select all for all my linux boxes i adminster at work, scheduled them to be updated, done. I got look for an SNMP update for my Windows servers, none found.

It's just annoying... Microsoft has billions for R&D, takes weeks to get a patch out on Windows update, yet some kid can write autorpm that does the same kinda thing for linux in his spare time...

Re:Gee...

[generic-man]

So according to the issue of RISKS Digest, this third-party program called "Ladarvision" kept on throwing very odd error messages internal to the program, and the tech was trained to hit RETURN. How is this Microsoft's fault?

Windows 95 is pretty stable if you use it as a single-tasking OS. I mean, there are still point-of-sale systems running DOS, and that provides just slightly less memory protection than Windows 95 does. Just don't blame the OS vendor for a shoddily-written third-party program.

It's evolved

[LichP]

The version I got reads

URGENT - Go to http://users.skynet.be/dark.angel/cool.htm

I went, but Mozilla crashed on accessing the site so I wasn't affected. Then I got a clone message, and the evil purpose rapdily became clear. Anyone peaked at this to see if the code is essentially the same?

--
From Phil

You need to get through these people.

[mickeyreznor]

Don't say:

"I suggest you do not follow the link"

Say:

Don't click on the link unless you want your computer to be fucked.

Re:This is dumber than a mail worm

[LPetrazickis]

a flyer explaining them why they shouldn't talk to strangers in the street given to them instead What's wrong with talking to strangers? I have not ended up in a dark van as of yet.:)

Re:Not a Messenger flaw

[CaptainSuperBoy]

A default install of Windows XP has zero open ports and a firewall, too. It automatically downloads security updates, which should prevent this IE exploit from becoming widespread.

Maybe the problems you're talking about went away in Windows? For someone who is so up to date on Linux, you should learn a little about Windows before you bash it for past problems.

Re:Not a Messenger flaw

[rhavyn]

You were doing good up to here:

Microsoft software really doesn't have significantly more problems than any other software. Microsoft is simply a large target, and so many and more people spend much more time finding those holes (often for malicious purposes, sadly).

IE has the biggest marketshare, and Windows has the biggest desktop marketshare, but the reason that people attack Windows systems is it's easy. I wish people would stop kidding themselves with the market share excuse. MS software has serious design flaws which makes it very easy to exploit a flaw in the browser to extract data from the registry and mail that off to some email address. Under windows, that is easy, under Linux there are multiple different browsers, you don't know what email client might be available, there is no central place to grab system/user info and there is no easy way to automate the process. The same type of exploit is used over and over and over again, yet for every patch MS releases, someone finds a new way to write an exploit that uses the same basic method. How long, exactly, do you think it's going to take before Microsoft recognizes this and fixes the design flaws instead of releasing patches which amount to little more then sticking their finger in the crack in the dam?

Re:The Code

[inKubus]

It's funny. Most of the code for Windows looks like this. Windows is basically one big script. Everything it does, practically, is scripted. They were relying on the fact that most of the scripting is undocumented, but a simple browse to \windows\web and opening *.htt with notepad should show you how much of a problem this is. Even something as fundamental as file browsing is scripted. There will always be a way to exploit windows.

Re:Explanation of code

[thorlarholm]

As Tom pointed out, it is amusing that this is posted now as a "worm article" instead of as an "example exploit" when we originally posted our bulletin on February 8th [securityfocus.com].

What is even more amusing is how the media, including Slashdot, seem to have misunderstood the bulletin entirely. This is not a flaw in MSN Messenger, this is a flaw in Internet Explorer - called crossdomain scripting.
Using MSN Messenger for our example was - just that, an example. We could as easily have used a .NET application and thus miscredited that Microsoft product instead.

Another amusing aspect is how people tie this together with the "privacy disclosure" vulnerability found last week in MSN Messenger. These are 2 completely different things. The "privacy disclosure" gives a malicious programmer the names (and possibly email adresses) of the user and his friends.
This vulnerability allows you to hijack the users MSN Messenger - the application itself ! This is why you can send messages through it, as you can do anything with the application that a normal enduser would be able to - including, but not limited to, sending messages, emails and files and co-starting appplications on the users machine (yes, this allows you to remote control a users entire Windows machine !).

Now, that should have cleared up a few things.

With regards to the latest "superpatch", Microsoft claims that it "eliminates all known security vulnerabilities affecting Internet Explorer 5.01, 5.5 and 6.0.".

As you can see on our vulnerability highlight page [jscript.dk], this is not true.

It is still very much possible for a malicious programmer to read a users local files and execute arbitrary commands - even when you are fully patched !

Re:Not a Messenger flaw

[ConsumedByTV]

Pig headed idiot.

A couple of things:

• You have to turn on the auto update feature, its not on by default.
  
• The Universal Plug and Play (UPnP) subsystem vulnerabilities in XP [eeye.com]

As someone thats "so up to date on windows", you should learn a little about it before you start to talk about it.

Everything has problems microsoft just puts the problems into the hands of people that cannot fix it, the end user.