Pipeline Worm Floods AIM With Botnet Drones 196
Several reader write about a new AIM threat
dubbed the "AIM Pipeline Worm" that uses a sophisticated network of "chained" executables to attack the end user. Security Focus has a brief note. One anonymous reader writes: "Using this method, there is no starting point for the attack — a malicious link via IM can send you to any given file, at which point the path of infection you take depends entirely on the file you start off with. The hackers can then decide which order to install malicious software, depending on their needs at the time. At a bare minimum, you will become a Botnet Zombie — if you're really lucky, you might be Trojaned, have a Rootkit installed on your PC, and be used for spam, file storage, and DOS attacks. Unlike similar attacks that have been attempted in the past, the removal of a file from the chain will not stop the attack — you will simply end up with something else installed instead, in the form of a randomly named executable dumped in your system32 folder. You'll still spam an infection link to all your contacts."
i love it... (Score:5, Funny)
the internet is a wonderful place
Re: (Score:2, Interesting)
Re: (Score:3, Funny)
Re: (Score:2, Funny)
It would have to be marketed as "Tight-fit Performance Pro" or hidden in with macho words like "Maximum Super-Shrunk Thunderbolt" or something like that!
Re: (Score:2)
Re: (Score:3, Funny)
Ah, the 36-count jumbo box... I believe the name for that sized box is "The don't-have-a-Family Pack".
Re: (Score:2)
And the lesson is... (Score:5, Insightful)
Re: (Score:3, Funny)
Which company is that? I just want to be sure to avoid working there ever.
Re: (Score:3, Informative)
Re:And the lesson is... (Score:5, Interesting)
Many, many companies block AIM at the firewall. Ask at your next interview.
There is more wrong with the above scenario than just that. Blocking AIM is usually what happens at two kinds of companies, those that somehow think it will help productivity and those who are security paranoid. At the former, the working conditions probably suck. At the latter, a competent admin will have a Jabber server that connects to AIM and filters for malware. Otherwise, technical employees are likely to bypass security by SSH tunneling their IM communications, which is a risk in and of itself.
The other thing wrong with this is paying for a propriety IM solution instead of going with a free, open, standard, interoperable, secure Jabber server. With jabber you can chat with any other Jabber server using a variety of clients on a variety of platforms. Internal communications are fully internal, running on your own server. External communications can be encrypted. Any company that pays for some other, proprietary IM server is probably run by incompetents and should be avoided.
Re: (Score:3, Informative)
Run a jabber server and filter the connections through there? GET REAL! Besides, most of these things have web based clients anyway, and admitidly I dont know exactly how this "jabber server proxy" would work but I doubt it even goes near port 80.
What I have done to combat this problem is block instant messenger with group policy,
Re: (Score:2)
We allow it here (20 people, so there's no real management issue).
It works well, we use MSN and Jabber between employees, and out to associates/clients/friends/family.
Personally, I've always been of the opinion that if an employee is spending too much time on IM, then it's time to talk to the employee, not block access for everyone.
Re: (Score:2)
Who gives a crap? If they're not working, then get rid of them because they're not working. If they're still producing an amount you're happy with, then who gives a shit if they're also talking to their girlfriend? Either way, banning IM doesn't help.
Re: (Score:2)
Re: (Score:2)
That's what I like about how I have Trillian configured. When a user IMs me, the only thing that happens on my desktop is I get a flashing notification icon in my buddy list. The IM window is hidden completely, and only shows when I click that notification icon. We use
Re: (Score:3, Insightful)
-K
Re: (Score:3, Funny)
Re: (Score:2)
Most companies are just blocking the port.
Hint: You can change what port AIM uses.
Re: (Score:3, Insightful)
Many, many companies block AIM at the firewall.
Should that not be "Many, many companies think they block AIM at the firewall."
Nuff said if your security people think they have it all plugged it all up.
Re:And the lesson is... (Score:4, Interesting)
Don't worry. I'm sure everyone there has installed AIM on their computers without letting the IT department know.
Re: (Score:2)
Re: (Score:2)
Well damn. I wonder if Intel, Motorola, Cisco, Vodafone, or MCI will ever get "actual" IT departments, as they all currently allow employees to IM to people outside the company, through their firewalls.
Re: (Score:2)
Re: (Score:3, Insightful)
Then they took a look at that cost and found that it is actually less than what they get back from increased productivity that their employees get by IMing their friends/family from work, instead of simply emailing or using a phone.
Actually I know some of the security guys at one of those companies and I can make a good guess as to how the decision was made. It was probably at a much higher level. "Well should we try to lock down each application on every desktop and have everyone trying to cram everythi
Re: (Score:3, Insightful)
A few requests out to a website for a picture would hardly be considered an anomaly. I'm pretty sure our corporate proxy sees a few dozen requests to
Depending upon whether or not their is a signature, it will be listed by worm name or as an unknown worm.
If there is no signature, how would it be listed as worm at all? Are you talking signature based on an IPS? Becau
Re: (Score:2)
And the lesson is, don't use omnipod, use jabber (Score:5, Insightful)
Re:And the lesson is, don't use omnipod, use jabbe (Score:2)
Oh, and yes, AIM (and YIM, MSN, ICQ and IRC) is blocked at the firewall. Most IM clients are also prevented from being installed by AD pol
Re: (Score:2, Insightful)
I guess that's against corporate policy, too, then, since it's quite possible to block file transfers while still allowing people to socialize.
But then, it's so much easier to use "security" as an excuse to clamp down on imagined "productivity threats".
Re: (Score:3, Interesting)
Funny, I thought that when I was sitting at my desk, I was at work. What I'm actually doing at my desk has nothing to do with whether or not I am at work.
Oh, and by the way, open your eyes and read this:
What's Next: Stupid Productivity Tricks [inc.com]
You say you don't care if people walk around for a bit? Eat your words:
"recreational Web surfing has become a kind of mental floss for workers who spend their days sucking in a stream of work-related data that now comes in at a
Re: (Score:2)
Re:And the lesson is, don't use omnipod, use jabbe (Score:5, Interesting)
ur users do actually get alot of latitude with thier machines (programming shop, they have to have it) but there are certain things we do not allow. Public IM networks are one of them.
Having worked at a number of programming shops, that doesn't sound like a lot of latitude to me. If you can't install arbitrary software because of an AD policy and you audit people's machines it sounds like a very authoritarian place that does not trust the workers very much. Here we get a choice of computer brand (1 of 3), laptop or tower, any OS we want, and any software we feel like. We're also responsible for keeping our machines moderately secure. We have internal IRC servers and any IM we want is fine. Shop talk is encrypted by policy, either over Jabber or on top of a public network like AIM.
I think it is pretty darn useful. I have a lot of friends and colleagues on both of the aforementioned IM networks who I regularly consult and vice versus. This provides me with an additional resource as well as makes for a more relaxed atmosphere, like when I want to see if my girlfriend wants to meet me for lunch, or just want to chat with old college buddies. I think the fact that my company trusts me is a lot more valuable than tight security policies. Most serious compromises come from within. Because they trust me I'm happier and I'm also a lot less likely to sell them out. Contrary to what you may have heard, studies show the most effective motivation for not exploiting an employer is not fear of punishment or being fired or jail, but an ethical desire to not hurt those who trust you. If your company does not trust you (audits, arbitrary restrictions) then that motivation is removed.
Re: (Score:2)
No the real lesson here is don't use that half-assed excuse for an operating system for anything more than playing video games.
I am sorry if I don't yawn (Score:5, Insightful)
The method used after that sound interresting, but nothing beat "trusting" executable being sent by any source, anonym or not , on email or AIM. Do that and SOONER or later your day will turn bad.
Re: (Score:2)
But WHICH keyboard and chair? (Score:3, Insightful)
Yes, at some developer's desk.
Some brilliant programmer asked: What if the user of my messenger application, clicks on something? And his answer was: well, if it's a URL, download the file. [Ok, so far, so good. A little risky, but not totally stupid at first glance.]
Then the followup question was: what if the file turns out to be an executable program? And his answer was: execute it, of course! Oh, and with the same privileg
Re: (Score:2)
If that's it, it's indeed completely braindead and whoever wrote it should be taken out and shot.
OTOH, it has been shown time and time again that most IM users are more than willing to download EatMyC0mpu7eR.exe and click on it all by themselves...
Re:I am sorry if I don't yawn (Score:4, Funny)
Sounds perfectly sane to me.
Re: (Score:2)
Yeah this is an old trick, there've been file.txt.exe files with a notepad icon for a while now.
What I do is always force file extensions on (except for shortcuts) and I sort/group by file type, so if I download an image/text file and it doesn't get stuck in the image/text file group, I know something's up.
Re: (Score:2)
Of course with Mac OS X you need to convince the user to set the execute bit to run the 'picture.jpeg' file: not trivial for a typical OSX user.
Re: (Score:2)
Re: (Score:2)
I guess you must mean OS/2, because Windows sure as hell doesn't do this.
Simple risk mitigation (Score:3, Informative)
2- Back up your profile regularly.
If you ever get bitten by something like this, it's easy to recover from.
Re: (Score:2)
Re:Simple risk mitigation (Score:4, Funny)
Re: (Score:2)
In my case, there is one system that runs windows (the main "family" computer). After the last couple of infections (even with no one logging in as administrator), I've found a way to nip it at the source.
The two major malware infection routes were AIM and Web (they don't do much email on that machine). So, I've got Wine set up on my Linux server with AIM and IE. Windows box has the appropriate icons linked to a Cygwin script that launche
Re: (Score:2)
I'm not sure why you went to all that trouble... I just switched our family computer to Ubuntu and loaded chat tools etc. They are fine with it as the icons are there for all the tools
Re: (Score:3, Interesting)
The kids will often need to use MyJal to download ringtones
Re: (Score:2)
VMWare gives you the option to not save across sessions, this ensures any changes made are lost. (You can save across sessions if you want to, but for security you may chose otherwise). It ensures each and every time your family use the machine, it is stable, virus free and
Re: (Score:2)
The shortcut icon then calls this script (r-aim.sh) via the cygwin "run" command (see the example shortcuts
Re: (Score:2)
At least part of the fault is MS' (Score:2)
For example, you take an executable ("TROJAN.COM") and rename it ("FUNNY.JPG") and for reasons that have never been clear to me, the brainiacs at Microsoft designed their OS so that it will execute the latter file when you double-click on it. This seems pretty retardate; clicking on a file shouldn't imply "open or execute," it either means "open," or it means "ex
Re: (Score:2)
Re: (Score:2)
Because to most people, file extensions are meaningless gibberish at best and confusing computer stuff at worst.
Re: (Score:3, Insightful)
(3) Linux doesn't allow non-root users to install shit in vital system folders and be run at startup.
Re: (Score:2)
Re: (Score:2)
Neither does Windows.
Re:Simple risk mitigation (Score:4, Insightful)
Now if we are talking about a work enviornment then sure, give everyone in the building (except engineering) non-admin accounts, but I would never recommend doing it to someone who didn't have a high level of computer knowledge and patience or an equivalant IT staff on hand to help out with any issues.
Re: (Score:2)
Software that requires an admin account is soooooooooo 1995. it should be considered obsolete.
When its supplier does not want to fix it, he deserves to go out of business.
Re: (Score:2)
Learn some basic sysadmin skills and you don't have to worry about programs not running more than once.
The sad thing is, on the world's most popular operating system people have to learn obscure methods that the average user will not comprehend or bother with in order to just run programs. Worse yet, on a consumer desktop where most people want to run executables they don't trust, there is no way to easily run them in an untrusted mode that does not give them default access to the entire user account. It
Re: (Score:2)
Re: (Score:3, Insightful)
you right-click an executable and choose 'run as...' then the default option is to run it in an untrusted mode without giving it access to your files and settings.
The problem is, to do this you have to have set up a different user account and it has access to all of those files and settings. This is broken conceptually, and in practice for the average user does not create a second account and because the average user does not want a second account, they want run programs without letting them mess anythi
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
No, this is because computers are fundamentally devices that do what you tell them to do, not what you want them to do.
A computer does not know what you mean by "don't do anything bad" unless you actually tell it what "bad" equates to.
Re: (Score:2)
I know that, but:
1 - I consider those programs broken, and so does Microsoft
2 - I think the end-user should not be bothered by this, but the programmer should fix it or find a more adequate occupation.
Re: (Score:2)
My experiance is that if a Windows application dies due to permission
Re: (Score:2)
Solutions (Score:4, Informative)
Within the reach of an expert, RegMon and FileMon can point you to the isolated places where changing ACLs will allow the stupid program to run. The most frequent bug is for a program to try to write to one or a few protected locations.
Re: (Score:2)
The rest of my family have happily used it for well over 2 years. No incident, no malware crap on their pc. Basically their pc run as new (no windows rotting) and they almost never need any support.
It is true that several years ago it was a real nightmare to setup. Especially with all the program designed for Win95. But after the
Re: (Score:3, Informative)
Yep, do it all the time. Even taught the wife how to do it. See http://blogs.msdn.com/aaron_margosis/archive/2005/ 03/11/394244.aspx [msdn.com] for details, but the basic idea is to run a batch file when you want to be an admin. The batch file gives you admin privileges, starts a process (usually iexplore.exe file:///c:/ , which gives you a
Re: (Score:2)
Yes. For about ten years now.
Some programs don't even run unless you are administrator.
Which is why you have "Run As".
Now if we are talking about a work enviornment then sure, give everyone in the building (except engineering) non-admin accounts, but I would never recommend doing it to someone who didn't have a high level of computer knowledge and patience or an equivalant IT staff on hand to help out with any issues.
True to
Re: (Score:2)
2. Its not hard to infect backups
Good thing it's AIM ... (Score:3, Funny)
Now I have more reason than ever to install trillian/gaim on newb computers.
Re: (Score:3, Funny)
Re: (Score:2, Interesting)
Re: (Score:2)
Re:Good thing it's AIM ... (Score:5, Informative)
www.dodgywebsite.com/really_interesting_picture.j
Note that the last part of the URL was ".com"
You gotta watch yourself
Re: (Score:3, Informative)
Re: (Score:2)
Yeah man, check this one out:
http://images.slashdot.org/slashdotlg.gif?picture. jpg_/session_ID=2383/www.dodgywebsite.com [slashdot.org]
Crazy stuff. Don't click it!
Not to Worry (Score:5, Funny)
Re: (Score:3, Funny)
Senator Ted Stevens responds:
Yes, but you see, the tubes are connected to pipes, and those pipes are connected to larger pipes, and then there are canals, and dams and reservoirs, and other things that are even more complex and convoluted. So you can see by my use of the words "complex" and "convoluted", that it's all terribly complicated. But you are right about one thing: thank God it's not a t
Why this is important. (Score:2)
And if you don't guess who they'll call first about how their computer has gotten SLOW again.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
After the second rebuild in 6 months, I put Ubuntu on my kids computer. End of problem. The kids like the uptime.
using aim (Score:2, Funny)
Tubes Dammit! (Score:2)
And the definition of Tubeworm [wikipedia.org] probably needs to be rewritten.
I love these kinds of attacks (Score:2, Funny)
Re: (Score:3, Funny)
fuckers stole my system32 folder (Score:3, Funny)
uuddlrlrba (Score:2)
Now all we need is a nice graphical interface and a joystick control system, and the fun can really begin
OS specific then (Score:2)
What if you don't run DOS (or any derivatives)?
Ha ha, it's a joke. I set up a linux box for my sisters kids to use, and kept an eye on the logs. One of the first things they tried to install was AIM. Ooops, too bad. Some kind ***soul was even trying to help them to do it while chatting though GAIM. Which is kind of funny
This rings a bell (Score:3, Informative)
From the article: What's smart about this attack is that it doesn't matter if you get a file "out of step" - if you start off with a particular file out of sequence, you'll just end up somewhere else in the chain instead. There is no right or wrong place to start with this one - the hackers will make sure you get your fill of infection files!
The basic idea of using multiple, completely unrelated vulnerabilities and attacks to achieve total control is not exactly that new. In fact, the ideas that feel so obvious to us today were quite novel back in the turn of the century. Michael Zalewski described [coredump.cx] a worm prototype that worked in somewhat similar manner more than six years ago.
On the occasions that I get to give lectures about computer security, I try to illustrate these very ideas. The rule #1: There are no local exploits; All vulnerabilities are remote, some may just require a piggy-bag step of first delivering extra code via other holes.
Didn't pass the filter (Score:2)
Wake up please! (Score:2)
http://lists.freedesktop.org/archives/xdg/2006-Apr il/008025.html [freedesktop.org]
http://lwn.net/Articles/178411/ [lwn.net]
http://lwn.net/Articles/178409/ [lwn.net]
Re: (Score:2)
Re: (Score:2)