Biting the hand that feeds IT
Biting the hand that feeds IT
|
|
Original URL: http://www.theregister.co.uk/2006/09/21/pipeline_worm/
A new worm spreading over AOL Instant Messenger seeks to built a botnet of zombie Windows PCs. The Pipeline worm packs an executable file disguised as a JPEG, which if executed, tries to download other strains of malware rootkits and Trojans. Pipeline uses the AIM Buddy List on infected computers to target other prospective marks.
Like many instant messaging worms, Pipeline appears as an instant message from a familiar contact, luring users into visiting malware-infested websites. The IM message “hey would it okay if i upload this picture of you to my blog?” downloads a hostile file called image18.com, disguised as a JPEG. Running the file results in infection.
Once compromised, infected PCs join a botnet under the control of hackers, who may use it for malign purposes include relaying spam, performing distributed denial-of-service (DDoS) attacks or committing click fraud. Hackers can also gain access to personal data stored on infected PCs.
The botnet established by Pipeline is sophisticated, according to researchers with IM security firm FaceTime. Features include the ability to authorise only specific IRC clients to log in and manipulate the botnet. The Pipeline worm is different from most previous IM worms because it features multiple waves of attack.
Chris Boyd, director of malware research for FaceTime Security Labs, said: "Previous IM attacks have tended to focus on the damage done by the files, with little thought on the method of delivery, save for the quickest way to get those files onto a PC. Here, the motivation for the bad guys seems to be in lining up as many 'install chains' as possible to insure a consistent pipeline that can be controlled by their rogue botnet." ®
Homer Simpson's email address hacked (14 July 2008)
http://www.theregister.co.uk/2008/07/14/homer_simpson_botnet_hack/
Polyglot worm spreads over MSN (23 January 2008)
http://www.channelregister.co.uk/2008/01/23/polyglot_msn_worm/
AOL spammer gets two years in the slammer (4 November 2007)
http://www.theregister.co.uk/2007/11/04/aol_spammer_sentencing/
FBI logs its millionth zombie address (13 June 2007)
http://www.theregister.co.uk/2007/06/13/millionth_botnet_address/
Users attacked by mysterious AIM buddies (12 June 2007)
http://www.theregister.co.uk/2007/06/12/aim_buddy_attack/
AOL debuts AIM location finder (20 March 2007)
http://www.theregister.co.uk/2007/03/20/aim_location_plug-in/
Anatomy sheds new light on Storm Worm (9 February 2007)
http://www.theregister.co.uk/2007/02/09/storm_worm_anatomy/
Dutch botnet duo sentenced (1 February 2007)
http://www.theregister.co.uk/2007/02/01/dutch_botnet_gang_sentenced/
US tops spam relaying and malware leagues of shame (22 January 2007)
http://www.theregister.co.uk/2007/01/22/malware_spam_report_sophos/
Organised crime fails to stop skiddies (20 October 2006)
http://www.theregister.co.uk/2006/10/20/disorg_web_crime/
Securities trading desks adopt IM (24 May 2006)
http://www.theregister.co.uk/2006/05/24/im_for_securities_traders/
IM worm installs rogue browser (22 May 2006)
http://www.theregister.co.uk/2006/05/22/safety_browser_im_worm/
Bot software looks to improve peerage (4 May 2006)
http://www.theregister.co.uk/2006/05/04/nugache_p2p_botnet/
Hackers control bot client over P2P (2 May 2006)
http://www.theregister.co.uk/2006/05/02/nugache_worm/
Hackers download pirate movies onto compromised PCs (21 December 2005)
http://www.channelregister.co.uk/2005/12/21/bittorrent_botnet_attack/
AOL IM worm roots around Windows PCs (31 October 2005)
http://www.theregister.co.uk/2005/10/31/aol_im_rootkit_worm/
© Copyright 2008
