Never Miss a Beat: Get a snapshot of the issues affecting the IT industry straight to your inbox.
May 2, 2006
2 Min Read
Security companies alerted users Tuesday of a worm that spreads via instant messaging, plants a bot on hijacked PCs, and poses a special challenge to researchers hoping to trace the bot back to its controller.
Dubbed "Nagache.a" by the likes of McAfee and Symantec, the worm propagates through AIM (America Online Instant Messaging) and MSN Messenger, as well as via e-mail and network shares. It will also install in a drive-by download -- a secret installation invisible to the user -- if the PC isn't patched against a pair of 2004 vulnerabilities in Windows.
However, unlike most bots, which are run by their herders through IRC, this bot is controlled via a peer-to-peer network that includes the infected machines. The traffic between the compromised computers and the herder is also encrypted, or at least not readable, said an analyst with the Internet Storm Center.
Other advisories said that the bot had raised the malware bar.
"The command and control channel that is used is unique, as the bot appears to connect to infected peers instead of a static list," said San Diego, Calif.-based Websense in its online alert. "A peer-to-peer command and control channel makes it more difficult to block commands issued to the bot…[and]the traffic over this channel uses obfuscation in an attempt to bypass intrusion detection systems."
Although AOL has blocked several of the IP addresses hard-coded in the worm to prevent the ensuing bot from communicating with its herder, "numerous other peers have been identified" the Internet Storm Center said in an update Tuesday. "It no longer makes sense to post a list of IPs. The best defense would to be to monitor activity in your flows for tcp/8, update anti-virus, and/or use the Snort signature to detect this activity."
You May Also Like
The Total Economic Impact™ Of Fortinet NGFW For Data Center And AI-Powered FortiGuard Security Services Solution Study
Edge Computing Bridges IT and OT People, Process, and Technology
*State of ITSM in Retail
Solution Brief: Fortinet FortiFlex Delivers Usage-Based Security Licensing That Moves at the Speed of Digital Accelerationâ€‹
Checklist: Top 6 Considerations to Optimize Your Digital Acceleration Security Spend