New IM Worm Operates Differently

Security companies alerted users Tuesday of a worm that spreads via instant messaging, plants a bot on hijacked PCs, and poses a special challenge to researchers hoping to trace the bot back to its controller.

Dubbed "Nagache.a" by the likes of McAfee and Symantec, the worm propagates through AIM (America Online Instant Messaging) and MSN Messenger, as well as via e-mail and network shares. It will also install in a drive-by download -- a secret installation invisible to the user -- if the PC isn't patched against a pair of 2004 vulnerabilities in Windows.

In turn, Nagache.a installs a bot -- a controlling component -- that communicates to its handler, sometimes called a "herder," on TCP port 8.

However, unlike most bots, which are run by their herders through IRC, this bot is controlled via a peer-to-peer network that includes the infected machines. The traffic between the compromised computers and the herder is also encrypted, or at least not readable, said an analyst with the Internet Storm Center.

Other advisories said that the bot had raised the malware bar.

"The command and control channel that is used is unique, as the bot appears to connect to infected peers instead of a static list," said San Diego, Calif.-based Websense in its online alert. "A peer-to-peer command and control channel makes it more difficult to block commands issued to the bot…[and]the traffic over this channel uses obfuscation in an attempt to bypass intrusion detection systems."

Although AOL has blocked several of the IP addresses hard-coded in the worm to prevent the ensuing bot from communicating with its herder, "numerous other peers have been identified" the Internet Storm Center said in an update Tuesday. "It no longer makes sense to post a list of IPs. The best defense would to be to monitor activity in your flows for tcp/8, update anti-virus, and/or use the Snort signature to detect this activity."