» Topic:  Rootkit Takes Aim at AOL

» Added by:  Michael Myser

» Date:  30.10.2005

  Security researchers have identified a rootkit being spread through AOL's popular instant messaging client and AOL chat rooms.

Bundled within the previously identified W32/Sdbot-ADD worm, the lockx.exe rootkit file is installed when users click on the file link within the IM window. Though neither the worm nor the rootkit file are new, it appears to be the worm's first foray into the AIM (AOL's Instant Messenger) network. What's more troubling is that rootkits haven't previously been spread via IM.

"This is the first instance of a rootkit coming through the IM vector," said Tyler Wells, senior director of engineering for FaceTime Communications.

"The important thing to watch here is that it's no longer single installs or links to Web sites, but adware, spyware and now rootkits (through IM)."

FaceTime discovered the additional rootkit using IM honeypots monitoring IM networks, Web sites and chat rooms for malicious content and URLs.

Ero Carrera, a researcher with F-Secure in San Jose, Calif., agreed that it's likely the first instance of rootkits happened through IM.

Foster City, Calif.-based FaceTime said in a statement Friday the rootkit could give an attacker access to and remote control of the PC and may be used to steal information or promulgate more viruses.

Attackers can automatically pass the worm along to users on the Buddy List. Additionally, the rootkit can shut down anti-virus software, alter the users' search page, run CPU usage to 100 percent and automatically download unwanted programs such as 180Solutions, Zango, MaxSearch and others.

An AOL spokeswoman said the company is working on the threat, but couldn't elaborate further.

FaceTime saw a 20-fold increase in the appearance of worms and viruses on IM clients over last year, and eWeek.com also reported last month that instant messaging systems have become an increasingly favored target for attackers, with nearly 75 new IM viruses reported in August and September.

As more and more enterprise users download IM clients, companies open themselves up to widespread attacks.

"There's been a huge use of IM on the enterprise, but IT managers are now becoming more and more aware of it," said Wells. "Their main concern is now IM security."

The use of rootkits by hackers has increased as well, and security vendors are starting to include detection and removal solutions in their offerings.

Rootkits give attackers better capacity to hide their malicious programs from anti-virus techniques, while potentially handing them complete access to hard drives and accounts, and possible remote reach into other computers on the network.

"Rootkits give the attacker the ability to hide the install on the box," said Paul Piccard, director of threat research at anti-spyware firm Webroot Software, Inc. in Boulder, Colo.

"They provide an environment to control a machine or install other software without being detected."

Because users must actively click on the file link to install it, FaceTime and other security vendors encourage enterprises to reiterate that employees not execute files from IMs, even if they come from trusted sources.

In addition, FaceTime's Wells said the company's Enterprise Edition security software and IMAuditor send test questions in response to unsolicited IMs to ensure they haven't come from a remotely controlled computer or bot network.

Source : www.eweek.com