Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×

Pipeline Worm Floods AIM With Botnet Drones 196

Posted by kdawson from the now-that's-a-worm dept.
Several reader write about a new AIM threat dubbed the "AIM Pipeline Worm" that uses a sophisticated network of "chained" executables to attack the end user. Security Focus has a brief note. One anonymous reader writes: "Using this method, there is no starting point for the attack — a malicious link via IM can send you to any given file, at which point the path of infection you take depends entirely on the file you start off with. The hackers can then decide which order to install malicious software, depending on their needs at the time. At a bare minimum, you will become a Botnet Zombie — if you're really lucky, you might be Trojaned, have a Rootkit installed on your PC, and be used for spam, file storage, and DOS attacks. Unlike similar attacks that have been attempted in the past, the removal of a file from the chain will not stop the attack — you will simply end up with something else installed instead, in the form of a randomly named executable dumped in your system32 folder. You'll still spam an infection link to all your contacts."
This discussion has been archived. No new comments can be posted.

Pipeline Worm Floods AIM With Botnet Drones More

Pipeline Worm Floods AIM With Botnet Drones

Comments Filter:

  • i love it... (Score:5, Funny)

    by 0110011001110101 ( 881374 ) on Monday September 18, 2006 @04:01PM (#16133050) Journal
    when I get free trojans... it's so embarassing to buy them in the store...

    the internet is a wonderful place

  • And the lesson is... (Score:5, Insightful)

    by d3ac0n ( 715594 ) on Monday September 18, 2006 @04:05PM (#16133080)
    Don't use IM software unless it's part of a closed, managed network. For example: www.omnipod.com is what we use for inter-office IM here. It's a closed network, and all files sent are automatically virus scanned before they can be received. Safe and effective, and keeps our employees from IM-ing with people outside the company.

    • Re: (Score:3, Funny)

      by OECD ( 639690 )

      ... and keeps our employees from IM-ing with people outside the company.

      Which company is that? I just want to be sure to avoid working there ever.

      • Re: (Score:3, Informative)

        by $RANDOMLUSER ( 804576 )
        Many, many companies block AIM at the firewall. Ask at your next interview.

        • Re:And the lesson is... (Score:5, Interesting)

          by 99BottlesOfBeerInMyF ( 813746 ) on Monday September 18, 2006 @04:33PM (#16133334)

          Many, many companies block AIM at the firewall. Ask at your next interview.

          There is more wrong with the above scenario than just that. Blocking AIM is usually what happens at two kinds of companies, those that somehow think it will help productivity and those who are security paranoid. At the former, the working conditions probably suck. At the latter, a competent admin will have a Jabber server that connects to AIM and filters for malware. Otherwise, technical employees are likely to bypass security by SSH tunneling their IM communications, which is a risk in and of itself.

          The other thing wrong with this is paying for a propriety IM solution instead of going with a free, open, standard, interoperable, secure Jabber server. With jabber you can chat with any other Jabber server using a variety of clients on a variety of platforms. Internal communications are fully internal, running on your own server. External communications can be encrypted. Any company that pays for some other, proprietary IM server is probably run by incompetents and should be avoided.

          • Re: (Score:3, Informative)

            by crabpeople ( 720852 )
            No offense but are you nuts? People should be able to IM at work? Yeah we used to have that here. Then they made me disable all messengers because people chat on them all day long.

            Run a jabber server and filter the connections through there? GET REAL! Besides, most of these things have web based clients anyway, and admitidly I dont know exactly how this "jabber server proxy" would work but I doubt it even goes near port 80.

            What I have done to combat this problem is block instant messenger with group policy,

            • Re: (Score:2)

              by mibus ( 26291 )
              People should be able to IM at work?

              We allow it here (20 people, so there's no real management issue).

              It works well, we use MSN and Jabber between employees, and out to associates/clients/friends/family.

              Personally, I've always been of the opinion that if an employee is spending too much time on IM, then it's time to talk to the employee, not block access for everyone.

            • Re: (Score:2)

              by G-funk ( 22712 )
              Then they made me disable all messengers because people chat on them all day long.

              Who gives a crap? If they're not working, then get rid of them because they're not working. If they're still producing an amount you're happy with, then who gives a shit if they're also talking to their girlfriend? Either way, banning IM doesn't help.
            • If people have enough time to be chatting all day long, then they are not being well managed. We use IM as a working tool, with some success. My team has lots of projects abroad, there are always 2 or 3 co-workers in foreign countries, working. And IM is a lot cheaper than international phone calls. I have my Gaim clients disconnected most of the time because, even when I'm flagged as "busy", friends of mine come at inappropriate times for some cheap talk, and I have to be kinda rude rude and tell them: I

              • I have my Gaim clients disconnected most of the time because, even when I'm flagged as "busy", friends of mine come at inappropriate times for some cheap talk, and I have to be kinda rude rude and tell them: I'M WORKING! WE'LL TALK LATER!

                That's what I like about how I have Trillian configured. When a user IMs me, the only thing that happens on my desktop is I get a flashing notification icon in my buddy list. The IM window is hidden completely, and only shows when I click that notification icon. We use

          • Re: (Score:3, Insightful)

            by ktappe ( 747125 )
            Blocking AIM is usually what happens at two kinds of companies, those that somehow think it will help productivity and those who are security paranoid.
            You have one of my employer's credit cards in your wallet. Tell me again that we are "paranoid" to block IM...or would you be happy with the possibility of your personal account information being sent out via chat?

            -K

        • Many, many companies block AIM at the firewall.
          Are they blocking AIM or are they blocking port 5190?

          Most companies are just blocking the port.
          Hint: You can change what port AIM uses.

        • Re: (Score:3, Insightful)

          by canuck57 ( 662392 )

          Many, many companies block AIM at the firewall.

          Should that not be "Many, many companies think they block AIM at the firewall."

          Nuff said if your security people think they have it all plugged it all up.

      • Re:And the lesson is... (Score:4, Interesting)

        by Daniel_Staal ( 609844 ) <DStaal@usa.net> on Monday September 18, 2006 @04:20PM (#16133214)
        Which company is that? I just want to be sure to avoid working there ever.

        Don't worry. I'm sure everyone there has installed AIM on their computers without letting the IT department know.

      • Any company with an actual IT department. RTFA for an extremely good reason.

        • Re: (Score:2)

          by pluther ( 647209 )
          Any company with an actual IT department.

          Well damn. I wonder if Intel, Motorola, Cisco, Vodafone, or MCI will ever get "actual" IT departments, as they all currently allow employees to IM to people outside the company, through their firewalls.

          • Congrats, you've listed 5 companies who have assessed the risk of their entire network going down, taking the time to clean everyone's computers, make for goddamnedsure that everyone has every update available, etc etc, or they've paid a whole lot to ensure everything is going to be properly blocked (not 100% possible). Then they took a look at that cost and found that it is actually less than what they get back from increased productivity that their employees get by IMing their friends/family from work, i

            • Re: (Score:3, Insightful)

              by 99BottlesOfBeerInMyF ( 813746 )

              Then they took a look at that cost and found that it is actually less than what they get back from increased productivity that their employees get by IMing their friends/family from work, instead of simply emailing or using a phone.

              Actually I know some of the security guys at one of those companies and I can make a good guess as to how the decision was made. It was probably at a much higher level. "Well should we try to lock down each application on every desktop and have everyone trying to cram everythi

              • Re: (Score:3, Insightful)

                by toleraen ( 831634 )
                They see the propagation behavior as a traffic anomaly on their control panel.
                A few requests out to a website for a picture would hardly be considered an anomaly. I'm pretty sure our corporate proxy sees a few dozen requests to /. every minute. I'm sure CNN is much higher than that.

                Depending upon whether or not their is a signature, it will be listed by worm name or as an unknown worm.
                If there is no signature, how would it be listed as worm at all? Are you talking signature based on an IPS? Becau

          • Re: (Score:2)

            by plopez ( 54068 )
            size is no indicator of quality.

    • And the lesson is, don't use omnipod, use jabber (Score:5, Insightful)

      by spun ( 1352 ) <loverevolutionary&yahoo,com> on Monday September 18, 2006 @04:17PM (#16133188) Journal
      It's free and open source. It's scaleable. It's easy to install and manage. It runs entirely on your own infrastructure so your messages aren't vulnerable to prying eyes and bored sysadmins of some other company. You can set it up to interoperate with any other IM system if you want to. There's a ton of open source clients available. Safe and effective, and keeps people from spending money on crap "solutions" that aren't.
      • Actually, jabber was one of the options I explored. We didn't go with it because omnipod was already in use by one of our larger branches, and it was simpler to just extend the use of the product. No servers to setup, no additional hardware needed, and low licensing costs. Omnipod worked great for us. For others it might not work so great, but it was our best option.

        Oh, and yes, AIM (and YIM, MSN, ICQ and IRC) is blocked at the firewall. Most IM clients are also prevented from being installed by AD pol

        • Re: (Score:2, Insightful)

          by Buran ( 150348 )
          Apparently you don't allow people to have social lives. Apparently, you think all your workers need to be mindless drones while at work. Guess what -- people work better when they can let their minds wander a bit when they need to during the day.

          I guess that's against corporate policy, too, then, since it's quite possible to block file transfers while still allowing people to socialize.

          But then, it's so much easier to use "security" as an excuse to clamp down on imagined "productivity threats".

        • Re: (Score:2)

          by spun ( 1352 )
          Well, in your case it makes sense to use omnipod, if a large part of your company is already using it. I guess it would also make sense for firms that don't have the time, inclination, or technical know-how to do it themselves. I'm not that much of an open-source zealot that I can't see there is a place for other solutions. I just finished setting up jabber where I work, so I'm kinda on a jabber kick is all. Instant messaging is really a great thing for business. Many time people have a really quick questio

        • Re:And the lesson is, don't use omnipod, use jabbe (Score:5, Interesting)

          by 99BottlesOfBeerInMyF ( 813746 ) on Monday September 18, 2006 @04:52PM (#16133503)

          ur users do actually get alot of latitude with thier machines (programming shop, they have to have it) but there are certain things we do not allow. Public IM networks are one of them.

          Having worked at a number of programming shops, that doesn't sound like a lot of latitude to me. If you can't install arbitrary software because of an AD policy and you audit people's machines it sounds like a very authoritarian place that does not trust the workers very much. Here we get a choice of computer brand (1 of 3), laptop or tower, any OS we want, and any software we feel like. We're also responsible for keeping our machines moderately secure. We have internal IRC servers and any IM we want is fine. Shop talk is encrypted by policy, either over Jabber or on top of a public network like AIM.

          I think it is pretty darn useful. I have a lot of friends and colleagues on both of the aforementioned IM networks who I regularly consult and vice versus. This provides me with an additional resource as well as makes for a more relaxed atmosphere, like when I want to see if my girlfriend wants to meet me for lunch, or just want to chat with old college buddies. I think the fact that my company trusts me is a lot more valuable than tight security policies. Most serious compromises come from within. Because they trust me I'm happier and I'm also a lot less likely to sell them out. Contrary to what you may have heard, studies show the most effective motivation for not exploiting an employer is not fear of punishment or being fired or jail, but an ethical desire to not hurt those who trust you. If your company does not trust you (audits, arbitrary restrictions) then that motivation is removed.

    • Re: (Score:2)

      by tb3 ( 313150 )
      Oh, random executable installed in your system32 folder, you say?

      No the real lesson here is don't use that half-assed excuse for an operating system for anything more than playing video games.

  • I am sorry if I don't yawn (Score:5, Insightful)

    by aepervius ( 535155 ) on Monday September 18, 2006 @04:05PM (#16133081)
    QUOTE (emphasis mine): How does this infection start off? As always, it begins with a seemingly innocent web address passed to you via Instant Messaging. Click the link and allow the file to execute and your day will quickly go bad."

    The method used after that sound interresting, but nothing beat "trusting" executable being sent by any source, anonym or not , on email or AIM. Do that and SOONER or later your day will turn bad.

    • Seems to me that the main problem is between the keyboard and the chair.

      • Seems to me that the main problem is between the keyboard and the chair.

        Yes, at some developer's desk.

        Some brilliant programmer asked: What if the user of my messenger application, clicks on something? And his answer was: well, if it's a URL, download the file. [Ok, so far, so good. A little risky, but not totally stupid at first glance.]

        Then the followup question was: what if the file turns out to be an executable program? And his answer was: execute it, of course! Oh, and with the same privileg

        • Re: (Score:2)

          by Fred_A ( 10934 )
          For the (apparently) few of us that haven't ever used AIM, are you saying that like the email clients of old, the IM client automagically executes any program it downloads ?

          If that's it, it's indeed completely braindead and whoever wrote it should be taken out and shot.

          OTOH, it has been shown time and time again that most IM users are more than willing to download EatMyC0mpu7eR.exe and click on it all by themselves...

    • Re:I am sorry if I don't yawn (Score:4, Funny)

      by $RANDOMLUSER ( 804576 ) on Monday September 18, 2006 @04:15PM (#16133169)
      ...downloads the image18.com file (disguised as a jpeg). Running the file...
      User clicks on .JPG file. Operating system (no names, please) looks at file, says "Oh, that's really an .EXE file, I'll just execute it without asking...".
      Sounds perfectly sane to me.

      • Yeah this is an old trick, there've been file.txt.exe files with a notepad icon for a while now.

        What I do is always force file extensions on (except for shortcuts) and I sort/group by file type, so if I download an image/text file and it doesn't get stuck in the image/text file group, I know something's up.

      • MacOS 7+ used to do that, but it was a bitch to send a resource fork properly over the Internet (though possible).

        Of course with Mac OS X you need to convince the user to set the execute bit to run the 'picture.jpeg' file: not trivial for a typical OSX user.
      • XP provides methods to mark a file as coming from an untrusted source. Ever tried to run an executable downloaded through IE? You get a warning dialog. It's the AIM client's fault for not noting the source of the file in the alternate stream used for security info.

      • Re: (Score:2)

        by drsmithy ( 35869 )
        User clicks on .JPG file. Operating system (no names, please) looks at file, says "Oh, that's really an .EXE file, I'll just execute it without asking...".

        I guess you must mean OS/2, because Windows sure as hell doesn't do this.

  • Simple risk mitigation (Score:3, Informative)

    by LinuxIsRetarded ( 995083 ) on Monday September 18, 2006 @04:05PM (#16133082) Homepage
    1- Don't run as an administrator.
    2- Back up your profile regularly.

    If you ever get bitten by something like this, it's easy to recover from.
    • Try explain that in terms that the average user will be able to understand.

      • Re:Simple risk mitigation (Score:4, Funny)

        by russ1337 ( 938915 ) on Monday September 18, 2006 @04:12PM (#16133134)
        Try explain that in terms that the average user will be able to understand.
        CLICK HERE [ubuntu.com]
        • Not always an option, if you want to keep your wife and kids happy.
          In my case, there is one system that runs windows (the main "family" computer). After the last couple of infections (even with no one logging in as administrator), I've found a way to nip it at the source.
          The two major malware infection routes were AIM and Web (they don't do much email on that machine). So, I've got Wine set up on my Linux server with AIM and IE. Windows box has the appropriate icons linked to a Cygwin script that launche

          • [Ubuntu is] Not always an option, if you want to keep your wife and kids happy..... I've got Wine set up on my Linux server with AIM and IE. Windows box has the appropriate icons linked to a Cygwin script that launches a local X server rootless (if it isn't already running), then remotely executes AIM or IE from my server.

            I'm not sure why you went to all that trouble... I just switched our family computer to Ubuntu and loaded chat tools etc. They are fine with it as the icons are there for all the tools

            • Re: (Score:3, Interesting)

              by tchuladdiass ( 174342 )
              Simple fact is that the family uses lots of windows-only programs. The wife will come home from an accounting class, and needs to download excel spreadsheets from the college web site (which is IE centric, and has little annoyances under Firefox), these spreadsheets will then need to be used under Excel, because last time I had her use it under Openoffice something didn't quiet work right and caused probems when she sent it back to her instructor.
              The kids will often need to use MyJal to download ringtones
              • Further to my last post, have you considered using Ubuntu on your family machine and running your essential Windows aps in a Windows OS under VMWare? This provides all the security of the Linux machine (host), with a VM running Windows.

                VMWare gives you the option to not save across sessions, this ensures any changes made are lost. (You can save across sessions if you want to, but for security you may chose otherwise). It ensures each and every time your family use the machine, it is stable, virus free and
        • noooooo! don't run it, it's the Slashdot Pipeline Virus!

    • Re:Simple risk mitigation (Score:4, Insightful)

      by (54)T-Dub ( 642521 ) <tpaine.gmail@com> on Monday September 18, 2006 @04:12PM (#16133138) Journal
      1- Don't run as an administrator.
      Have you ever done this on a windows machine for an extended period of time? I did it for about a week before I gave up. Some programs don't even run unless you are administrator.

      Now if we are talking about a work enviornment then sure, give everyone in the building (except engineering) non-admin accounts, but I would never recommend doing it to someone who didn't have a high level of computer knowledge and patience or an equivalant IT staff on hand to help out with any issues.

      • Re: (Score:2)

        by pe1chl ( 90186 )
        Easy: use this method. when a given piece of software does not run, complain at its supplier. ask your money back. remove it from the system. spread the word far and wide.

        Software that requires an admin account is soooooooooo 1995. it should be considered obsolete.
        When its supplier does not want to fix it, he deserves to go out of business.

      • Re: (Score:2)

        by Kaenneth ( 82978 )
        Running an application that requires you to run as Admin for no good reason is like buying a wallet with a chip that voice announces at random intervals how much cash you have on you.

      • Solutions (Score:4, Informative)

        by Beryllium Sphere(tm) ( 193358 ) on Monday September 18, 2006 @04:59PM (#16133569) Journal
        Within the reach of a normal person, shift-right-click and Run As... will get you temporary and per-process administrator privileges without the insanity of running Internet Explorer as root.

        Within the reach of an expert, RegMon and FileMon can point you to the isolated places where changing ACLs will allow the stupid program to run. The most frequent bug is for a program to try to write to one or a few protected locations.

      • Re: (Score:2)

        by gutnor ( 872759 )
        OK I have been running in non-admin account for over 5 years ( at home since Win2000 with its magic RunAs command ( I know this is sad to think of a su-like command as magic :-) ) )
        The rest of my family have happily used it for well over 2 years. No incident, no malware crap on their pc. Basically their pc run as new (no windows rotting) and they almost never need any support.

        It is true that several years ago it was a real nightmare to setup. Especially with all the program designed for Win95. But after the

      • Re: (Score:3, Informative)

        by Software ( 179033 )

        Have you ever done this on a windows machine for an extended period of time? I did it for about a week before I gave up. Some programs don't even run unless you are administrator.

        Yep, do it all the time. Even taught the wife how to do it. See http://blogs.msdn.com/aaron_margosis/archive/2005/ 03/11/394244.aspx [msdn.com] for details, but the basic idea is to run a batch file when you want to be an admin. The batch file gives you admin privileges, starts a process (usually iexplore.exe file:///c:/ , which gives you a

      • Re: (Score:2)

        by drsmithy ( 35869 )
        Have you ever done this on a windows machine for an extended period of time?

        Yes. For about ten years now.

        Some programs don't even run unless you are administrator.

        Which is why you have "Run As".

        Now if we are talking about a work enviornment then sure, give everyone in the building (except engineering) non-admin accounts, but I would never recommend doing it to someone who didn't have a high level of computer knowledge and patience or an equivalant IT staff on hand to help out with any issues.

        True to

    • 1. Its not hard in windows to go from user->admin if you are executing arbitrary code
      2. Its not hard to infect backups

  • Good thing it's AIM ... (Score:3, Funny)

    by (54)T-Dub ( 642521 ) <tpaine.gmail@com> on Monday September 18, 2006 @04:07PM (#16133094) Journal
    ... because it's a well known fact that most AOL users have higher than average internet savvy.

    Now I have more reason than ever to install trillian/gaim on newb computers.

    • Re: (Score:3, Funny)

      by fr175 ( 999487 )
      ... because it's a well known fact that most AOL users have higher than average internet savvy.
      Me too!

    • Re: (Score:2, Interesting)

      by fr175 ( 999487 )
      Now I have more reason than ever to install trillian/gaim on newb computers.
      AOL silliness aside, according to (my understanding of) TFA (and, yes, I am new here), this worm spreads by getting users to run a .com file which is disquised as a .jpg. The .com then infects the users System32 directory and the magic happens. Wouldn't GAIM and Trillian both be vulnerable to this, if they are running on Win machines?
      • You'd still be vulnerable, but you likely wouldn't spam the linked virus to everyone on your list using gaim/trillian. I would assume that the virus is programmed to expect AIM running, and it probably wouldn't interface with other programs. Then again, IANAP.

      • Re:Good thing it's AIM ... (Score:5, Informative)

        by russ1337 ( 938915 ) on Monday September 18, 2006 @04:38PM (#16133372)
        This worm spreads by getting users to run a .com file which is disquised as a .jpg.
        I was surfing pr0n^H^H^H^H^H the Internet the other night and mining some sites... I saw very clever(?) URL's on a couple of websites... they were along the line of:

        www.dodgywebsite.com/really_interesting_picture.jp g_/session_ID=2383/wwwdodgywebsite.com

        Note that the last part of the URL was ".com" .. not part of the website, but the suffix to the file - a COM file!!

        You gotta watch yourself

  • Not to Worry (Score:5, Funny)

    by Aqua_boy17 ( 962670 ) on Monday September 18, 2006 @04:09PM (#16133109)
    It's a Pipeline Worm. It's a good thing the internet is made up of tubes instead of pipes or we'd all be screwed!

    • Re: (Score:3, Funny)

      by revery ( 456516 )
      It's a Pipeline Worm. It's a good thing the internet is made up of tubes instead of pipes or we'd all be screwed!

      Senator Ted Stevens responds:
      Yes, but you see, the tubes are connected to pipes, and those pipes are connected to larger pipes, and then there are canals, and dams and reservoirs, and other things that are even more complex and convoluted. So you can see by my use of the words "complex" and "convoluted", that it's all terribly complicated. But you are right about one thing: thank God it's not a t
  • You probably understand how this works, but I'm sure you can think of someone in your family that you might want to call and warn about this. Maybe you've told them a thousand times about the dangers of clicking on that link, but do it again anyway. I mean, you love them, right?

    And if you don't guess who they'll call first about how their computer has gotten SLOW again.

    • Re: (Score:2)

      by fotbr ( 855184 )
      My family has figured out that I don't do tech support.
    • Maybe you've told them a thousand times about the dangers of clicking on that link, but do it again anyway. I mean, you love them, right?
      I love them a tiny bit less every time I have to do a PC rescue because "it was from someone who would never send me a virus!"
      • With friends and family who ask me for computer advice I have a new policy. When they tell me they are thinking of getting a new computer and ask for advice I always recommend a Mac Mini or Macbook. When they tell me that a dell or something is cheaper I tell them my new policy: no free support for Windows, sorry. (I'm not a mac zealot either...I don't use any macs anymore, but my wife, sister and parents do because of this policy)
    • And if you don't guess who they'll call first about how their computer has gotten SLOW again.

      After the second rebuild in 6 months, I put Ubuntu on my kids computer. End of problem. The kids like the uptime.
  • using aim is like being kicked in the balls
  • It's TUBES dammit not PIPES!!11!

    And the definition of Tubeworm [wikipedia.org] probably needs to be rewritten.

  • I'm a student employed by the university to fix students' computers in my dorm building. Everyone will click on these links, some more than once. But why do I love these attacks? The hot chicks that will inevitably click the link. I love this job.

  • fuckers stole my system32 folder (Score:3, Funny)

    by quonsar ( 61695 ) on Monday September 18, 2006 @05:48PM (#16133946) Homepage
    lessee... /, bin, boot, debootstrap, dev, etc, home, initrd, lib, media, mnt, opt, proc, root, sbin, srv, sys, tmp, usr, var - nope, it's GONE!
  • Boyd likened the technique to the fight combos common in martial arts video games.

    Now all we need is a nice graphical interface and a joystick control system, and the fun can really begin :-)

  • At a bare minimum, you will become a Botnet Zombie -- if you're really lucky, you might be Trojaned, have a Rootkit installed on your PC, and be used for spam, file storage, and DOS attacks.

    What if you don't run DOS (or any derivatives)?

    Ha ha, it's a joke. I set up a linux box for my sisters kids to use, and kept an eye on the logs. One of the first things they tried to install was AIM. Ooops, too bad. Some kind ***soul was even trying to help them to do it while chatting though GAIM. Which is kind of funny

  • This rings a bell (Score:3, Informative)

    by Bostik ( 92589 ) on Tuesday September 19, 2006 @05:38AM (#16136540)

    From the article: What's smart about this attack is that it doesn't matter if you get a file "out of step" - if you start off with a particular file out of sequence, you'll just end up somewhere else in the chain instead. There is no right or wrong place to start with this one - the hackers will make sure you get your fill of infection files!

    The basic idea of using multiple, completely unrelated vulnerabilities and attacks to achieve total control is not exactly that new. In fact, the ideas that feel so obvious to us today were quite novel back in the turn of the century. Michael Zalewski described [coredump.cx] a worm prototype that worked in somewhat similar manner more than six years ago.

    On the occasions that I get to give lectures about computer security, I try to illustrate these very ideas. The rule #1: There are no local exploits; All vulnerabilities are remote, some may just require a piggy-bag step of first delivering extra code via other holes.

  • A quick glance at the headline and stuff like this stands out: At a bare minimum, you will become a Botnet Zombie -- if you're really lucky, you might be Trojaned, have a Rootkit installed on your PC, and be used for spam, file storage, and DOS attacks. Excessive use of capitalized jargon like that always indicates that it's going to be a nothing story, and sure enough, that's exactly what it is. Although, if you think the fact that your PC can be compromised by something you download on purpose is news,

Slashdot Top Deals

Two can Live as Cheaply as One for Half as Long. -- Howard Kandel

Close