Bot chats on AIM actually carry worms skulking in their messages

Bot chats on AIM actually carry worms skulking in their messages

On AOL Instant Messenger “kittypink 5” may seem just another chat-mate with poor grammar and plenty of "lol", but in reality behind the chat-id lurks a bot that is gaining its victims confidence to activate malware.

And this warning comes from none other than IMLogic that is a leading security vendor for Internet Messaging sites. IMlogic on Tuesday said the worm nicknamed IM.Myspace04.AIM marks its arrival on messages with the words "lol thats cool" with a link to a file "clarissa17.pif".

Most chat users on AOL do not expect something that chats to be a worm and when they raise the possibility of it they get misled: "lol no its not its a virus". Should they be misled enough to click on the link, the file by disabling system security software and launching a backdoor takes over the system. Furthermore, it modifies system files and shows its worm-like ways messaging those on the contact list a copy of the unlikely “lol” message. Unknown to the victim his system actually is messaging the worms around and no trace of such messages are seen.

IMlogic's director of product management, Andrew Burton confirmed that this sort of a chat worm was a "first" even though not widespread. It also reflected that worm writers were trying out new techniques to hoodwink wary PC users. Burton prophesied, "We will see one or two instances of an attack, there will be a refinement and then there will be an outbreak". An indication of the things to come, the IM bot shows a certain degree of sophistication that has never been seen before.

Another IM security specialist Akonix Systems on the same day announced a worm that follows the more expected route of a holiday greeting card. But given that Christmas is round the corner, it could cause damage as unwary recipients may accidentally open the greeting. Given the name Aimdes.E, this worm arrives on the AIM screen with a link saying, "The user has sent you a Greeting Card, to open it visit (the link)”. Once the link is clicked the worm gets installed, launching a backdoor to the system besides sending a similar message to contacts.

The presence of these sort of threats is a clear indication that users need to be careful even on Instant Messaging applications. Links in chats from friends could actually be a bot trying to perpetrate itself. Unlike the previous era worms, bots are more intelligent programs that have the capacity to interact with people and programs alike.

AOL itself has bots that permits users to get a reply when asked queries via IM. But like all things good there are many code-writers who use these bots to gain control of user systems without their permission, often for unworthy purposes. A quickly as these bots are discovered, they vary and security experts are on a constant trail of such variants. The bottom-line is “chat with care” and “avoid opening links” even if it carries “lol”.