IM-based malware threat grows

By

Just as the number of end-users enlisting instant messaging (IM) programs to communicate has risen, so too has the number of distinct families of IM-based malware. More attackers are utilizing this propagation method and infections are increasingly sophisticated.

IM-based malware threat grows

The most anticipated development breakthrough for IM-based malware is to close the loop in the propagation mechanism and automatically begin executing the malware on the target machine. The net effect of this will be significantly faster execution of the malware.

The second major breakthrough we expect to see is a change in the malware binary distribution method. Currently it requires that the malware be downloaded from a central distribution site, which means that it is easy to shut off this point. We expect authors to begin to propagate the malware from one infected machine to another, much like a traditional worm, using either the built-in file transfer capabilities of the worm or a mechanism such as TFTP (used by worms like Blaster) or HTTP fetches from the attacking machine. This will make eradication of the worm significantly harder.

Finally, we expect the number of messages sent to a user to entice them to accept the malware to grow, which would make message analysis more difficult. 

Attackers have shown a widespread adoption of the IM-based worm as a major threat vector in recent months, and we expect this trend to continue. Because of the network structure, such worms can devastate enterprise networks. Instant messaging is here to stay, so it is inevitable that we will continue to face threats that use those networks to propagate.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Log In

  |  Forgot your password?