The Next Big Virus Threat: Instant Messaging
In the past, viruses needed help. They couldn't infect your machine unless you opened an e-mail-attachment or another malicious file. Nowadays, viruses can attack on their own. Like the MS Blaster worm or the more recent Sasser, they can burrow onto your machine through a vulnerability, or hole, in your operating system or another piece of software. In the summer of 2003, Blaster infected more than 10 million people worldwide by exploiting a known vulnerability in Microsoft Windows XP.
Since Blaster, Microsoft has done a much better job of patching the security flaws in end-user operating systems. According to the company, three times as many people downloaded the patch that protected against Sasser as did the one that prevented Blaster. But there's still a gaping hole in millions of systems across the Internet that seems to have gone unnoticed. Symantec, makers of Norton Antivirus, says the next big worm is likely to exploit flaws in instant messaging clientsand it will spread faster than any other worm on record.
"Code Red was able infect every vulnerable machine on the Internet in 14 hours. Slammer was able to do it in 20 minutes," says Eric Chien, chief of research at Symantec Security Response. "An instant-messaging threat could spread to a half a million machines in 30 or 35 seconds."
This is particularly worrying because IM clients are widely used on business machines. The Radicati Group estimates that 26 percent of American companies use instant messag-ing as an official corporate service and that another 44 percent would acknowledge that their employees use instant messaging on their own. This jibes perfectly with estimates from the Gartner Group.
Naturally, viruses can spread over IM in much the same way they spread over e-mail: via attachments. But this is a minor worry. The real danger is that someone will realize that IM is ripe for attack from a so-called "blended threat," a virus that exploits a specific soft-ware vulnerability. "A blended threat, like a Code Red or a Slammer, takes advantage of a bug in the software on your machinesay a bug in IIS server," explains Chien. "They can gain access to your machine without you doing anything."
In all likelihood, there are numerous vulnerabilities in today's IM clients. All software contains such holes. "We've seen vulnerabilities in every free IM client out there," says Chien. The difference is that, unlike most apps, an IM client is almost always exposed to the Internet.
On any given day, there are probably only a few minutes when a virus could exploit a vulnerability on your e-mail client. The chances are that you open your e-mail client for only a few minutes, pull down the latest messages, and then close it. But your IM client is generally open and running all day long, ready to receive messages at any point. This makes it much easier for someone to piggyback a virus on an instant message and exploit the client's vulnerabilities. And thanks to your IM "buddy list," an instant messaging blended threat could spread with inordinate speed. Past speed demons like Code Red and Slammer spread by system-atically scanning the Internet for vulnerable hosts. "They would literally start at IP address 188.8.131.52 and go up 255.255.255.255," explains Chien. "It's like calling every phone number in the world." But an instant-messaging blended threat wouldn't have to do that. After in-fecting one IM client, it could just send itself to everyone on the client's buddy list. "Once they infect a machine, it has a ready-made list of [vulnerable machines] right there for the taking, and as it reaches other machines, it can continue to spread the same way."
The good news is that whenever you open your IM client and connect to your particular IM network, the vendor will automatically install patches for any known vulnerabilities. But there's always the risk that someone will exploit a hole before the vendor finds it. All it takes is 30 seconds.
What can you do to protect yourself? For one, if you're not already, you should be run-ning antivirus software. Most engines have plug-ins for IM clients. And on the corporate side, businesses need to crack down on the unauthorized use of IM within their walls. If IM is essential to your business, Chien recommends using something other than the free clients, something that uses encryption and goes through a more rigorous testing process.
blog comments powered by Disqus