On instant messaging worms, analysis and countermeasures

WORM'05 - Proceedings of the 2005 ACM Workshop on Rapid Malcode

Volumn , Issue , 2005, Pages 2-11

  Mannan, Mohammad ^a   Van Oorschot, Paul C ^a  

^a CARLETON UNIVERSITY   (Canada)

Author keywords

Instant Messaging worms; Scale free networks

Indexed keywords

COMPUTER NETWORKS; INFORMATION DISSEMINATION; USER INTERFACES; WORLD WIDE WEB;

INSTANT MESSAGING WORMS; SCALE-FREE NETWORKS;

COMPUTER VIRUSES;

EID: 31844456208     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1103626.1103629     Document Type: Conference Paper

References (63)

1. R. Albert, H. Jeong, and A.-L. Barabási. Diameter of the World Wide Web. Nature, 401:130-131, 1999.
2. America Online, Inc. AOL Instant Messenger. http://www.aim.com/ [Accessed: Mar. 22, 2005].
3. Anti-Phishing Working Group. Phishing activity trends report, Feb. 2005. http://www.antiphishing.org/APWG_Phishing_Activity_Report_Feb05.pdf [Accessed: Mar. 31, 2005].
4. A.-L. Barabási and R. Albert. Emergence of scaling in random networks. Science, 286:509-512, 1999.
5. A.-L. Barabási and E. Bonabeau. Scale-free networks. Scientific American, 288:60-69, 2003.
6. N. Borisov, I. Goldberg, and E. Brewer. Off-the-record communication, or, why not to use PGP. In Proceedings of the 2004 ACM Workshop on Privacy in the Electronic Society, WPES'04, pages 77-84. ACM Press, 2004.
7. Z. Dezsö and A.-L. Barabási. Halting viruses in scale-free networks. Physical Review E, 65(5), May 2002.
8. Eyeball Networks Inc. Eyeball Chat - Free video Instant Messenger. http://www.eyeballchat.com [Accessed: June 15, 2005].
9. FaceTime. IMPact Center - IM & P2P Threats. http://www.facetime.com/ impactcenter/default.aspx [Accessed: Aug. 17, 2005].
10. A. Gostev. Malware evolution: January - March 2005, Kaspersky Lab. http://www.viruslist.com/en/analysis [Accessed: Apr. 27, 2005].
11. N. Hindocha. Threats to Instant Messaging, 2003. Symantec Security Response. http://securityresponse.symantec.com/avcenter/reference/threats.to. instant.messaging.pdf [Accessed: Dec. 7, 2003].
12. N. Hindocha and E. Chien. Malicious threats and vulnerabilities in Instant Messaging. In Virus Bulletin Conference, vb2003, Sept. 2003.
13. ICQ Inc. ICQ Pro 2003b. http://www.icq.com/ [Accessed: Mar. 22, 2005].
14. IMlogic. IMlogic Threat Center. http://www.imlogic.com/im_threat_center/ index.asp [Accessed: Mar. 17, 2005].
15. C. Kalt. Internet Relay Chat: Architecture, Apr. 2000. RFC 2810, Status: Informational. http://www.faqs.org/rfcs/rfc2810.html [Accessed: June 22, 2004].
16. D. M. Kienzle and M. C. Elder, Recent worms: A survey and trends. In Proceedings of the 2003 ACM Workshop on Rapid Malcode, pages 1-10, Washington, DC, USA, Oct. 2003. ACM Press.
17. N. Leavitt. Instant Messaging: A new target for hackers. Computer, 38(7):20-23, July 2005.
18. M. Mannan. Secure Public Instant Messaging, Aug. 2005. Masters Thesis (Computer Science). http://www.scs.carleton.ca/~mmannan/publications/msthesis. pdf [Accessed: Aug. 21, 2005].
19. M. Mannan and P. C. van Oorschot. Secure public Instant Messaging: A survey. In Proceedings of the 2nd Annual Conference on Privacy, Security and Trust (PST'04), pages 69-77, Fredericton, NB, Canada, Oct. 2004. http://www.scs.carleton.ca/~mmannan/publications/pst04.pdf [Accessed: June 23, 2005].
20. Microsoft. MSN Messenger. http://messenger.msn.com/ [Accessed: Mar. 22, 2005].
21. Microsoft. MSN Messenger for Mac. http://www. microsoft.com/mac/default. aspx?pid=msnmessenger [Accessed: May 3, 2005].
22. Microsoft. Office live communications server. http://www.microsoft.com/ office/livecomm/prodinfo/ default.mspx [Accessed: Mar. 18, 2005].
23. Microsoft PressPass. Flirting's moved online! New research from MSN reveals millions swap IM addresses with potential dates, July 2004. http://www.microsoft. com/presspass/press/2004/jul04/07-08FlirtingPR.asp [Accessed: Mar. 17, 2005].
24. Microsoft TechNet. Microsoft security bulletin MS05-009: Vulnerability in PNG processing could allow remote code execution (890261). http://www. microsoft.com/technet/security/bulletin/ MS05-009.mspx [Accessed: Mar. 18, 2005].
25. Microsoft TechNet. Microsoft security bulletin MS05-022: Vulnerability in MSN Messenger could lead to remote code execution (896597). http://www.microsoft.com/technet/security/Bulletin/ MS05-022.mspx [Accessed: June 20, 2005].
26. G. Mori and J. Malik. Recognizing objects in adversarial clutter: Breaking a visual CAPTCHA. In Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR), volume 1, pages 134-141, 2003. UC Berkeley Computer Vision Group. http://www.cs.berkeley.edu/ ~mori/gimpy/gimpy.html [Accessed: June 14, 2005].
27. News.com Staff. IM worm speaks your language, Aug. 2005. News article, http://news.com.com/ [Accessed: Aug. 24, 2005].
28. News.com Staff. Phishers target Yahoo Messenger, Mar. 2005. News article, http://news.com.com/ [Accessed: Mar. 27, 2005].
29. News.com Staff. Trillian IM flaw exposed, Mar. 2005. News article, http://news.com.com/ [Accessed: Mar. 25, 2005].
30. News.com Staff. Worm attack forces Reuters IM offline, Apr. 2005. News article, http://news.com.com/ [Accessed: Apr. 15, 2005].
31. News.com Staff. Yahoo fills in Messenger hole, May 2005. News article, http://news.com.com/ [Accessed: June 17, 2005].
32. J. Oikarinen and D. Reed. Internet Relay Chat protocol, May 1993. RFC 1459, Status: Experimental. http://www.faqs.org/rfcs/rfc1459.html [Accessed: June 10, 2004].
33. Open Source. aMSN: Alvaro's Messenger. http://amsn.sourceforge.net/index. php [Accessed: May 3, 2005].
34. Open Source. eMule Project. http://www.emule-project.net/ [Accessed: Aug. 21, 2005].
35. R. Pastor-Satorras and A. Vespignani. Epidemic spreading in scale-free networks. Physical Review Letters, 86(14):3200-3203, 2001.
36. V. Paxson, editor. Proceedings of the 2004 ACM Workshop on Rapid Malcode (WORM'04), Washington, DC, USA, Oct. 2004. ACM Press.
37. B. Pinkas and T. Sander. Securing passwords against dictionary attacks. In Proceedings of the 9th ACM Conference on Computer and Communications Security, pages 161-170, Washington, DC, USA, 2002. ACM Press.
38. P. Saint-Andre. Extensible messaging and presence protocol (XMPP): Core, Oct. 2004. RFC 3920, Status: Standards Track. http://www.ietf.org/rfc/rfc3920. txt [Accessed: Mar. 2, 2005].
39. P. Saint-Andre. Extensible messaging and presence protocol (XMPP): Instant Messaging and presence, Oct. 2004. RFC 3921, Status: Standards Track. http://www.ietf.org/rfc/rfc3921.txt [Accessed: Mar. 3, 2005].
40. S. Savage, editor. Proceedings of the 2003 ACM Workshop on Rapid Malcode (WORM'03), Washington, DC, USA, Oct. 2003. ACM Press.
41. Secunia. ICQ predictable file location weakness, Feb. 2004. Secunia Advisory SA10970, http://secunia.com/advisories/10970/ [Accessed: June 17, 2005].
42. R. D. Smith. Instant Messaging as a scale-free network, June 2005. cond-mat/0206378, http://arxiv.org/abs/cond-mat/0206378 [Accessed: June 20, 2005].
43. S. Staniford, V. Paxson, and N. Weaver. How to Own the Internet in your spare time. In Proceedings of the 11th USENIX Security Symposium, pages 149-167. USENIX Association, 2002.
44. Symantec. Search and latest virus threats page. http://www.symantec.com/ avcenter/vinfodb.html [Accessed: Mar. 18, 2005].
45. Symantec. Securing Instant Messaging. http://securityresponse.symantec. com/avcenter/reference/secure.instant.massaging.pdf [Accessed: June 27, 2004].
46. Symantec. W32.Bizex.Worm. http://securityresponse.symantec.com/avcenter/ venc/data/w32.bizex.worm.html [Accessed: June 21, 2005].
47. Symantec. W32.Bropia.M. http://securityresponse.symantec.com/avcenter/ venc/data/w32.bropia.m.html [Accessed: June 21, 2005].
48. Symantec. W32.Choke.Worm. http://securityresponse.symantec.com/avcenter/ venc/data/w32.choke.worm.html [Accessed: June 21, 2005].
49. Symantec. W32.Kelvir.HI. http://securityresponse.symantec.com/avcenter/ venc/data/w32.kelvir.hi.html [Accessed: Aug. 25, 2005].
50. Symantec. W32.Serflog.A. http://seurityresponse.symantec.com/avcenter/ venc/data/w32.serflog.a.html [Accessed: June 21, 2005].
51. Symantec. W95.SoFunny.Worm@m. http://securityresponse.symantec.com/ avcenter/venc/data/w9B.sofunny.worm@m.html [Accessed: June 21, 2005].
52. TechWeb.com Staff. IM threats growing 50% per month, Mar. 2005. TechWeb.com news article, http://informationweek.com [Accessed: Mar. 25, 2005].
53. The CAPTCHA Project. Telling humans and computer apart (automatically). http://www.captcha.net/ [Accessed: Mar. 19, 2005].
54. Trend Micro. JS_MENGER.GEN. http://www.trendmicro.com/vinfo/virusencyclo/ default5.asp?VName=JS_MENGER.GEN [Accessed: June 21, 2005].
55. Trend Micro. Virus encyclopedia. http://www.trendmicro.com/vinfo/ virusencyclo/ [Accessed: Mar. 18, 2005].
56. Trend Micro. WORM_AGOBOT.AJC. http://www.trendmicro.com/vinfo/ virusencyclo/default5.asp?VName=WORM_AGOBOT.AJC [Accessed: June 21, 2005].
57. Trend Micro. WORM_BROPIA.F. http://www.trendmicro.com/vinfo/virusencyclo/ default5.asp?VName=WORM_BROPIA.F [Accessed: June 21, 2005].
58. USA Today Staff. IM viruses opening a new can of worms, Aug. 2001. News article, http://www.usatoday.com [Accessed: Mar. 17, 2005].
59. N. Weaver, S. Staniford, and V. Paxson. Very fast containment of scanning worms. In Proceedings of the 13th USENIX Security Symposium, pages 29-44, Aug. 2004.
60. D. Whyte, E. Kranakis, and P. C. van Oorschot. DNS-based detection of scanning worms in an enterprise network. In In Proceedings of the Network and Distributed System Security Symposium (NDSS), Feb. 2005.
61. M. Williamson. Throttling viruses: Restricting propagation to defeat malicious mobile code. In Proceedings of the 18th Annual Computer Security Applications Conference (ACSAC), pages 61-68, Dec. 2002.
62. M. Williamson and A. Parry. Virus throttling for Instant Messaging. In Virus Bulletin Conference, vb2004, Sept. 2004.
63. Yahoo! Inc. Yahoo! Messenger. http://messenger.yahoo.com/ [Accessed: Mar. 22, 2005].