A new breed of computer worm could spread and multiply thanks to a software bug discovered in the latest version of AOL instant messenger (IM), according to a US-based team of researchers.
The problem affects those running AOL鈥檚 instant messenger application and Microsoft鈥檚 Windows operating system. The flaw lies with the process that allows two AOL IM users to play games online.
A malicious hacker could design a simple program that would use this communication process to gain complete access to another user鈥檚 system, according to an analysis published by a computer security research group called w00w00.
Advertisement
The author, Matt Conover, says that this particular bug is so simple to exploit that a self-replicating computer worm or a harmful computer virus could use it to spread quickly.
Propagating code
Conover believes a program exploiting the hole could easily be designed to download further files from the web, determine the buddies of the victim, and then attack them also. 鈥淕iven the general nature of social networks and how they are structured, we predict that it wouldn鈥檛 take long for such an attack to propagate,鈥� he writes in his analysis.
Victims could fall prey to such an attack without having to download a file themselves. There is also no way to determine who launched it, Conover says.
AOL is currently working on way to block such malicious messages at the central server and expects this to be completed within a few days. This means users will not have to install a patch themselves. The company says that no users have been targeted with the exploit to date.
Hungry worms
Software bugs with instant messaging applications are not unusual and viruses have in the past been designed to spread through other messaging programs, although none has spread far in this manner.
But Conover says: 鈥淭he implications of this vulnerability are huge and leave the door wide open for a worm not unlike Melissa, ILOVEYOU, CodeRed or nimda.鈥�
Experts note that instant messaging programs could provide a fertile breeding ground for worms and viruses because each provides a 鈥渂uddy list鈥� of contacts, similar to an email program鈥檚 address book.