Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IM Worm Raises Bar By Using P2P For Herder Comm Channel

Security companies alerted users Tuesday of a worm that spreads via instant messaging, plants a bot on hijacked PCs, and poses a special challenge to researchers hoping to trace the bot back to its controller.

Dubbed "Nagache.a" by the likes of McAfee and Symantec, the worm propagates through AIM (America Online Instant Messaging) and MSN Messenger, as well as via e-mail and network shares. It will also install in a drive-by download -- a secret installation invisible to the user -- if the PC isn't patched against a pair of 2004 vulnerabilities in Windows.

In turn, Nagache.a installs a bot -- a controlling component -- that communicates to its handler, sometimes called a "herder," on TCP port 8.

However, unlike most bots, which are run by their herders through IRC, this bot is controlled via a peer-to-peer network that includes the infected machines. The traffic between the compromised computers and the herder is also encrypted, or at least not readable, said an analyst with the Internet Storm Center.

Other advisories said that the bot had raised the malware bar.

  • 1