zero-day IE flaw.

tom-thebox

http://news.netcraft.com/archives/2004/06/09/new_attack_compromises_fullypatched_ie_browsers.html

Martyr

Someone mentioned this, i can't remember who..
About installing help files..

Something related to exploiting weaknesses in web browsers..

There was talk of this virus that would exploit vulnerabilities
in web browsers in order to spread.
The main way it worked was through, yet again..social engineering.

The virus would connect to multiple IRC servers, limiting connections
to only a few at a time.
Then, at random would initiate conversations between
random people from random channels.
Without a response from one person within a period
of time, it would simply move onto another user.

It would make the introduction to atleast one person,
with simple "hi", "hello", "how are you"..etc
taken from a table, selected at random, and even
saving previous introductions from earlier conversations.

Once, 2 people had responded, it would relay
each message between each user.

All the virus would do then, is simply monitor the conversation
for key words to a particular subject.

It would relay messages..like

UserA <---> Virus Host <---> UserB

Then at some point, inject hyperlinks to both users, if say.."music"
was mentioned, "check out this great music site"
providing a link to the virus host where a pseudo
web server would take the connection and send the exploit
appropriate to the connecting users web browser
after analysing its request.

Sounds all very elaborate and probably has more
detail to it, but i found it interesting.
And i'm sure with the millions of users on IRC, it would work
very well indeed, for its purpose, of course.

i thought it was stupid..funny in some ways, but there
are alot of naive people around.
All the talk about using Artificial Intelligence in viruses
seemed far fetched.
For now, they could use..intelligent people on IRC ;-)

hehe

Of course, the virus could simply monitor channels
too..who knows, or utilise AIM and ICQ, and all
that kind of thing..

Its probably something you'll see more often in the future.

scojones

i'd love to know how it relays the messages.

Martyr

I guess it works similar to a proxy server..
Maybe, set up a thread for each user.
I would think, from my limited knowledge of the IRC protocol
it simply recieves the messages from the server, and then
sends them back to it, in process to each user after analysing them...dunno really.
Probably modify name of recipients/senders too of course.