AIM-based worm?

From: Troy Ablan (bugtraq@pinchaser.com)
Date: 09/26/02


Date: Thu, 26 Sep 2002 15:51:47 -0400 (EDT)
From: Troy Ablan <bugtraq@pinchaser.com>
To: incidents@securityfocus.com


A coworker of mine (Tim) recently found a buddy on his buddy list who he
didn't know (JDogg786). When Tim sent a message to him/her, he got a
response back "Hmmmm.. http://24.74.206.239:8180/"

When he clicked on the link, it took him to a page which redirected to a
download of a file ending in .com, which he promptly alerted me to and
did not run it.

I tried to go to this link, it tried to download the file. I hit cancel,
then I tried to view the source of the page. From the View menu, or right
clicking on the page, and clicking View Source, nothing happened.

I eventually got the source using wget, which is shown below.

Question 1: Is there a way a web page can add a buddy to your AIM list
without your knowledge?

Question 2: How was I prevented from viewing the source of the HTML page
in IE?

I wgetted the psecure20x-cgi-install.version6.01.bin.hx.com file as well
for anyone who wants to look at it, just in case the above link does not
work any more.

-- BEGIN SOURCE --

<html><head><title>Browser Plugin Requried</title><meta
http-equiv="refresh" content="1;
url=psecure20x-cgi-install.version6.01.bin.hx.com"></head><body><h1>Browser
Plugin Required:</h1><br>You may need to restart your browser for changes
to take affect.<br>Security Certificate by <a
href="http://www.verisign.com">Verisign</a> 2002.<br>MD5:
9DD756AC-80E057FC-E00703A2-F801F2E3<br><br>Click <a
href="psecure20x-cgi-install.version6.01.bin.hx.com">HERE</a> and choose
"Run" to install.</body></html>

-- END SOURCE --

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com



Relevant Pages

  • Re: Friday Night Lights 4.03 [Spoilers]
    ... taking wrath from her that should have been directed at Buddy, ... It's good for Tim, mentoring the younger player ... I think Riggins would make a fortune co-authoring a diet and lifestyle book ...
    (rec.arts.tv)
  • Re: Friday Night Lights "The Toilet Bowl" (spoilers)
    ... Mindy convinced Tim that Billy is stepping out on her. ... no mention as to how the Taylors are going to pay for Julie's college. ... about it by having various East Dillon businessmen buy enough ads that Buddy ...
    (rec.arts.tv)
  • Re: Ive gone all Dervy.
    ... That looks very similar to what Tim Kemp's buddy uses. ... Had a play today, wasn't fully calibrated then, is now. ... Drove to Tesco for fuel, then on into car park for some shopping. ...
    (uk.rec.cars.modifications)
  • Re: Friday Night Lights 4.03 [Spoilers]
    ... Don't miss the fact that he was in awe of the statue Richard built. ... S3, Buddy was a major screwup -- a good ol' boy and loyal friend, but ... Buddy wouldn't want to lose the ... It's good for Tim, mentoring the younger player ...
    (rec.arts.tv)
  • Re: REALbasic 2006 Release 2 Article
    ... Nice try buddy. ... I suggest you visit RS on a more frequent; ... knows they required you download the entire application to ... original post was made. ...
    (comp.lang.basic.realbasic)