May 27, 2005

Many Internet security companies warn that a new worm and a phishing scam are aimed at users of AOL and Yahoo instant messaging systems. In both cases, Internet users get an instant message (IM) with an apparent reference to the newly released "Star Wars Episode III" movie, encouraging them to click on a link.

"Both seek to capitalize on momentum and enthusiasm around the 'Star Wars' movie," he said.

In the case of the AOL worm, the text in the instant message is: "hehe, i found this funny movie," and the word "this" is a hyperlink, according to the IMLogic advisory. The Yahoo message references "StarGames" in the link, IMLogic said in its warning.

When an IM user clicks the link in the AOL message, malicious code is downloaded to the user's PC. The code is installed, and the worm sends itself to all of the victim's contacts, Shmugar said. The code, a variant of the Gaobot virus, could give the attacker remote control over the victim's PC, he said.

The link in the Yahoo instant message leads to a site that is designed to look like a real Yahoo Web site, but is in fact part of a phishing scheme to steal login information, Sakoda and Shmugar said. (Phishing scams are a prevalent type of online fraud that attempts to steal sensitive user information such as user names, passwords and credit card information.) Once at the Web site, the IM user is asked to enter their Yahoo credentials, which appear to then be e-mailed to a Hotmail e-mail address.

The worm and phishing scam are the latest in an increasing number of cyberthreats that use instant messaging to get to Internet users. Just as with attachments and links in e-mail, instant messaging users should be careful when clicking on links that arrive in instant messages--even messages from people they know, Sakoda said.

People are advised to keep their antivirus software up to date. McAfee will update its antivirus software on Wednesday to detect this latest Gaobot variant, Shmugar said. Current McAfee products may catch the malicious software via their intrusion detection capabilities, he said.

Source: C-Net News

Save Internet Security.ca's URL to the list of your favorite web sites in your Web browser by clicking here.

Become an authorized reseller of Proxy Sentinel™ and Firewall Sentinel™. Do like the rest of our authorized resellers and have your clients benefit the important security features of our products and solutions, while increasing your sales at the same time. Click here for all the details.

You can link to the Internet Security web site as much as you like. Read our section on how your company can participate in our reciprocal link exchange program and increase your rankings in the major search engines such as
Google and all the others.