WORM 2005, Fairfax, Virginia - Nov 11, 2005

On Instant Messaging Worms, Analysis andCountermeasures

Mohammad Mannan and Paul C. van Oorschot
Digital Security Group
Carleton University, Canada

Overview➠ Review Instant Messaging (IM) worms➠ Analyze known countermeasures for IM worms• Present two simple variations of current techniques➠ Raise awareness of IM worms

Mohammad Mannan

2

WORM 2005

Definition of IM worms➠ Worm: Malicious code that propagates over a network, with orwithout human assistance [Kienzle & Elder, 2003]➠ IM worms: Worms that spread in IM networks, by exploiting features or vulnerabilities of IM clients and protocols

Mohammad Mannan

3

WORM 2005

Figure 1: IM in action
Mohammad Mannan

4

WORM 2005

IM communication model
ServerClient A
A’s contact list

Client B
B’s contact list

BADCEHH

Client−Server Communications (e.g. login, profile)
Client−Client Direct Communications (e.g. file data transfer)
Client−Client Server−mediated Communications (e.g. text message)

Mohammad Mannan

5

WORM 2005

IM worms: why do we need to worry?

➠ IM is a popular application• instant communication (home users)• instant collaboration (enterprise users)➠ Number of users (in millions): MSN 185, Yahoo! 82, AOL 61a➠ Number of IM worms• 2004: 1 new IM worm per month• 2005: 28 new IM worms per month➠ 13 of Fortune 50 companies were affected by IM-related security
incidents in the last 6 monthsb
abSource: ComScore Media Metrix, Aug. 2005
Source: IMlogic, Nov. 2005

Mohammad Mannan

6WORM 2005

“I don’t use IM. Why should I care?”➠ The user base is big enough to impact the whole network➠ You may use it without knowing! (integrated IM in popular applications)• Microsoft Outlook Express• Microsoft Live Communication Server

Mohammad Mannan

7

WORM 2005

What makes IM networks different?

➠ IM and scanning worms
1. Scanning worm’s connection attempt to a target may fail• IM worms have free hit-list (contact list)
2. Spread of IM worms may be latency-limited• Some scanning worms are bandwidth-limited➠ IM and Email worms
1. IM worms have access to an online hit-list
2. IM worms can expect instant user-action

Mohammad Mannan

8

WORM 2005

Existing techniques to restrict IM worms
1. Temporary server shutdown [Hindocha & Chien, 2003]– Unrealistic?
2. Temporarily disabling the most-connected users [Smith, 2002]– Disabling the top 10% connected users still would leave 90% of
the remaining network connected
3. Virus throttling for IM [Williamson & Parry, 2004]– See the next slide

Mohammad Mannan

9WORM 2005

Virus throttling for IM – the mechanism
requesth"delay"
queue

working set
n=4
not−new

abc

new
add

dgf

Queue
lengthdetectore
updaterate timer

clockprocess

Mohammad Mannan

10WORM 2005

Virus throttling for IM – shortcomings
1. One new contact/day may be too restrictive2. Instant messages may get delayed
3. Test data set is small – only 710 users and 2.5 messages/user/day
4. Group chat is not handled
5. Worm may ‘learn’ a user’s working set

Mohammad Mannan

11

WORM 2005

Two simple proposals – motivation➠ File transfer and URL messages are the most common propagation mechanisms• Neither is expected to be instant (but quick nonetheless)➠ File transfer and URL messages are much less frequently usedthan normal text messagesa

1.84• File transfer/user/day:• Text message/user/day: 334.03➠ Idea: restrict file transfer and URL messages
aData collected from Eyeball Networks, 2001 - 2005, on avg. 7459 online users

Mohammad Mannan

12

WORM 2005

Two simple proposals – mechanisms➠ Use these independently or in combination:
1. Throttle file transfer requests and URL messages
2. Challenge senders of a file transfer request or URL message
with a CAPTCHA• Some users send more files than others – use secure
cookies [cf. Pinkas & Sander, 2002]• Challenges may come from the server or recipient client

Mohammad Mannan

13

WORM 2005

Comparing virus throttling to new proposals➠ Throttling minimizes the number of IM worm connections – a worm
can establish a certain number of connections unchecked➠ New proposals restrict only file transfers and URL messages, notIM connections (e.g. for text messages) – intention is better usability

Mohammad Mannan

14

WORM 2005

Concluding remarks➠ IM security proposals must consider usability• IM users are mostly ‘casual’• IM messages are expected to be ‘instant’➠ Early CAPTCHAs have been broken [Mori & Malik, 2003]• Arms race
➠ New proposals presented are preliminary (not implemented)

Mohammad Mannan

15

WORM 2005