Skype is warning users of a new worm that may infect users computers, according to a story in Infoworld by Jeremy Korn. A message will pop up on Skype chat from someone who has your Skype address in their mailbox showing links to a couple of sites. Clicking on those links will prompt you to download a file.

If you do, the file will download and execute. It sets your online status to busy while it propagates itself to other users in your Skype address books and will change your host file (this translates DNS names to IP addresses) so that your anti virus updates won’t work. It only targets Windows computers.

It all relies on social engineering: getting someone to click on a link to look at the latest internet joke or naughty picture. The link leads to a site or runs software that will install a virus, or a worm, or a trojan (collectively malware). It works really, really well.

Of all the bad things that can happen from getting hit by a worm, this is fairly benign. Skype, to its credit, has admitted the problem and has warned (albeit only via its blog) users. But this example should not be seen as an isolated incident, internet messaging (IM) is a fast-growing vector for virus and trojan propagation.

If you’ve ever been in an office in China, you’ll notice that virtually everyone is using some form of internet messaging. While this in itself is not necessarily a bad thing (unless you’re concerned about productivity), it can create an environment ripe for hacking. The convergence of:

- Unsuspecting users clicking on a link
- Poor computer administration that results in vulnerable software not being patched or updated
- Unrestricted administrative rights that allow users total control of their computer
- Unlicensed software that may not be eligible for updates

All results in infected computers. China is one of the most (if not the most) insecure computing environments in the world. Internet messaging is a key contributor to the problem.

While some people may not care, it can be a nightmare in an office. Bandwidth may get sucked up, computers may run slowly or even not run at all, IDs and passwords may get disclosed, etc., etc.

So mind what you’re clicking on and save IM for what it’s meant for: killing time in the office gossiping with friends.

Share This