Worm Exploits MSN Messenger

[BigBlueBall News]

CNET

February 14, 2002

A worm that uses Microsoft�Œs MSN Messenger application to exploit a browser glitch emerged late Wednesday and spread rapidly, despite the existence of a patch covering the security hole, according to experts.

The worm replicates itself by sending messages to other MSN Messenger users but doesn�Œt otherwise damage PCs, experts said.

The virus may have originated with a demonstration originally created weeks ago to warn of an Internet Explorer exploit.

JS/Exploit-Messenger, as it is called, apparently emerged from several different locations at once on Wednesday. It exploits a hole in the Internet Explorer browser that Microsoft made public Feb. 11 along with a bug fix, just two days before the worms appeared.

"The main problem is getting people to apply the patches," said Jack Clark, product marketing manager with Network Associates. "There are a lot of desktops out there."

A worm is a type of virus that replicates itself across a network.

The hole allows Internet Explorer to automatically execute harmful JavaScript code embedded in a Web page. In this case, code appeared on several Web sites causing Explorer to create a Messenger missive and dispatch it to other contacts within Messenger. The note contains a link back to the Web page containing the code, with a message such as "Hey go to (link) plz" or "Go to (link) NoW!!!"

Some of the pages containing the code were taken down quickly, according to virus companies. The worm appears to have spread at high speed because of the instantaneous nature of Internet-based instant messaging, but it does not appear to have infected large numbers of users. Sophos, a UK-based antivirus company, said none of its customers had reported being hit by the virus.

[Discuss]

http://news.com.com/2100-1001-837556.html