Tech Shout!

Akonix Systems Inc. has recognised a new instant messaging (IM) worm named IM-Worm.Win32.Kelvir.WMF.A, which exploits the MSN IM network to spread the newly discovered Windows Meta File (WMF) vulnerability on users’ PCs.

The IM-Worm.Win32.Kelvir.WMF.A spreads over the MSN IM network using the link http://[snip]/xmas-2006 FUNNY.jpg. This jpg is actually an HTML page that contains a WMF file, taking advantage of a security vulnerability first identified on December 27. Opening the above link in a browser will infect users’ computers by downloading an SDBot that is instructed to download the IM-Worm.Win32.Kelvir.WMF.A virus. In turn, this attempts to re-propagate the worm by using an IM buddy list.

Akonix said that since the discovery of the WMF vulnerability one week ago, this is the first time it is being exploited as an IM-based threat. The company does not expect a patch for the WMF security hole to be issued uptil Tuesday, January 10.

Instant messaging is the simplest way for hackers to take advantage of this security infringe because users simply need to click a link in an IM conversation to get directed to a Web site infecting their machines. Akonix said that anti-virus software may not offer protection against the worm, and has advised enterprises to warn employees of this potential IM security risk.

Akonix L7 Enterprise systems are automatically configured to download and install the latest updates to the Akonix SPIM & Malware Filter, and no IT intervention is required. Akonix L7 Enterprise combines dynamically updated IM security policies and incorporated anti-virus scanning to provide protection for corporate networks from IM-based attacks. Akonix has advised other organisations to ensure all desktop computers are updated with the latest security patches, and that all public IM use is securely managed.

In its Q4 2005 IM Threat Watch report, Akonix said that the Akonix Security Center in 2005 issued a total of 233 SPIM and malware filter updates, compared to only eight in 2004, an increase of approximately 2,800%.