4 - IM Malware

Abstract

Instant messaging (IM) is not only used to transfer text messages but also to transfer files, which, as with e-mail, are capable of initiating a transfer of worms and other malware, and it can provide an access point for backdoor Trojan horses. IM can also be used by hackers to gain backdoor access to computers without opening a listening port, effectively bypassing desktop and perimeter firewall implementations. IM also supports peer-to-peer file sharing, where a directory or drive is shared. In this case, all the files on a computer can be shared using the IM client, leading to the spread of files that are infected with a virus or other malware. Viruses can be sent via file transfers, bypassing traditional gateway anti-virus security. URLs to malicious code hosted on the Internet can be pushed to users via IM, and that code can be downloaded and executed on local machines. IM worms can utilize exposed application programming interfaces (APIs) by the vendor, enumerate windows via the Windows OS APIs to interactively send a file, send a URL link instead of a file, or patch client DLLs to send itself along with the original message to spread through an IM system.