AOL IM bot cloaked in encryption

America Online on Monday said it is blocking malicious links tied to a recently discovered bot that uses encryption to increase the range of its targets and make eradication more difficult.

The bot software, which can only infect those who click on a malicious link sent via AIM, may infect upwards of a few tens of thousands of users, said Johannes Ullrich, chief research officer at the Sans Institute. San's Internet Storm Center released a report on the issue Sunday night.

"This is one of the few times we've seen a botnet encrypted," Ullrich said. "Encryption usually takes a lot of code space, but in this case it does not. It's a leaner bot."

A computer that has bot software installed--for example through a malicious Web site or Trojan horse--is called a zombie. A network of zombies is referred to as a botnet.

The bot, which is about a third of the size of other bots that have used encryption, requires less bandwidth to infect someone's system, making it possible to infect a larger number of computers, Ullrich noted. In addition, the encryption makes it more difficult to ascertain the bot's command language, so IT administrators could have a harder time locating and removing the bot.

But AOL said it is blocking the three URLs it has identified as being tied to the bot in order to prevent its AIM users and AOL subscribers from inadvertently clicking on the link and infecting their machines.

"It is not a significant threat for our members or AIM users," said Andrew Weinstein, an AOL spokesman.

Security researchers also suspect that the bot may be using peer-to-peer techniques rather than relying on a central command control server to issue orders to a network of zombie computers. As a result of the peer-to-peer network, the malicious attacker can easily issue commands from any one of the commandeered zombie computers, and the encryption gives only the attacker control of such commands.