Instant Messaging Worms, Analysis and Countermeasures

IM worms are an interesting beast. They have both built-in speedups for propagation via a buddy list, an a great control mechanism in the message routers for each network. We haven't seen the end of them, but they seem to be dominated by bots using link-spamming techniques to propagate. This paper, from WORM05, proposes throttling (which works) and CAPTCHA mechanisms to give a challenge-response mechanism for possibly malicious content. As I recall, the latter wasn't well received by the audience at WORM05, who felt that if you suspected content was dangerous why don't you just block it.

We provide a collection of minor results on the area of Instant Messaging (IM) worms, which has received relatively little attention in the formal literature. We review selected IM worms and summarize their main characteristics, motivating a brief overview of the network formed by IM contact lists, and a discussion of theoretical consequences of worms in such networks. Existing methods to restrict an IM worm epidemic are analyzed in terms of usability and effectiveness, leading to the suggestion of two minor variations to limit IM worm propagation. We believe these variations are more user-friendly and effective than existing published methods. We also provide brief results of a three and a half year user study of IM text messaging and file transfer frequency in a moderate-size public IM network – the largest such study to date – which is of independent interest, but also supports in part the preceding claim regarding user-friendliness.

Source: Instant Messaging Worms, Analysis and Countermeasures, M. Mannan, P.C. van Oorschot. WORM 2005 (ACM Workshop on Rapid Malcode).