The Internet security company IMlogic is reporting on a new virus, titled IM.Myspace04.AIM. The virus, once it infects its host, disables anti-virus software and software firewalls, then sends out instant messages to everyone on the host computer's buddy list.
The user of the host computer is unaware that this is happening, and does not see any of the outgoing messages. However, people on that user's buddy list will start seeing instant messages from the host's computer. For all intents and purposes, these IMs seem to be coming from someone the user knows and trusts already.
The messages are simple, consisting of phrases such as "lol thats cool" and urging the "buddy" to click on a "cool" link, which is a download address for the virus. If the user queries the bot about the link, the virus will respond: "lol its not a virus."
While IM.Myspace04.AIM is not currently widespread, it does represent a new method of "social engineering," the technique hackers have long used to convince human operators to give out passwords, turn off security measures, or download and execute viruses or trojans. In this case, the entity doing the social engineering isn't human, and can work tirelessly without end.
Bots pretending to be humans have been around for years. Web-based message boards have recently been inundated with bots registering to sign up just to post a link to their web site, prompting many boards to implement "captcha" authentication where the human must read a sequence of blurry, distorted letters and type in the correct response to register on the site. Internet Relay Chat forums are often visited by bots who arrive briefly to promote their website and then leave. I remember being briefly fooled over ten years ago by a cleverly-written BBS door that pretended to be a human typing on the chat feature. In that case, it wasn't the content that convinced me, but the simulated poor typing and corrections. In the world of IM, where spelling and grammar don't count and "lol" is often the height of discourse, it's easy for bots to simulate humans.