Sources inside of the world's largest consulting firm reported being hit by an AOL Instant Messenger worm late today. The worm masquerades itself as an AIM game and propagates itself by sending messages to your buddy list simply stating:
Check this out: [Some URL].
The URL takes you to a web site displaying a news article claiming that Osama Bin Laden has been captured. To read the article you have to click on a link that begins the download of the AIM game containing the worm. Most users’ default settings for AIM allowed the program to launch successfully without being detected by anti-virus software.
Thousands of users internal to Accenture were hit by the worm. Portions of their global network were reported inaccessible as a result of this worm being propagated. The CIO Service Center help desk became clogged with callers. Some sources reported being contacted by people outside of the company complaining about receiving the worm's messages.
This worm spread so fast that there was no time to react. IT staff had to sit back and watch the event unfold, despite their centralized control of desktops and laptops connected to their corporate network.
What will be the outcome of this event? Will they ban AIM or purchase the corporate service, either of which will cost them hundreds of thousands of dollars?
Accenture makes heavy use of the free AIM services to the level some would think it is abusive of a free service. When I worked there, most communication was done via email and AIM. Things that could wait for a response were sent via email. At any given time during a normal day, I would have three or four AIM sessions going.
