Yahoo messenger log files help

The MIS of one of our sister orgs. just called and has discovered that one of her (L)users has, (against company policy), installed Yahoo Messenger and been using it over port 80 to avoid the firewall block. She says that the logs are there but if she opens them they are all ascii characters.

Anyone tell me how to read the logs to determine if it is work related or not 'cos if it isn't the (L)user is getting her pink slips - if it is the (L)user is getting suspended...... either way, she's in the clag........

What are you trying to find? If I remember right, when you put Yahoo over port 80 the traffic tends to look similar to HTTP but not quite. Nothing is encrypted so with a sniffer you should be able to read all coversations and see login/logout.

/nebulus

We'll it appears as if I have been bet to the punch again.

Nebulus200

You are correct with the sniffer. Just use Iris. It does all the dirty work for you. Plus it is super simple for lazy people like myself. If you prefered a *nix based sniffer however, try whatever you are comfortable with.

Its a .dat file saved by the user by the look of it.

It's entitled awesomeamber03.dat, along with harely_babe, peachsncream etc etc etc..... really sounds like work..... ;)

It was located in the Progra~1\yahoo!\messenger\profiles\awesomeamber03\archive\messages\probe7270 folder.

Is it possible that these are the user's profiles and these are logs of her activity as that screen-name...... I say that because of the directory structure. And if this is the case then these sure aren't the kind of names you would use for work related conversations..... :rolleyes:

does AIM have logs too? If yes, where are they located?

I just checked my folders where I have it installed and don't have anything like that. The user must have chosen to archive some offline messages. You are probably better off looking at your firewall logs (or maybe IDS logs, ISS for example detects many Yahoo things). If you haven't busted the user yet (which I take it you have), you could also setup a network sniffer and catch the entire conversation.

If you have already busted them and IDS doesn't catch it, your best bet for seeing the conversations is to look at your firewall logs. If you log the URL of http traffic, you will see what IP she was talking to and maybe parts of the converstation. You may want to take that DAT file and put it on a unix system and run 'od -cx' and 'strings' on it, you might be able to get useful infomration that way, but just keep in mind, it is probably only offline messages.

/nebulus

I found some information on another forum that may help:

Quote:

---

when i'm in yahoo messenger and i want to view some ones profile a message pops up saying: THIS FILE DOES NOT HAVE A PROGRAM ASSOCIATED WITH IT FOR PERFORMING THIS ACTION. CREATE AN ASSOCIATION IN MY COMPUTER, BY CLICKING VIEW AND THEN CLICK FOLDER OPTONS.

So what then?

---

Answer:

Quote:

---

You can always type in:

http://profiles.yahoo.com/<user name>

---

Cheers:

I believe if its a date file then u may have to use the "Messaging Archive Viewer" tool in the Yahoo Messanger menu, from there u can see all the logs by the peoples names like u said were awesomeamber03.dat, along with harely_babe, peachsncream etc etc etc. If she uninstalled the messanger then reinstall it and see if you can load the messanger archive and have it open those .dat files. If you dont wanna install it back on her machine cuz she'll say something like u put it on there then save the .dat files on a floppy (shouldnt be too big) and install the messanger on another computer and load the .dat files in the view. I know that theres an option in messenger that u can archive all the conversations you've had with people.

Ok. I recreated the folder structure by using my yahoo profile and put her dat. file in there. Lo and behold it comes up in the Archived messenger thingy as a record of a conversation with probe7270. It clearly shows that the concersation took place, when each line was typed and even shows the "smileys"..... But the actual conversation comes out as trash, like it's encrypted.

I checked probe's profile and he's a guy.... she's a girl..... I see birds and bees....<s>

So.... I know....

1. The names are her screen names
2. the last folder name is the name of the person she was talking to
3. Yahoo uses some kind of encryption on the offline files that probably uses her password.
4. It ain't work........

try my advice tiger...just to see if it works...then u might actually have the convo. Not tryin to sound like a uber yahoo dude but maybe the archiver has an algorithm to read the log files and show them to u in plain text maybe? i dunno worth a shot if u wanna try and read them.

I'll give it a bash in the morning if I have time Def..... thanks

No offense tigershark......but,you sound like a real dick!
Don`t you have anything better to do?

Quote:

---

Originally posted here by hillbillyh8ter
No offense tigershark......but,you sound like a real dick!
Don`t you have anything better to do?

---

Now just how is Tiger being a dick? I believe he, like many others here, are hired to perform various functions related to securing a company. Doing investigations on policy breaches is just one of those functions. This looks very much like a breach of policy, so he is doing his job.


Cheers:

Tigershark is perfectly within his job description to perform the duties that he has listed. I'm sure there is something in their security policy about how the end user should have no expectations of privacy while working on the companies network. It's also been stated that it is in the policy that they are not allowed to use IM software.

This user broke the rules, and Tigershark is doing his job (at least I assume it's a him).

Tigershark - I'll look in to the tools that we use here for breaking the "encryption" that the various IM software out there uses on their log files. I remember doing all this on a yahmess account a couple of years back.

lol what was up that guys ass? dont worry about him tigershark

Apparently no one read the initial post well enough to know that tigershark isn't the one doing this but a fellow MIS person from a sister organization...he apparently is just trying to help out a fellow co-worker. And neither he nor his co-worker are being "dicks" for doing their job and enforcing company policy. If the policy states that you aren't supposed to install programs and you do it any way then you are going to get what you deserve.

wow, banned so soon...lol just 6 posts. What was his problem?

Well....... What can I say? Other than thank you for the overwhelming outflow of support and offers of additional help from most...... :D

For Hillbilly: Yes, I can see why someone might think I am a dick and that's fine.... You see, I get paid quite well to be a dick when the company's policies that I wrote are violated. Allow me to expand.

Company policies are given in writing to each new employee. They are also periodically reminded of them in an email that details the acceptable use of company owned computers, laptops and handheld devices. Those policies include the following pertinent, (and not unreasonable), items:-

1. Thou shalt not install any software without the explicit permission of your MIS
2. Thou shalt not expect _any_ privacy in any electronic communication using company property.
3. Thou shalt not use personal webmail or IM software.
4. Thou shalt not attempt to circumvent the security measures put in place by the MIS dept.

(For your edification: they do not actually contain the "Thou shalt's").

Now.... bearing in mind that this gal was caught just a month ago doing this but the MIS of her company didn't inform me then or I would have had sniffers on her box. Bear in mind the messenger was uninstalled and the gal reinstalled it. Bear in mind that the gal discovered, (as I did again yesterday), that my firewall does indeed block Yahoo IM so she had to change the settings to "I believe I am behind a firewall.... but want to circumvent it anyway".........

I can assure you Hillbilly that my supervisor, (the COO of my company), does not think I am a dick for my actions..... and to be quite honest I don't really care if she does..... She pays me to do this job and she gets her money's worth. As to the gal..... she has had more than fair warning but appears to be an immature little gal who thinks she is smarter than her co-workers. Hopefully, this experience will give her a new found respect for those around her in the workplace as she moves forward to her new career elsewhere. You might want to try learning from her experience too since your rection implies a similar level of maturity, but I do understand that one of the failings of the immature is that they _have_ to learn from their own experience not that of others...... Good luck.

Lv4: Tiger Shark is indeed, all man..... ;) Thanks for looking for the encryption stuff. I haven't spoken to the MIS in question since yesterday but I left her a voicemail pointing out that the cute names under profiles are the screen names and the names of the final folder is who she was talking to and that while I can't see the content the cute names are not something her company would appreciate her doing business for them under.

Thanks again everyone........ This is what AO is about....... :D

I would create some user right policy restrictions for other users who should not be able to, say, install or reinstall programs....etc. This will help avoid alot of hassle in the future.