Printable View
Does anyone know of anything (theoretical or otherwise) that could exploit some kind of instant messenger to compromise network security?
In my research I have found several problems relating to recieving files, but are there any kind of vulnerabilities that do not require file trnasfer?
Thanks for any info/resources you may offer.
--
nickel
Well I know first that when you have, an instant messenger open it opens a port which usually is not a good thing. Now it also means which way you are referring to it and using it. Now if you are using it for BUSINESS it is kind of shaky I wouldn't personally.
Now I can't think of any exploits that can be used off the top of my head.
But I got a question, which Im service, don't they run on different ports.
I would imagine that there are a lot of possibilitys of a security flaw with a IM. I see that there is a program out by the creators of the Zone Alarm series calles IM Security. Its software that was created for the soul purpose of securing your computer while useing an IM. I would imagine that if a program was created to secure you PC w/ an IM then most likely it is not secure without it.
LINK(http://www.zonelabs.com/store/conten...sp?lid=nav_imp)
Also when you receive a file or send a file with an IM, lets say ICQ, your IP becomes easily availible to the user you sent it to or received it from.
well basically u are exposing ur internal LAN.....once the hacker is in ur n/w...he can almost do all kind of wired things....the way u expose ur LAN is indirect...
Security is not one mans job...until the End Users help him...usually this doesnt happens...there is always some lazy RAT to ignore admins warnings....this RAT may accept infected files...which may lead to the compromise of ur n/w...
A hacker may trick this RAT to give sensitive info too..
i think its very clear the point i am trying to make...
same thing is also possible with emails tooo...
instant messengers are a no-no on a secure LAN. I am a LAN manager in the army, we do scans for such programs on the regular. If we find one, we shut down the switch port the offending machine and make the end user clean all that mess off the HDD and bring it in for inspection before we turn in back on. MOst IM software uses a p2p connection, so keep that in mind when thinking about allowing IM software on your LAN.
Check any of the anti-virus vendor web sites. Worms and other nasties use IRC channels, ICQ, Trillian, KaZaa, Morpheus and just about any of the "freebie" chat and sharers to move and propagate. Widely know vulnerabilities. The writers of the worms and trojans take advantage of the fact that most users will download anything that is "free" and don't know how to protect their systems from the vulnerabilities.
this would propbably make a gud reading for u...and wud definately give u some reasons why IMs are bad in corporate LANs...
Source : http://www.computerweekly.com/articl...avourID=1&sp=1Quote:
Virulent worms that exploit vulnerable instant messaging (IM) clients and could infect hundreds of thousands of computers in seconds are a real threat for internet users worldwide, security researchers from Symantec have warned.
A small but growing number of documented IM security holes and the rapid adoption of IM technology within corporations are posing significant risks of infection and information theft, the two researchers said Friday at the Virus Bulletin conference in Toronto.
There are about 60 published IM vulnerabilities, according to Eric Chien, chief researcher at Symantec Security Response in Dublin. Those range from security holes that could be used to crash IM clients in denial-of-service attacks, to those which allow attackers to install and run malicious code remotely on computers running the vulnerable IM clients.
I have to agree that IM creates security holes in your network. Although, i personally do not know of any specific exploits for IM software. I can bet there are many out there that do. IM software basically makes a connection to a server for communication with the other IM clients out there or they make a direct connection like p2p software. either way, you are opening ports up and making yourself vulnerable once you have IM software on your network.
do not allow IM software to be used. either block the ports used by them or as is the case now where a lot of IM software are able to search for open ports and use them you have to figure out how to block them some other way. from what i know, IRC connects to a specific server when starting up. if it cannot connect to that server it does not work. so all you need to do is block that range of ip addr. of course there are other im clients out there
just to clarify i am saying all this about a office network. for home systems its up to you as you have mre control about what software is installed.
oh..yeah...another way to block IM would be to install sofware tracking on your users pcs and when they install IM software make sure its removed. but all this has to be done with the support of management. the problem is a lot of them are sing this software and dont like to be without it and they will try their best to stop you from blokcing it. thats the problem i ahve here. they always say they need the software for communicatin g with client and other stupid excuses. I alwasy have to explain and they will most definitely go to my boss. and the i have to spend loads of time trying to explain to both of them.
their arent any direct assaaults to ur comp if that is what ur worried about; but M$N'$ IM has so many cracks and holes that with teh right program i can get your ip, domain, and name; worst case with msn is for me to give u a bad script stuff
i agree that IM are security threats.Any one can use the flaws created by th IMs and dont forget the open ports they creats.
IM applications create no greater holes than nearly any other client software (web browser, email client, etc) in fact using a good content proxying firewall your IM applications can lose minimum functionality (loss of file transfer ability) and be more secure than other clients like email or web browsers as these deal with a wider range of content types and locking them down to essentially text only would render them more or less useless.
However, on a theoretical level... to the best of my knowledge there are no provable secure IM clients so with all things being equal, they will introduce new security issues.
catch
While reading through this thread my original intent was to direct this question to breakology , but after reading the rest, I believe I should ask all.
What about the recent attempts to tunnel the instant messenger services through a common port, such as port 80? How do you deal with this? How are you detecting it?
The main problem with Instant message progs is that the data your are sending is not encrypted, anyone stealing packets coming out of your network can read everything you include in the message. I know AOL IM uses TCP ports 5190 and 4443, if you want to prevent AOL IM, I'd disable those ports.
I've also read something on forced file download through IM, if it's not configured right.
Two things:Quote:
Originally posted here by Fallow Undertow
The main problem with Instant message progs is that the data your are sending is not encrypted, anyone stealing packets coming out of your network can read everything you include in the message. I know AOL IM uses TCP ports 5190 and 4443, if you want to prevent AOL IM, I'd disable those ports.
I've also read something on forced file download through IM, if it's not configured right.
1. several IM clients (like AIM) do support encryption.
2. Encryption is a bad thing from a security standpoint as it makes the users less accountable to the system custodians. Plain text data is more secure than the phone as it is more auditable.
catch
Let me add one point that may be overlooked. It's not necessarily the application that causes the most harm here but the intelligence of the average user of that application. (hint, hint)
It is not good practice under any circumstances to have IM ports open on your firewall, but as stated before if you lock everything down enough....I still don't like it. Sorry, I would say no to any user. BUt then again that's just me. ;)
my 2 cents.
Sorry if this is a little off topic for this thread, but I was wondering what peoples thoughts are on Microsoft's Netmeeting. We have a few requests to open our firewall to allow Netmeeting through to the internet. We have dug in our heels and said no to this point, but I would like some other opinions on the risks associated with Netmeeting.
Thanks
Cheers:
Security risks and M$ products....hmmm....let me think, synonymous? You be the judge.
I wouldnt open Netmeeting out to the internet if I had a choice. MS and security dont really go together. Unless I have proof that netmeeting is really secure then I would consider. Unless they have a really good reason to open the ports for netmeeting, I wouldnt allow it. If they really need netmeeting to connect to the internet. then setup a DMZ and a system to allow them to do that with nothing on that system except what they need. Also explain the risks to them and get them to acknowledge that accept that they will bear the risks associated.
You can "assume" there will be security threats with any P2P client or Instant Messaging clients. What you can do however, is lock out much of the vulnerability at the firewall. Also, you install and configure IM for your users. Create a local policy that will not allow them to make changes to the configuration. There are methodical ways to prevent IM from being a risk, but your best course of action will 'begin' at the user level. It has proven successful in our company to bring in end users in groups to a scheduled meeting and toss around some statitics and tell some stories to enstill awe and then let them know "how they can be an active influence to keep hackers out of our network".
well if u dont want to get infected just turn of the network........ keep it a colsed cercuid network....... not internet connection...... e_mails can be stored on a server Pc... that is connected to the internet..... Checked then frwded to the resipients........
who will only have sertain ports open.... this will make the lan "" almost "" inpermiable....... but also will limit it usefullness since e_mail will take more time to get to recipients......& so on
but it will surly be as secure as posible....... u can even limit the Hdd of mashines... then they can be scaned every 6H with an AV... ":I think this will be costy:"
plus u can take out all the CD's & FDD's & USB's from the terminals.. this will protect it internaly... just have a PC with these on the network if some 1 needs to get progs from CD's
or Fdd's... make it a charable PC... like Printers on LAN's ... also let every ..like 20 terminals have 1 FDD & CD enabled Pc... witch will be supervised by a security personel...
this could be a little extrem but it does the job..
this way no 1 from inside or outside can .... take out the data.... undetected.......
but it keeps 1 problem....... the ppl who r using them..... they can be tricked to give out info to ppl who must not have it...........
this is a problem that could be solved by......... ceminars ........ & so.......
but as it is said before..... ther will be "rat" who wont obay the rules
but with no direct connection it is possible to avoid this problem......
the Question is how far are you ready to go......