myspace IM at work

IM curious if someone has 'myspace IM' on one of the workstations at work (small office consists of two desktops and one notebook). Some of the employees like to use 'myspace IM at work'. Couple questions,

#1. Does it post any type of security threat? If so, how?

#2. Im curious if someone is chatting with someone inside the office using "myspace IM" can the DATA (traffic) inside the office can it be sniffed by a packet sniffer from someone outside of the network? Basically, the other person their chatting with on myspace IM? All help is greatly appreciated.
CN22

Well CN22,

My personal view is that "Myspace" is actually "Theirspace" and has no place in the office which is "Yourspace" and your equipment and time?:jester:

Myspace has been attacked, and all social networking sites are attractive distribution centres for bad stuff in general. Individuals' accounts are not well regulated to prevent this.

Basically, they are so large and change so rapidly it would be a near impossible task.............. a bit like trying to moderate a large IRC network?:eek:

IM is another communications conduit along which you can be attacked by worms, spyware and God knows what else. Main problem as I see it is that people are probably more relaxed in their "community" and so are less vigilant?

One other concern I would have is regarding regulatory compliance, and the concept of legal "discovery". I haven't seen any cases but I would strongly suspect that external IM would be considered an "electronic record" that you might be required to produce?................a real PITA if you don't monitor it.

Just my £0.02 :)

if it's just inernal IM messaging
get MS Communicator ...........

Just finished a contract with Unilever, and they use it, and they DO have quite a few employees :)

just so long as you are on the same domain
or in the same forest
or in the ......................... you get the picture
YOUR data stays on YOUR network

then snuff out the opposition :eek: :D

I've got a question.. Why do people use myspace? I mean haven't they heard of what happened? people all over the world use their real live names/locations/ other things.

I mean why can't they stick to something like this, a forum.. Or the tried and true email? or messenger? I mean, with that alone you can talk to each other and see each other perhaps not in real life but that's at least something to do then read bulletins all day.

That's just my opinion.

Here is a short article from Panda on MySpace security threats:

http://www.snpx.com/cgi-bin/news55.c...4329669?-11434

:)

More here:

http://www.snpx.com/cgi-bin/news55.c...4194448?-14215

http://www.snpx.com/cgi-bin/news55.c...13948374?-1313

The workstations have a lot of spyware & malware etc... on them and they need to be cleaned up. I would just uninstall it and block them from accessing www.myspace.com but this is in a doctors office with only 2 workstations and a notebook. I really don't want to get that 'strict' with the 'level of security,' also it would cause them to complain. "so to speak," and think I was doing it just so it wouldnt be on the system little do they no it can make the system/network worse.

Hi CN22,

Quote:

---

this is in a doctors office with only 2 workstations and a notebook

---

Doesn't HIPAA apply to it? Tighten the whole lot up and blame it on the boogy man :D Blaming stuff on "Nanny State" Government requirements is usually a good move.

This site may help?

http://www.cms.hhs.gov/SecurityStandard/

Quote:

---

Doesn't HIPAA apply to it?

---

I never heard of it until now. ;) Anyways, I guess it does apply. So basically, their is no other option or choice but to remove it from the office workstation? Pretty interesting stuff.

Hi CN22,

I know it may sound a bit "off" for a UK type to be pointing out US legislation, particularly as I have never had to apply it or study it in detail, but a lot of this legislation is similar in both our countries, so I keep my finger on the pulse? :D

Seriously though, if ANY patient data passes through those computers you should lock them down as best you can.

:)

Quote:

---

Seriously though, if ANY patient data passes through those computers you should lock them down as best you can.

---

Good point. Will surely do what I can do to secure the network. Its pretty small anyways not like it's an office of 30 workstations or anything like that.

I would look into aim pro it works with outlook :-)

oofki,

After you have considered regulatory compliance and what the effects of a compromise of patient confidentiality would have on this medical practice, you would not really recommend that would you? :shocked:

And that is before the lawyers and other reptiles start to go into a feeding frenzy.:eek:

This is a regulatory high security environment............... you cannot behave like a normal commercial environment?

A bit like the Financial Sector who have Sarbanes-Oxley?

I would guess I would go for:

1. A strict AUP that at least feigns compliance.
2. A security policy that supports this, and the regulations.
3. A lockdown setup that enforces #1 & #2 above.
4. A monitoring system that checks for infringements of the above.

This is a medical practice........... I guess the partners are on at least $200,000 a year? In that case you will be supported, trust me ;)

iptabels -L -n DROP all -- 216.178.38.116 0.0.0.0/0

or

ip route add 216.178.38.116 via 127.0.0.1

The3ntropy , I am unsure of what you mean; is it that you are drunker then I ?
Oh wait, I'm sober! ( remind me to fix that. )

Providing these commands can be used on the router in use ( I think from a prior thread it may be a Netgear wireless? ) Oh well, let's cover these anyway.

Quote:

---

iptabels -L -n DROP all -- 216.178.38.116 0.0.0.0/0

---

( note: spelling counts using command line -- it is iptables, not iptabels )

I read this as:
list iptables entries ( iptabels -L ), in numeric format (-n), disjointed target from unknown chain ( DROP ), all protocols ( all ), disjointed hyphens ( -- ), net-address ( 216.178.38.116 ), then disjointed address ( 0.0.0.0 ) that has a netmask of 0.0.0.0 ( /0 )

That makes no sense. I think what you meant was something like
iptables -I FORWARD -d 216.178.32.0/20 -j DROP
or
iptables -I FORWARD -d 216.178.32.0/20 -j REJECT
These would add the rule to the FORWARD chain.
Notice the Netrange used, this discussed more below.
Notice too I did not use the -A, but the -I.
The reason for this is we do not know what rules are already in place, and appending the rule to the end of the chain ( using -A ) may be moot if there is already a rule before it that allows the forwarding of the packets. Inserting the rule ( using the -I ) without a rule number specified places the rule at the head of the chain. This should work, providing the default FORWARD policy is DROP!

Of course, a reboot would nullify the addition to iptables unless you had saved it in some manner, but that is another topic.

Quote:

---

ip route add 216.178.38.116 via 127.0.0.1

---

This might be a useful tactic during a specific DOS attack, but you are limited to a specific address here, that of profile.myspace.com. It does not stop anything else from Myspace from being accessed.

If you want to use routing tables, why not something like
ip route add prohibit 216.178.32.0/20
or better yet
ip route add unreachable 216.178.32.0/20

These would block a bit more of the Myspace netrange?

you say tables, I say tabels
alias iptabels='iptables'

last night I felt helpful so was reading some stuff on here, first line was a sad attempt to drop all packets from the root myspace ip

second was just null-routing all packets to the ground; if you 'prohibit' or 'unreachable' packets it takes more cpu time to make the decision of what to do with the packet (from my experiences at least with heavy DRDoS attacks)

Actually, I am on vacation, so I say
pour me another drink!:drink:

I have to go over there and setup the wireless 'security' on the netgear router and also, clean out both PC's and notebook. Since they all run very slow and seems to be infected with spyware/malware etc...

also, have to install a label maker on workstation 1. Have to be there at 12:30 it's 9:45 here.

I will post later results.