Warning to all MSN Messenger users

Security dangers of MSN Messenger, Yahoo Messenger, AOL Instant Messenger and ICQ. (Taken from a Govt Security website.)

Email has revolutionised the way we talk to each other. For many of us, snail mail is a thing of the past. However, the benefits of speedy communications have come at a price. The past few months have seen commercial and home email users assailed with malicious worms and viruses, underlining the dangers of sharing information online. The popularity of email, however, may soon be rivalled by a newer and more nimble online communications system, Instant Messaging (IM). At last count, there were 50 million IM users worldwide. Its exploding popularity threatens to open a range of new security issues - issues that the anti-virus and internet firewall vendors have been slow to address. IM is like email on steroids. Users hold online conversations in real-time, passing typed messages back and forth in a way similar to speaking on a telephone. IM software tells users who is online and provides for conferences between multiple participants. In a corporate setting, this has, in many instances, filled the gap between email and telephones, providing fast collaboration between many people in different parts of the business. Elsewhere, IM has become the latest toy of internet consumers, many of whom are enamoured of its recreational potential but ignorant of its potential dangers.

The increasing popularity of IM over the past two years threatens to take security breaches to a new level. The four most popular IM products in use outside the commercial world - MSN Messenger, Yahoo Messenger, AOL Instant Messenger and ICQ - are all free and all highly vulnerable to security breaches. They allow users to freely transfer potentially virus-ridden files and to conduct unencrypted chat sessions that are a virtual open book to any reasonably knowledgeable hacker. The security vendors, however, appear to have lagged behind the IM popularity curve and this is an issue weighing heavily on the minds of corporate users. Like email, IM enables information to be shared through file transfers, with all its inherent dangers. However, IM goes one step further; it enables peer-to-peer file sharing among members of a messaging group. In other words, all users in an IM club can potentially access the disks of the other members of the group. Thus, the hard disks of unprotected IM users are potentially at the disposal of any would-be hacker during an IM chat session. The latest version of a whitepaper titled Instant Insecurity: Security Issues of Instant Messaging, written by Symantec virus researcher, Neal Hindocha, identifies five main IM security threats - worm viruses, back-door Trojan horses, hijacking and impersonation, denial of service and unauthorised disclosure of information.