How do I use instant messaging?

Backdoors: Instant Messaging via Other Means (HTML)

Some IM applications have moved to HTML-based integrations with their network. The reason is obvious: This is a way around the explicit IM protocols being blocked on corporate networks. Employees want to keep using their IM tools for personal or professional reasons, and they are finding workarounds. The obvious counter to this is HTML content filtering, especially at the gateways to networks. If your policy disallows IM, make sure the content-filtering blacklists are sensitive to IM IP addresses and communications. Many IM applications will actively scan for ports that are available on which they can piggyback communications, meaning that if you have any permissive rules for communications, the IM application will find it.

Instant Messaging

Instant messaging (IM) systems can be very useful. It allows immediate and convenient communication between two parties. If you use an externally administered system, then you don’t have to worry about managing the infrastructure. But along with the convenience and ease of IM come many potential threats. With IM, you have to worry about information flowing in clear text, Internet links in messages, file transfers, and social engineering.

Information sent via IM is generally sent in clear text. There are programs available that can be used to encrypt IM traffic, but these are usually separate add-ons. If someone is sending sensitive information via IM, that information is vulnerable to network sniffing.

You have to be very careful with IM systems because you never really know who is on the other end. IM systems allow you to post Internet links inside of messages. This can be very dangerous. The links you receive could direct you to malicious sites. Many e-mail systems can scan messages for dangerous links, but IM generally does not do this. IM clients may warn you about clicking links in messages, but they will not block them.

IM clients also allow file transfers. Usually, these are just pictures or something harmless. But that’s not always the case. Sometimes, these files are malicious executables. IM clients do not scan messages to see if these files are malicious or not, by default. It’s up to the users to use their best judgment.

Social engineering attacks are also common with instant messaging systems. Because of their relaxed and informal nature, IM systems often give people a false sense of familiarity and trust. You must still remember that you do not really know who is on the other side of the connection. If you send confidential information through an instant message, you need to be aware that you could be sending it to anyone.

There are several steps that can be taken to secure instant messenger usage. First, you can prevent the usage of external IM clients. Most public e-mail clients require users to log into a central authentication system. You can block users within your network from accessing this central authentication server. If you need IM within your organization, you can set up an internal IM system.

If preventing the use of external IM systems is not feasible, then you should do what you can to protect the users and client systems. You can use an add-on application to encrypt the content of your IM messages. This will help protect against network sneaking. IM encryption applications generally require the use of a shared key. The key is usually exchanged the first time communication occurs. Second, you should enable the file transfer protection settings in the IM client. Certain antivirus applications also have plug-ins for IM clients. You can use these to scan transferred files for malicious content. Finally, end-user education is essential. You can educate users not to click links in e-mail messages. You can also educate users on the dangers of instant messaging in an attempt to help prevent social engineering attacks.

Instant messaging and well-being

IM has become one of the most popular and prevalent forms of online communication, especially among young populations (Fox, Rosen, & Crawford, 2008). Prior studies point out that IM is mostly useful for maintaining existing relationships and thus has positive effects on subjective well-being (Ramirez & Broneck, 2009; Valkenburg & Peter, 2007a). Specifically, Valkenburg & Peter (2007a) found that by increasing the time spent with existing friends and the quality of these friendships, IM use strengthened relationships among adolescents and enhanced their well-being. These prior findings lead us to propose the following hypothesis:

H1: IM use will be positively associated with subjective well-being over time.

IM Clients

Instant messaging is perhaps the dominant means of real-time communication on the Internet today. IM’s roots can be traced back to the Internet Relay Chat (IRC) networks, which introduced the chat room concept but did not track online presence and never reached the popularity of IM. Just as IM is the next logical step from IRC, voice chat is the next leap from text-based chat. Most of today’s most popular IM clients have included voice functionality, including AOL’s Instant Messenger, Yahoo! Messenger, and MSN Messenger. Skype took the opposite approach and created a chat client that focuses on voice as the star and text chat as an afterthought. Even Google jumped aboard the IM bandwagon, releasing Google Talk. Let’s take a look at these clients to see what makes them similar, and what makes them different.

AIM, AOL’s IM service, surely wasn’t the first on the scene, but it has the largest base of users. Initially AIM was limited to users of the AOL Internet service, but eventually it was opened up to the Internet as a whole. With the addition of a proprietary voice capability in late 1999, AOL was a VoIP pioneer of sorts. (although voice chat was first available through Mirablis’s ICQ). Yahoo! Chat jumped aboard the voice bandwagon soon after, and Google’s more recent client has included voice from the beginning. In 2005, Yahoo announced interoperability with Google and MSN (who also has a voice chat plug-in for messenger that is also used with its Live Communication Server product). In addition, Microsoft’s popular Outlook e-mail client (and entire Office suite in the case of LCS) can be linked to Microsoft Messenger. Also worth mentioning is the Lotus Domino IM client that competes with Microsoft LCS in the enterprise instant messaging (and presence) space, as well as Jabber, which can be used to tie together both public and private IM services using the XMPP protocol.

Google Talk is the newest comer to the IM game. Though Google Talk is still in its infancy, it stands to succeed due largely to a philosophical stand point, embracing open standards over proprietary voice chat. Google Talk aims to connect many different voice networks over a series of peering arrangements, allowing users to minimize their need to run several IM clients. Like Skype, Google seeks to bridge traditional phone calls with Internet telephony, promising to federate with SIP networks that provide access to an ordinary telephone dial tone. Google recently released a library called libjingle to programmers, allowing them to hack new functionality into Google Talk. It will be interesting to see where Google takes Google Talk in the future.

V.C. Instant Messaging (IM)

Instant messaging provides the ability to send textual messages, usually short ones in rapid sequence, between business colleagues and personal friends. It permits a real-time conversation medium without the use of a telephone. In addition, IM provides an indicator that shows whether or not the other person is on-line and available to communicate.

Instant messaging is an e-mail-enabled application in two ways:

Presence indicator within inbox. When you are reviewing the list of new e-mails in your inbox, your IM service can indicate whether the senders of recent e-mails are on-line at that specific time. If so, you can initiate an IM session to ask a specific follow-up question about the e-mail you have just received.

Presence indicator within an e-mail message. When you open an e-mail message from a colleague, a presence indicator could be embedded into the message that shows the availability status of the individual at that specific time. The recipient can click on the presence indicator to automatically initiate an IM session with the original sender.

Check out ICQ, AOL Instant Messenger, Microsoft's MSN Messenger, or Yahoo Messenger for personal use. Corporate offerings are available from Lotus Development, Microsoft, and PresenceWorks.

Instant messaging

Instant messaging allows two or more users to communicate with each other via real-time “chat.” Chat may be one-to-one or many-to-many, as in chat groups. In addition to chatting, most modern instant messaging software allows file sharing and sometimes audio and video conferencing.

An older instant messaging protocol is IRC (Internet relay chat), a global network of chat servers and clients created in 1988 that remains very popular even today. Other chat protocols and networks include AOL instant messenger (AIM), ICQ (short for “I seek you”), and extensible messaging and presence protocol (XMPP) (formerly known as Jabber).

Chat software may be subject to various security issues, including remote exploitation, and must be patched like any other software. The file sharing capability of chat software may allow users to violate policy by distributing sensitive documents; there are similar issues with the audio and video sharing capability of many of these programs.

The Problem with Instant Messaging

In 2007, the SANS Institute identified IM as one of the top security risks (www.sans.org/top20.com). Some of the reasons given for this designation is that its widespread use could result in increased attacks. These attacks could include variants of e-mail worms, malware, and botnets (software running on collections of zombie computers that are used in coordinated attacks; we discuss botnets in greater depth in Chapter 10).

By default, most of the IM products are configured to stay active all the time, running in the background, and broadcast that the user is online even when the program interface is closed. This wouldn't be so bad except that the IM software also allows for sending of files among users, which means it's not that difficult for a knowledgeable hacker to use this open channel to transfer viruses hidden in Trojans or other unwanted “gifts.”

Although IM vendors are pretty good about releasing fixes for these security flaws when they become known, new exploits are continuously being found, and many users don't update their software often. They could remain unaware of the problem until they are victimized. Network administrators and other IT professionals should stay current on these issues by subscribing to security newsletters and regularly visiting security bulletin Web sites. They should then work to educate the users in their organizations about security vulnerabilities and see that updates and fixes are installed when they become available.

CyberStats

Another possible security problem is the IM log that records the content of online discussions. These could be accessed by a hacker, exposing private conversations.

In fact, IM vendors generally admit that their products are not secure, and in their end-user agreements they recommend that you not use them for sensitive communication. Nevertheless, many business users discuss personnel matters, financial and budgeting decisions, marketing strategies, and other confidential information via instant messages.

Another problem with IM software is that there is no reliable authentication mechanism to verify that a person sending you a message across the Internet really is who he or she claims to be. Anyone can set up an IM account using a false name and information. For this reason, instant messages are also a popular way for pedophiles, scam artists, and other criminals to make contact with their victims and get to know those they target for their crimes.

Instant messaging and chat

Instant messaging and chat are technologies that create the possibility of real time text-based communication (no sound or video) between two or more participants over the internet or an intranet. Chat and instant messaging are synchronous forms of communication, i.e. they happen in close to real time. E-mail, forum, discussion, etc. are asynchronous and it is not expected that messages posted will be received or answered immediately. Some systems do however allow offline working.

Standard free instant messaging applications offer functions like file transfer, contact lists, and the ability to have simultaneous conversations. These may be all the functions that a small research team needs, but larger communities will require more sophisticated applications that can work together. Enterprise-level applications include software such as Jabber, Lotus Sametime, Microsoft Office Communicator, etc., and can be integrated with other systems such as workflow. Such services have additional features, such as the immediate receipt of acknowledgment or reply, group chatting, conference services (possibly including voice and video), conversation logging and file transfer.

There is a long list of instant messaging applications; some widely used ones (with over one million users daily) include QQ, Windows Live Messenger, Skype, AIM, Jabber, eBuddy, Yahoo! Messenger, IBM Lotus Sametime, ICQ, Xfire, MXfit, Gadu-Gadu, Paltalk, IMVU, Mail.ru Agent, Mettbo, PSYC and Bigant.

Sakai has a built-in chat tool. Members of a worksite can open the tool and join an existing chat thread or start a new one. Messages from different users are coloured differently to make it easier to follow a conversation. Access Grid uses a Jabber tool for text conversations ‘aside’ of the main AG streams; room operators often find this useful for discussing technical issues.