Slashdot Mirror
Blocking MSN Messenger?
Tekno2k3 asks: "As a sysadmin for a financial company, I have been tasked with removing Instant Messaging from our network. The only service that is being difficult is MSN Messenger. It uses many methods to get around being blocked. These include using port 80, using it's own DNS servers for lookup, using MANY logon servers, and using reverse DNS lookup. Has anyone had any success in blocking Messenger?"
Disable MSN Messenger via group policy.
Fire everyone who's caught using it. Eventually you'll fire enough people that they'll be afraid to open it. Just like the RIAA suing P2P users... eventually nobody will share because they'll be afraid of lawsuits.
Block port 1863 (tcp) at the router/nat box/whatever.
On your web proxies (if you have them), block HTTP messages with the mime type "application/x-msn-messenger" and turn off HTTP CONNECT support for port 1863.
Turn off SOCKS for port 1863, too.
I'm sure something is known about the messenger protocol... Find it, and find out how the authentication is done. Now, the problem just becomes listening in on new connections, and determining if its a messenger client authenticating itself. If it is, you could kill the connection.
:)
I don't know the tools that do any of that, though, but I'm sure they exist.
python -c "x='python -c %sx=%s; print x%%(chr(34),repr(x),chr(34))%s'; print x%(chr(34),repr(x),chr(34))"
Have you tried Packeteer? Many educational institutions use it to shape and manage traffic. They also have a help page describing how to control instant messaging including MSN.
Use a packet shaper. The one that comes to mind (proprietary, however) is Packeteer. These filter based on protocol (I think), so usually they can keep out resourceful programs like gnutella, etc.
Everyone is getting all technical about this but it's very easy. Just block messenger.hotmail.com. Walla msn messenger stops working. It connects to this central server to find out what server to use.
Hacker Media
This is a very inelegant approach, but I suppose you could block EVERY logon server at the router. There has to be a finite number of logon servers out there, so all you'd have to do is sit down for X amount of time with a MSN client and monitor outgoing traffic from your IP. Block each logon server as it comes up, wait for the client to reconnect, block that server, rinse, repeat.
Also, you could try looking for the location that the MSN client fetches the server list from and block that IP. If the list is stored locally, it'd be even easier to find and block those servers.
Of course, the above approach assumes that the router can handle blocking X amount of IPs. I wouldn't put it past MS to have hundreds or thousands of servers out there.
Then log all access to port 1863.
install msn messenger...and run it. See how it connects and then block that method, then re-run messenger and see how it connects and block that. wash lather rinse repeat until messenger can no longer connect.
/* oops I accidentally made a comment, sorry */
In addition to blocking MSN on the network, why not kill the software? This page discusses in gory detail the various methods of crippling/uninstalling/haxoring MSN software on the user machine, and making sure it won't come back. You have to be careful, as there are right ways and wrong ways to do it. My favourite method is to uninstall the software (made possible on XP via a convoluted run command), then place a blank file called "msn messenger" in Program Files. Installer won't work, and the user never goes into Program Files! It works.
Having the software right out of the computer is a good thing, because then it can't begin to pester the user or remind them of their painful inability to chat.
Blcoking 1863 does work, as I use that method myself.
? suckerid=bIcycleSExfiEND&referrid=1269
... etc... you get the idea.
The only problem is that they will move on to the next messenger that works (like Yahoo! etc).
If you wanted to be really insidious and get people to self police themselves, log all messenger messages and put a new section on your companies Intranet user customised page - something like "Hello xxxx, here are your last few messenger messages:
[bIcycleSExfiEND] w00t!
[cute^babe7599] SO BABEE U WANA C MY PIC?
[bIcycleSExfiEND] yeah - send it
[cute^babe7599] http://www.crackparty.com/showpictrojanisemachine
...
Please contact the helpdesk if you would like a complete log.
Have a nice day."
...and below that:
Here are your last few web accesses:
The real question here is why block MSN? What about people who use instant messaging for legitimate business purposes?? People chat on telephones, and I don't see many offices rushing to ban them. Fire unproductive people, and let the rest of us communicate.
One future, two choices. Oppose them or let them destroy us.
Hey,
you can block stuff like this using Group Policies (GPO's). I think you should start asking at news.microsoft.com at their group policy newsgroups.
If you have windows XP's as a member of your domain, you can easily block it using GPO.
Packet Filtering
_______
Death wish, n.:
The only wish that always comes true, whether or not one wishes it t
Get a MSN sniffer... the (very beta) one I used was called MSN666.
Tell everyone that you're sniffing MSN messenger traffic, and that you can trace it to a person esaily. Wait a day. Post a few innocuous messages between people on the noticeboard to prove it. Add a scrawled note on the bottom of the message saying "and , FatShaft42, you are one SICK Bastard! I'll be passing *your* messages onto HR!!" for maximum effect.
You are in a twisty maze of processor lines, all alike.
There is a lot of hype here.
Blame Enron and other such fiasco's.
Financial institution's have to record and hold all elctronic communications for years now. The specific number of years eludes me atm.
If you think some E-mails people send are incriminating, imagine what IM's traded around an office would expose.
It's much easier to stop the people from using IM services than to try to capture/record/log/preserve it all. At least for financial institutions which theoretically could face billion dollar lawsuits.
In college I worked as a projectionist. We had a stupid, paternalistic boss who worried that we were watching the movie when we should be keeping an eye on the equipment. His solution: disable the speaker in the projection booth! Of course that made things even worse, since projectionists kept running between the booth and the auditorium. The real problem was that some projectionists just had a bad work attitude, but the boss had no idea how to address that.
None of which really matters. I had no hope of changing the stupid speaker policy, and Steve has no chance of changing the stupid MSN policy. No it's no use arguing over it.
Incidentally, there is a legitimate reason to forbid MSN, AIM, etc. They're not secure. Some companies don't forbid IMing, but insist that you use special software and servers. Probably not the issue here, but worth mentioning.
Or not. On second thoughts perhaps not a good idea. Still, it's your call.
Now wash your hands.
I assume blocking that site to include its IP range, too.
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
Install Linux, MSN Messenger will go away rather quickly :)
I think it would be easier to lock down a linux box to prevent installations of gaim, Gabber, etc than it would be to putz around with your firewalls trying to kill MSN Messenger.
If you allow www, you can't stop all chats. You can pretend, but you can't do it. Heck, email can be used for such as well. How about making internet access a priviledge that only those have that need. Though im can be used to boost productivity too.
world was created 5 seconds before this post as it is.
I thought financial people were supposed to be more socially able than technological people. Don't your managers understand the concept of "talking to people abouth things they should and should not do during work hours?"
I now it's not generally accepted in most larger companies, but I always question bad and lazy management decisions like this one. Management is usually paid generously enough to compensate for the occasional difficult talk with a bothersome employee. Besides, talking has a lot less negative (or even positive, depending on the person doing the talking) effect on the work atmosphere and might alleviate a general feeling of "us against the managers" in employees.
You may be able to block the win32 client, but that does not stop employees from using services like http://www.wbmsn.com/ (MSN) or http://go.icq.com/ (ICQ) for their IM needs.
Alternatively, a mass block of Microsoft's IP address range(s) should help stop people being able to connect (and you'll also kill hotmail, passport and a lot of other of their useless services with the same stone).
I used group policy software distribution to force the install of Windows Messenger on all computers. Windows Messenger is a slightly different version than MSN Messenger but it can also connect to the IM system of Exchange. We use that in house as our instant messaging system.
When once installed you can use Group Policies to lock the Windows messenger down. With registry keys embedded in the policies you can disable file transfer, video chat and even outside communications (to the internet, not intranet) of the client.
We disabled file transfer to avoid viruses slipping in via this way.
If I am correct you can even set Windows messenger to have priority on MSN messenger, thus disabling the MSN version. In this way you should have full control over the IM system. Check the knowledge base and technet for the necessary info. If necessary, contact me.
Disable via the registry with login scripts
8 1/
/ Gr oup%20Policy%20Registry%20Editor.htm
http://www.winguides.com/registry/display.php/9
Or group policy
http://www.subvers.com/technobabble/html/tweaks
If you have wildcat machines that people just setup on their own, you have a larger problem.
Conformity is the jailer of freedom and enemy of growth. -JFK
Shoot the Messenger .
Environmentalism is the new Victorianism. Everyone ties on a green corset and pretends we're virtuous.
I did this with my old company. They had a very strict firewall policy, and to get a port open, you had to get through higer management.
Geez. Try baking the sysadmin some cookies, give him a case of Guiness/Bawlz, or take the poor guy to lunch.
Iptables (as well as any decent firewall) can match packets containing arbitrary strings. Tcpdump a couple of Messenger handshake sequences and look for some common ids.
Edgar
WindowsUpdate.com?
support.microsoft.com?
Office Tools on the Web? (clipart, template galleries)
Do you, perchance, mean "voila," the French word? Yes, I know it should have accents on it but I'll be damned if I can figure out how to type them.
Walla indeed!
Stick Men
Damn! It isn't even pronounced like that! Why is literacy becoming a lost art? Get thee back to school, moron!
I block MSMessenger without any problems with the following rules:
ipchains -A input -p TCP -b --sport 1863 -j DENY
ipchains -A input -b -d 64.4.13.0/24 -j DENY
now the extremely persistant Yahoo IM is something I still haven't nailed down yet.....
Don't mean to be rude but this is a case of RTFM.
We manage MSN IM use and all the ports are listed on the M$ Technet.
Assuming you are on a domain and not a workgroup, its not hard to lock down pcs to only run 'approved' apps..
If you dont know how to do that, then you have got some basic windows admin skills to learn.
---- Booth was a patriot ----
Moron,
"Tasked" is not a word.
TASK is a noun. You do not "task" somebody, you ASSIGN A TASK to them.
Please smack yourself several times in the head with a large crowbar until you understand english.
In this case being a finance institution, they have to log all conversations or possibly face fines.
In 99% of normal businesses, its NOT needed to have outside IM access, peroid.. If you need IM communication between your employees, great, then you use a secure internal IM setup, with no outside server access.. For people outside the firwall like sales guys, they vpn back in.
Its not in best business interest to let you talk to your wife, or friend down the street about where to go for lunch. Regardless of what you might think.
Phones the same, many dont get outside line access. Its ONLY Internal calls that they can make, unless they have a business case to get 'out'.
---- Booth was a patriot ----
This is how I blocked MSN Messenger... bought SuSE Linux 8.1 professional. Installed it and no more MSN Messenger for me!!
Use policy editor and apply it to the entire domain.
---- Booth was a patriot ----
The only way to block it is to shut down ALL network traffic, then allow only the explicit traffic you want. I'm not sure about MSN, but AOL's AIM server protocol binds to *every* port on the AIM server. Just because there is a "preferred" port means nothing - a user can simply change their AIM client to use *any* other port on that server and will get the same result.
If you want to block IM, you need to block *everything*, then allow access only as requested. It's a network management nightmare. You allow port 80, except to certain AOL hosts which are AIM servers, for instance (you might not want to block aol.com, but the AIM servers are *somewhere* in the aol.com domain).
See where this is headed?
You just need to block access to port 1863, the entire subnet 64.4.13.0/24, and gateway.messenger.hotmail.com. It will then attempt to tunnel through port 80, so have your web proxy stop it there. This will stop the ability to authenticate, and works for us with Win98 and XP clients, haven't tried with other ones. Interestingly, the built in XP client was easier to stop, it was the Win98 version that took extra measures.
Well I'm the doctor and I say you're dead, so shut up and take it like a man!
...Unless all Internet access is blocked, to prevent any IM from being used. Remember, you can always SSH to a home server (using any port you want to configure) and start an IM client via the encrypted tunnel. If you are going to check all data transfer on all ports to/from the Internet, you might as well just block it all. It's the "clever" end-users that know how to do this that are your real worry.
Can You Say Linux? I Knew That You Could.
I like sysadmins that run Windows shops and think that since they are the only ones that know what they set the Administrator password to, their machines can't be modified. They're funny.
Anyone who thinks I'm going to work on Windows without cygwin, JSPager, xemacs, etc, has another think coming. Sysadmins are *support* personnel. They're there to facilitate work getting done. They aren't supervisors of said personnel, and controlling behavior is certainly not in their baliwick unless expressly handed down by management.
That said, I've had grand old times with IT folks who don't feel the need to try to be assholes.
Finally, I don't use any form of instant messaging at work, because I find email and phone to be more convenient. But I *have* done software development before with another person on the other end of an ICQ connection, and if that's the most convenient way to do work, IT should definitely not be trying to be a pain in the ass about it.
May we never see th
Ding Ding Ding! Correct, IT is there to HELP. Same exact thing goes with contractors, they are there to help the full time employees. As a contractor in IT departments, I can tell you that companies, contractors and IT departments are often very broken in how they try to get stuff done.
:).
NOT EVERYTHING IS A TECHNICAL ISSUE. Policy is as important as technology. Lazy management makes management problems (lack of control and accountability) into technical problems because they are too weak to deal with the issues on their own and want IT to do it for them.
Also, FlashDesktops is far better than JSPager
JSPager is free. :-)
May we never see th
I'm not sure, but I think you're talking about Virtual Desktops (Pagers in *nix).
For my money, and yes I spent 20 whole dollars on it, cause it was TOTALLY WORTH IT, Vern was the hands-down winner.
Even though I'm now on Linux, the pagers still pale in comparison to Vern on Win2k (which, again, I no longer use.)
-A
Web Based MSN proxies. Yes it's not secure, but it does work.. sometimes.
As Administrator, go to 'Services' in the Control Panel. go to 'Properties' for Windows Messaging, and uncheck the box that says something like "Turn on at startup." (I don't have an XP machine in front of me right now.) That's really all there is to it.
...if you shot all of the standard ones. Probably operating over GRE or something your firewall doesn't know exists (which is a good reason for French Foreign Legion firewalling rules, but it's real work to nail down everything even so).
Got time? Spend some of it coding or testing
In financial institutions, you have to log all communications as a matter of law. If there's no logging facility for an IM method, that method has to be blocked or eventually people will go to jail.
Insider trading rules are a bitch but if you can't deal with everything being read by management, don't work for a brokerage or similarly constrained institution.
That turns off the Windows Messenger serivce. It sends administrative messages to machines over NetBIOS.
MSN Messenger is not a service, it's a user program.
However, if you set Windows Messenger to manual or disabled you don't get that annoying spam that's so popular now.
Every IM client I've ever used can log conversations.
May we never see th
Give everyone Jabber / PSI, and your local server. Communications over Jabber can be encrypted, logged, and secured enough to meet federal mandates. There are gateways that can be installed to allow people to chat with the outside world (logged, of course). And, most importantly, few enough people use Jabber that most chatting will be going on within the company, not with outside parties.
IM is a powerful alternative to phone calls and e-mails for getting work done. It shouldn't be taken entirely out of a workplace, just put in its proper (and legal) place.
- C
The ______ Agenda
If your corporate policy is to ban Messenger, then a few firings will go far.
As far as I know, Snort should be able to recognize Messenger's packets' fingerprints and block them.
I had successfully completely blocked MSN Messenger from working... And the same goes with OutLook Express to Hotmail.
Unfortunately, there are some consultants who can only talk to each other (even whilst in the same room) via MSN Messenger, so I had to reenable access to them.
C'est la vie.
-- The universe began. Life started on a billion worlds...
-- Except on one where stupidity was there first.
Too bad I just now saw this. Anyone using Windows or MSN Messenger on XP has probably gotten those stupid spam messgaes. To disable them, just block anyone on your address list. If they want access, they can just email you requesting access. Works great!
either way its not overly hard, I run and iptables based firewall on debian. I restrict both incoming and outgoing traffic, I also have a filtering proxy for all web traffic (squid and dansguardian).
Anyway, msn didn't like working thru my proxy setup so I had to open tcp port 1863. So, restrict outgoing traffic by destination port and source ip and you should take care of most nastiness :)
---- Put Sig here:
Yes, for the client, but can you log the traffic centrally? I think a logging system that required each user to hand over the incriminating data at the end of each session would be considered inadequate, even in corporate America.
Virtually serving coffee