Instant-Messaging Attacks On the Rise

Ant writes "CNET News.com and ZDNet News report that security attacks over instant-messaging (IM) networks became more prevalent in 2005, according to a new study. MSN experienced the largest number of IM security incidents in both 2004 and 2005, while year-on-year incident growth rates were largest on AIM."

Comments

Thank God for IRC

[IEBEYEBALL]

Amen.

Re:Thank God for IRC

[SchrodingersRoot]

Thank God for IRC?

"Hacker groups have large (compromised) server farms to experiment with propagating exploits. They hide Trojans and viruses, and control these botnets via IRC,"

You're one of them, aren't you?! ADMIT IT!!

Just remember, IRC isn't safe, only safer

Re:Thank God for IRC

[Mortimer82]

Indeed, a strain to write and read, and now I slip into the realm of what is arguably off topic...

Leetspeak does not impress me at all, in fact, if I see someone genuinely using it, I'll just assume they are immature individuals who have yet to grow up, and consequently I treat them as such. In my opinion, Leetspeak is also a complete waste of time, my typing is bad enough without me training myself to do it incorrectly, what I am trying to get at is that leetspeak is not only arguably lame, but it is in fact counter-productive.

Many people, especially IT workers, have probably never been on a typing course, but despite this, many may be considered to be exceptionally quick on the keyboard. You see, the brain is remarkable in that forcing yourself to do something repetitively sets up neural pathways, and one finds themselves able to do the same thing that they initially found to be complicated or difficult, with almost little or no effort whatsoever, this is called "training". So, all these leetspeak people have successfully trained themselves in a skill that has absolutely no value in the workplace, but even worse, good language and typing skills, which would be useful in the workplace, have probably been sabotaged by them repetitively doing it wrong. As an example, earlier today /. linked to a White Dust Security article. I am no English teacher, but it was absolutely abysmal English, assuming that the article's author's first language is English, it would not be suprising that part of their shocking English skills (or lack there of) could be directly attributed to their "leetness" at leetspeak.

That's just one reason I don't care much for IRC, the other is that many people on IRC, seem be far to, as a Vulcan might say, "irrational".

Re:Thank God for IRC

[Anonymous Coward]

Doesn't really matter where you go, what client you use, what precautions you take. In the end if they want to mess with you they will. The only secure computer is one that never has any exposure to a network of any kind. It's kinda like getting mugged, it could happen any place for any reason, regardless of how big you are or what weapons your carrying. IRC is where these little black hats propagate anyhow, if anything your less safe there. You more likely to run across someone nasty, and hey now they have your ip without ever having to talk to you in the first place... =)

Re:Thank God for IRC

[IEBEYEBALL]

That was my point. IRC is a safer, simpler, more robust (imho) protocol. It gets the same job done as IM does. And yes, it can be abused just like any other Internet protocol, unfortunately. Sure, someone could trick you into visiting a website if you are stupid enough. And no, they don't always get your IP address: on some networks you can mask you hostname/ip address (Undernet comes to mind with it's +x mode.) And no, I am not one of them. Those are LIES! ALL LIES!!!!!!

Re:Thank God for IRC

[IEBEYEBALL]

I don't see l33t sp34k at all on irc these days. Of course I guess it depends on which channels you hang out on.

Obvious

[heavy snowfall]

Obvious, they go to where the easy targets are. As a plus: When you infect a computer connected through AOL the chance of discovery and subsequent removal is smaller. How many granny's on AOL run a firewall+spybot+antivirus etc?

Re:Obvious

[dc29A]

Obvious, they go to where the easy targets are. As a plus: When you infect a computer connected through AOL the chance of discovery and subsequent removal is smaller. How many granny's on AOL run a firewall+spybot+antivirus etc?

I doubt it's only AOL. How many non AOL average Joes use a firewall, antivirus and antispamware? The vast majority of home computer users don't give a damn about or are totally clueless about computer security.

That and everyone and his mother running with a root account so once you get a user clicking on a "OMG COOL PICTURE HERE CHECK IT OUT" spam, their PC is a newborn zombie.

Re:Obvious

[Pneuma ROCKS]

The problem with companies like AOL, EarthLink, etc, is that they give a false sense of security to their users, claiming that they will be protected from everything. Not a day goes by I don't see their stupid TV commercials and feel sick.

If people want to be really safe using the web, they need to be conscious about their computer and their security. This is a major drag for average users, but there's no other way. Even if the programs that access the web were 100% safe, there are ways of attacking users by exploiting their ignorance and gullibility. Teaching people to be more security-aware makes it a lesser problem to have insecure applications.

Re:Obvious

[Billosaur]

How many granny's on AOL run a firewall+spybot+antivirus etc?

Don't limit it to grandmother's in their retirment homes in Florida; most of the general public is none too swift, nowhere more evident than in the tech field. I harp on this all the time. People need to use some god-given common sense, but that's the one thing lacking. There's nothing wrong with using whatever IM system you choose as long as you're smart about it.

Re:Obvious

[Anonymous Coward]

Actually, my Grandma has the Security Edition of AOL 9, which means there's a firewall, virus protection, and spyware remover.
Of course, keep in mind that that's all AOL's protection.. so I made sure there was a hardware firewall (router), and am pushing for them to stop using AOL alltogether (they're paying for DSL too.)

Re:Obvious

[ozydingo]

Didn't you see their new ad? The new and improved AOL blocks all spyware, foils all hackers, and does you up the butt all with a single mouse click!

Re:Obvious

[Anonymous Coward]

Obvious, they go to where the easy targets are. As a plus: When you infect a computer connected through AOL the chance of discovery and subsequent removal is smaller. How many granny's on AOL run a firewall+spybot+antivirus etc?

#1 Firewalls don't block instant messages
#2 AS/AV only works "after the fact"
#3 Real security comes through OS access control, not your silly software based security
#4 Get your grandma on a user account

Re:Obvious

[heavy snowfall]

- My grandma doesn't use AOL.
- She uses linux, user account.
- iptables, ids.

I was talking about your average grannies in FL. (Their neigbours are probably the spammers exploiting their boxes..)

Re:Obvious

[Kesch]

I know I'm secure when I use AOL. The spamblockers mean that I can auto-enter my email adress into every field on the net. Plus I can download anything becuase I know AOL will stop it if it is harmful. I even switched to an admin account because I find it easier to work that way. Hell, I didn't even worry about the WMF exploit because I've got the AOL security center.

But you know what the best part is? After using AOL this way for a month, all I have to do is boot up my computer, and I will be barraged with tons of free porn.

Re:Obvious

[laffer1]

Any granny with aol 9 has a firewall and antivirus. Now they may be bad ones. AIM exploits are NOT limited to aol customers though. Aol and third parties make AIM clients for the general public as well. Thats the real target area. Hell every mac ships with an AIM client (iChat).

The trick here is to watch what the 12 year olds are using. They will click on anything and prefer IM conversations to email like my generation and phones likes my parents generation. I run an et clan and most of my members use MSN IM software but also have one other service. Europeans often have ICQ, americans have AIM and most others seem to have yahoo or something else. All of them use xfire for finding games... i've always wondered if that is spyware.

Re:Obvious

[ih8bills]

All those of us who DO know security can do is try to make as many people as you can AWARE of the risks --try to explain some of the possible consequences of NOT practicing basic security measures. I personally have everyone I know come to me --if they are having computer problems (popups/slow performance,etc) so I can help. It's a pain,sometimes trying to get across the fact that what they are experiencing is PREVENTABLE with a few, largely free, software programs & some basic maintenance. Once they discover that they can fix it themselves --if they try just a little-- they usually figure out just how much help is available. It is usually self-sustaining from that point... especially when I stress that EVERYONE is SAFER if we all do just a little bit of daily housecleaning. Most people don't want to be a problem-- they just need a little "push" in the right direction. I, in fact have a 'standard first email' that I send to everyone I know who is just getting into the internet, containing links to pages/organizations/security software/newsgroups that I think are helpful & honest.

Simple Fix

[jimbolauski]

FTA:
    "We recommend that customers do not click on attachments or links in IM without confirming their validity with the person who sent them"

When is a patch going to come out for this problem, it seems to have been plaguing the net for quite some.

Re:Simple Fix

[randyflood]

What is interesting to me is the number of new users to IM services fall for Bots that chat with them using a perl script or whatever. Now some of the worms using IM are chatting with the users first in order to work better:

http://news.com.com/New%20IM%20worm%20chats%20with %20intended%20victims/2100-7349_3-5984845.html

Re:Simple Fix

[meringuoid]

"We recommend that customers do not click on attachments or links in IM without confirming their validity with the person who sent them"

When is a patch going to come out for this problem, it seems to have been plaguing the net for quite some.

Once AOL start requiring (for 'technical' or even 'security' reasons) a set-top box to place on top of the monitor. This will track the location of the user using an inbuilt digital camera. Every so often it will cause a popup message containing suitably spammy text and a linked executable. If the user clicks it, the box deploys its payload: a hollowpoint between the user's eyes.

Think of it as evolution in action.

Re:Simple Fix

[Phisbut]

When is a patch going to come out for this problem, it seems to have been plaguing the net for quite some.

We've been trying to patch human beings for quite a while now, but they just don't seem to stand still. We'll get to it though.

Re:Simple Fix

[SchrodingersRoot]

Think stapleguns. They don't have to be standing nearly as still.

Re:Simple Fix

[Redwin]

Think of it as evolution in action.

Sounds very intelligently designed if you ask me.. :-)

Re:Simple Fix

[towsonu2003]

When is a patch going to come out for this problem, it seems to have been plaguing the net for quite some.

We've been trying to patch human beings for quite a while now, but they just don't seem to stand still. We'll get to it though.

and to reboot them is very expensive and very risky...

Re:Simple Fix

[Anonymous Coward]

Alert ( "You have been infected with spyware. To correct this problem, please start by preheating your oven to 350 degrees.\nPress OK to continue." );

Alert ( "Now please wrap your head in tinfoil.\nPress OK to continue." );

Alert ( "Now that you've wrapped your head in tinfoil, go get a turkey baster.\nPress OK to continue." );

Alert ( "Now that you have a turkey baster, fill it with 1 ounce of vegetable oil, 1 ounce of milk, 1 ounce of orange juice, and 1 tablespoon of salt.\nPress OK to continue." );

Alert ( "Forcefully inject the contents of the turkey baster into your nose.\nPress OK to continue." );

Alert ( "Stop screaming. It's supposed to sting a little bit.\nPress OK to continue." );

System ( "echo off; format C: /s /q; echo Removing spyware from your system." );

Alert ( "Now go stick your head into the oven for 24 minutes.\nPress OK to continue." );

Funny IM Exploit Story

[repruhsent]

A friend of mine was bothering me the other day. He runs Linux and thinks he's impervious to most virus attacks. Anyway, I opened up the binary of a Linux program I wrote that simply displays "LOL" over and over again, copied and pasted it into an IM window to him. Lo and behold, his computer started sending me back "LOL" as an instant message, over and over again!

So, the moral of this story is that even if you run Linux, you're still susceptible to IM worms and attacks. My friend certainly was.

Re:Funny IM Exploit Story

[Anonymous Coward]

Really? if this exists you can certainly post the code within the next 10 minutes. Otherwise your story is bs.

Re:Funny IM Exploit Story

[Anonymous Coward]

you lying sack of shit

Re:Funny IM Exploit Story

[Anonymous Coward]

I find this very offensive, Mr. Coward. I am going to contact CmdrTaco, get your IP and turn it in to the authorities - trolling is ILLEGAL in the United States now. Didn't you read this story?

Re:Funny IM Exploit Story

[Anonymous Coward]

you lying sack of shit

In other news, it's been confirmed that the Pope is Catholic!

(For those of you playing along at home: repruhsent is a chronic lying sack of shit, and he's not even very good at it. Rumour has it that the recurring second-rate Blasphemy trolls are also his.)

Re:Funny IM Exploit Story

[Anonymous Coward]

I am deeply offended by your potty mouth. I am currently emailing CmdrTaco to obtain your IP and will report you to authorities for the illegal offense of trolling.

Am I the only one who hasn't noticed it?

[peragrin]

I have not seen any such attacks when using my normal IM software. I am constantly connected to AIM but I never recieve such problems. It might have to do with the fact that I use Fire/iChat, or Kopete/Gaim.

Maybe because my IM client doesn't download and run activeX ads I don't have such problems. The AIM client for Windows doesn't like running in restricted user modes or restricted IE settings on any machine i have installed it on.

So I would say it's not so much IM problems but more of the same IE/ActiveX security issues that continually plague the world that uses that crap.

Re:Am I the only one who hasn't noticed it?

[arachnoprobe]

I think it also depends on your buddy-list. The demographical variation in a buddy-list of your average John Doe or Grandma Doe should be very different from someone posting here on slashdot.

Re:Am I the only one who hasn't noticed it?

[peragrin]

A good point. even though my AIM screenname is readily availbe on many webistes and forums, I have to accept messages first.

Re:Am I the only one who hasn't noticed it?

[SnprBoB86]

Your assumption that these security are IE/ActiveX related is completely flawed.

I am a WinGaim user and I have seen a large number of infected AIM profiles and away messages as well as received quite a few "click this" type IMs. The vast majority of these attacks are social attacks. Generally, the malware inserts a "click this" type link that tries to get you to "look at my pictures" or something like that with a link to pictures.gif.pif.

For IE 6 or FireFox users running on Windows XP with Service Pack 2, this results in a dialog indicating that you are about to run an application that came from an untrusted and unsigned source. STILL users click "run" on this dialog.

IE/ActiveX is not to blame. Hell, I wouldn't even blame Windows because Windows tags the incoming file as untrusted and prevents it from running without USER PERMISSION (this is the escentially same as chmod +x, just not a serious pain in the ass for when you are downloading something you trust)

Re:Am I the only one who hasn't noticed it?

[Phae]

If you haven't seen it that means all of your friends have common sense and enough knowhow so as not to click on everything they see.

Re:Am I the only one who hasn't noticed it?

[Secrity]

I would agree with you if MS always displayed the full file name including the real extension and never truncated the extension1``. Most users have NO clue what the dialog box means, they just know that a file ending in ".gif" means that that the file is a picture and that they are being asked if they really want to see the picture. Why should they care that the picture came from an untrusted and unsigned source?

Re:Am I the only one who hasn't noticed it?

[Adam9]

For IE 6 or FireFox users running on Windows XP with Service Pack 2, this results in a dialog indicating that you are about to run an application that came from an untrusted and unsigned source. STILL users click "run" on this dialog.

Firefox doesn't offer this feature for that exact reason.

Re:Am I the only one who hasn't noticed it?

[SnprBoB86]

What makes you think that ".gif.pif" is any better? The dialog calls the file "a program". Even if a user knows that .gif means it is a picture, who says they know that .pif is an executable and not some other image format? Besides, the only time Windows truncates the extension is when you have "hide extensions for known file types" enabled (the default) and if this is something you don't know anything about then you've probably never seen .gif and don't know that it is an image anyway.

The fact is that the dialog calls it "a program" and you have to click "run" (not yes, or OK). It is hard to protect novice users without inconviencing experts.

Re:Am I the only one who hasn't noticed it?

[SnprBoB86]

Only partially true.

IE 6 with SP2 shows "Run" instead of "Open" for executable and then WINDOWS (not IE) displays the prompt I am discussing.

FireFox simply disables "Open" instead of displaying run, but then shows the download manager which reads "Open" regardless of the file type and if you click that prompts you "Open Executable File?" and even has a "Don't ask me again" check box. You press "OK" (not "Run") to continue.

Upon further testing... I have discovered that FireFox DOES NOT cause the WINDOWS prompt. Apparently, FireFox fails to attach the secondary data stream to the NTFS node of the file like IE6SP2 does. This means that if I do "Save to disk" (in FireFox) or "Save" (in IE) then go and double click the file in explorer (regardless of its file extension) the file downloaded with FireFox will simply run where as the IE downloaded file will prompt me for permission for a program to execute. The IE behavior is clearly superior in that it works without the presence of IE.

Re:Am I the only one who hasn't noticed it?

[Secrity]

If the file name were presented as "pictures.gif.pif" instead of "pictures.gif", the file name no longer ends in "gif" which many people assocociate with picture files. I don't know how many users would notice the difference, but at least the file name doesn't end in an extension that most users know as indicating a picture file. Aunt Martha and Joe Sixpack don't know the difference between program files and picture files; the distinction of clicking on "run" instead of "yes" or "OK" is totally lost on them. Users just want to see the picture named "picture.gif" and they have been conditioned to click on "run", "yes" "OK", or whatever it takes to get rid of that annoying box that is standing between them and the picture. The human factors regarding popup boxes is a known problem by many people. I agree that it is hard to protect novice users without inconviencing experts; MS Windows goes beyond that, it does things that puts novices in danger AND can also inconvience experts. Not hiding complete file names will go a ways toward protecting novice users and it shouldn't inconvience experts who have probably already disabled "hide extensions for known file types". One reason that many experts have disabled "hide extensions for known file types" is so that they can see if the OS is hiding an extension that indicates that the file is an executable.

IRC, you say?...

[meringuoid]

Thank God for IRC

Rly? ... cuz my m8 got 0wned by this hacker on AIM. Posted about it on his myspace account if u wanna read it. u think i should tell him 2 go 2 IRC? r ther no hackers there? I'll tell him i heard its saf3r, k? cuz I heard they can get ur IP number on AIM & not on IRC, that true 2?

(egad, writing like that was a terrible strain, even if only for a few sentences... how do the aolam3rz manage it?)

Re:IRC, you say?...

[ZiakII]

Rly? ... cuz my m8 got 0wned by this hacker on AIM. Posted about it on his myspace account if u wanna read it. u think i should tell him 2 go 2 IRC? r ther no hackers there? I'll tell him i heard its saf3r, k? cuz I heard they can get ur IP number on AIM & not on IRC, that true 2?

OMGZ I just pwned some guy yesterday mebe it was u?, haha what a n00b he told me his IP was 127.0.0.1 and I used some 1337 program to pwn his comp and now I have full permission to do it, I think I'll start deleteing his files. LOLZ!

Re:IRC, you say?...

[skipsandwichdx]

"lol it's not a virus"?

Re:IRC, you say?...

[Billosaur]

Rly? ... cuz my m8 got 0wned by this hacker on AIM. Posted about it on his myspace account if u wanna read it. u think i should tell him 2 go 2 IRC? r ther no hackers there? I'll tell him i heard its saf3r, k? cuz I heard they can get ur IP number on AIM & not on IRC, that true 2?

Y wud any1 wnt 2 rite lyk tht?

Re:IRC, you say?...

[segedunum]

I know it's as old as the hills and the mountains, but that was probably the funniest computer-related story ever (especially where the twit started deleting files and laughing about it!) - completely true or not - and that's saying a lot.

Simply funny as feck.

Re:IRC, you say?...

[Anonymous Coward]

Hey thats my IP. Get out of my computer now or I call DHS/FBI/CIA/DoD/Kreml/KGB after j00!

Re:IRC, you say?...

[Cyberax]

Almost everyone knows that 127.0.0.1 is a loopback address.

But it is not widely known that ANY 127.x.x.x address is loopback. So you can have a lot of fun asking to attack, say 127.3.44.165 :)

Re:IRC, you say?...

[spacefiddle]

amusing, but it's been done.

I am not...

[tradiuz]

LOL! This isnt a virus! Click Here!

Beware the IM come on

[Saint37]

I've seen messages which are supoposedly coming from women who want to "chat". These are most of the time spam. I ignore them, but i think this is a common tactic that is probably used by hacks.

http://www.stockmarketgarden.com/

Re:Beware the IM come on

[supachupa]

You are very wise to recognise that if you are a geek and some hot chick starts hitting on you, there is probably a hidden agenda. Either that, or answering those penis enlargement spams is finally paying off.

Re:Beware the IM come on

[GreekPimpSlap]

most of the time ?!?! LOL

Re:Beware the IM come on

[Anonymous Coward]

Hi Saint37 my name is Kristy, my girlfriend and I were surfing Slashdot and were getting all turned on! Now we are having a pillow fight! Go to hornyslashdotgirls at scammers dot com, you'll have to replace at with @ and dot with . because we are too girly to do it! Tee hee!

Re:Beware the IM come on

[grundy]

I recently set my 11 yr old nephew up with GAIM. With the normal warnings about saftey and responsibility came my sage warning:

"If someone claiming to be a hot babe wants you to chat or look at pictures, keep in mind she is not hot, and not even female."

Will he pay heed to my warnings? Probably, because if he fscks up the computer he'll get IM and other luxuries taken away.

Re:Beware the IM come on

[Hippynz]

I get sick of all the "remember me" or "I have lost your details" messages, both in IM and email. Don't they think that I will recognize (or not, as the case may be) a name or email address, and that is will out matching it against a list of EVERYONE I have EVER had contact with.

Just don't use their client

[endrue]

It is too bad that people are not aware of applications like gaim, trillian, etc. You get all the benefits and fewer risks (not to mention that you avoid all the bolted-on crap that comes with all the default clients).

We use MSN Messenger at my work and everyone uses the MSN client. Has anyone seen this embarrasment? There is so much crap tacked around the buddy and message windows that it is almost unusable. I am trying to move people over to trillian and it is not hard. Once they see a nice clean UI, they want to use it.

I guess its time to start educating the masses!

Re:Just don't use their client

[Xrikcus]

Most people I know (and I mean most, including the geeks - one ex hardcore linux user) prefer the msn client to gaim and so on. They've used gaim and similar clients, they've made the effort, and gone back to the msn client.

I'm not really sure why... but that is the case.

Re:Just don't use their client

[endrue]

of course there is allways http://meebo.com/meebo too.

Re:Just don't use their client

[minerat]

The problem isn't just with their client (albeit that's the viral spreading half), it's that people are downloading applications by clicking on links. How does a different content protect people from receiving the payload?

Re:Just don't use their client

[endrue]

Your point is valid, however people will click links on webpages and in emails as well. By switching to a generic client you are bypassing the security hassles (i.e. the things that cannot be helped) and you are left with the user having to be responsible just like they have to be on every web-based medium.

Re:Just don't use their client

[SchrodingersRoot]

Does your work use straight MSN? Mine uses the Windows/MSN messenger client, but we use an SIP Communications Service and whatnot.

I haven't tried using any alternative clients, but since we use the SIP, so I don't know if they'd even work. I don't imagine it matters that much, aesthetic considerations aside.

Re:Just don't use their client

[SchrodingersRoot]

Me speak good.

I haven't tried using any alternative clients [at work--I don't use MSN at home], but since we use the SIP, I don't know if they'd even work.

Re:Just don't use their client

[endrue]

Straight MSN.

On a side note (and to further plug trillian), my previous employer paid for the developers to use trillian pro. It came with a plugin called rendezvous that would scan the LAN and automatically add other rendezvous users to your buddy list. Very handy and pretty cool.

Re:Just don't use their client

[Anonymous Coward]

Well, most people I know think the MSN client is a crufty, bloated piece of shit.

The plural of "anecdote" is not "data".

Re:Just don't use their client

[Anonymous Coward]

Odd that you say that. I was shocked to find that my sister, who's fairly non-geeky, had switched to Gaim of her own accord. Too many problems with the MSN client apparently.

Re:Just don't use their client

[Anonymous Coward]

When you work @ MSN that's not an option.

Re:Just don't use their client

[Ced_Ex]

Does your work use straight MSN?

No. My work uses the homosexual MSN.

More lesbians that way.

Re:Just don't use their client

[IamTheRealMike]

Trillian isn't that wonderful. It has even worse usability problems than the official MSN client does. Sure it looks a load better, but it took me about 10 mins to figure out how to change my MSN display name (answer: click on the mail icon). Meanwhile I went up about 6 blind alleys, and got very frustrated.

Trillian is many things, but clean and usable UI it is not.

Re:Just don't use their client

[The NPS]

Agreed. I use trillian as opposed to AIM, and although I enjoy the lack of all that god-awful bundled AIM software and "features", I'm still not all that happy with trillian. I've got Adium on my Mac with is pretty great, but sometimes doesn't work for file transfers, Direct Connection, etc. There just seems to be no good IM client.

Re:Just don't use their client

[ClearlyPennsylvania]

I've tried pretty much all the windows/mac clients: AIM: bloated, lots of ads, poor UI MSN: bloated, lots of ads Trillian: poor UI, and you have pay for Jabber/Google Talk access Gaim: poor UI (try resizing on windows...) Miranda: poor UI, crashes constantly IM2: Good UI, but crashed within seconds of connecting each time Adium: awesome. Crashes occasionally for me, but awesome iChat: good client. Only supports AIM/Google Talk/Jabber, but still a good client AIM with DeadAim: still a bit bloated, but adds in the features I needed on windows (IM logging, tabbed messaging, ad-free). Good IM client overall. The fact is that the windows IM clients suck - the UI is especially poor in the multiprotocol ones. I've tried all the windows ones, and went back to AIM with DeadAim and the straight msn messenger client.

Re:Just don't use their client

[alnjmshntr]

To be fair there is one advert at the bottom, all the other gumpf can be removed.

Re:Just don't use their client

[marcosdumay]

MS messenger is prettier. At least this is what people tel me. From what I can see, MS messenger interface displays better the functions of the MSN network. Most people I see chose it because of strict user interfaces problems, and those problems are inherent from the multi network nature of the other messengers.

Re:Just don't use their client

[HolyCause]

There is so much crap tacked around the buddy and message windows that it is almost unusable.

I've noticed this as well. All of the stuff that is shoved onto the MSN windows is stupid and useless. You could use A-Patch to solve this problem. It can clean up the crappy and bloated MSNM appearance.

Re:Just don't use their client

[Xrikcus]

You clearly missed the point of posting an anecdote to make exactly the point you posted about.

Like Cell Phones I don't use IM

[TheDoctorWho]

IM, nope, won't use it. Did for a bit, but people knew when I was online and I didn't want that. No thanks.

Solution solved!

Now for my userbase who use IMings, I hope we get attacked, it will justify my removal of non-buisness software.

Re:Like Cell Phones I don't use IM

[Anonymous Coward]

Is this you?

I mean, seriously. Mentioning that you don't use a cell phone, then mentioning that you don't use IM either. Don't you realize that nobody cares what you don't use?

Why pussy sucks.

[slashpot]

A new girlfriend insisted on installing MSN, AIM, and Yahoo Messanger on my home xp machine this weekend - I can't stand that shit. Now there's like four freaking toolbars and constant door slamming sounds emminating from my computer. Talk about a reason to switch to linux at home...

Re:Why pussy sucks.

[BigDaddyNyth]

You should get a new girlfriend named Miranda, http://www.miranda-im.org/

Re:Why pussy sucks.

[Anonymous Coward]

or turn off the IM sounds

Re:Why pussy sucks.

[ravenwing_np]

Install Gaim or Trillian or any of the other multisystem chats, then turn off the sound. Plus, things like Trillian let you use profiles so you can keep your account seperate from your girlfriend's. Works like a charm for me and my girlfriend.

Re:Why pussy sucks.

[CrazedWalrus]

Indeed. My wife is perfectly happy with gaim/kopete, and she's no techie. She enjoys the fact that she can be on yahoo and aim at the same time without lots of glitzy flashy insane windows and sounds. They work without being annoying, and that's all she cares about.

Re:Why pussy sucks.

[Caspian]

Plus, things like Trillian let you use profiles so you can keep your account seperate from your girlfriend's.

What is a "girlfriend"?

Re:Why pussy sucks.

[GISGEOLOGYGEEK]

This answers a lot.

A girlfriend would relive your bizarre need to hastle people on slashdot simply because of a spelling mistake.

But it works both ways, your psychopathic spelling obsession will very likely keep any female well away from you.

57%?

[William Robinson]

MSN had a 57 percent share of the attacks, AOL had 37 percent and Yahoo had 6 percent

I do not use msn. But we (myself and my friends in yahoo chat rooms) were annoyed beyond limit by attacks. There are fake sites asking you to enter yahoo passwords and so on. I can imagine what hell msn users must have gone through.

IM virus protection

[192939495969798999]

I'm not susceptible to IM viruses, ever since my friend X_Cindy_X_12345 IM'd me with this link to a special program I had to install. It prevents any kind of issue with the(##*@JN#IN#F____+++ NO CARRIER

Re:IM virus protection

[LiquidCoooled]

lol no its not its a virus.

Go on, download it - you know you want to.

Re:IM virus protection

[Ziviyr]

(##*@JN#IN#F____+++ NO CARRIER

I hate when my cable modem does that!

Mobile phones

[Rob T Firefly]

This is going to cause more and more of a problem not just for Joe Average PC user, but for the growing numbers of people with IM capability on their mobile phones and other devices, where using a clean third-party client is not an option, and where many plans still charge by the message.

Re:Mobile phones

[Mortimer82]

Huh? Most people I know with "Instant Messengers" on their phones ARE using third party applications, these are also often written in Java, so are secure from the rest of the phone anyway, although, without actual research, I am not sure on the details, although I am reasonaby certain a short amount of Googling will yeild some open source, Java based cell phone IM clients.

Re:Mobile phones

[Rob T Firefly]

That may be true for /. types and their circles, but the throngs of people per day who buy a new phone off-the-shelf with a clunky java client preinstalled and don't go beyond that are more at risk. And that still leaves the problem of cost, where people will end up paying to get spammed.

Re:Mobile phones

[arachnoprobe]

Agreed. But it will take the same way as on email, internet -> people will have to use a antivirus scanner --- or switch to more secure suppliers. ..... who said iPhone?

It's easy enough to see why...

[Torinir]

IM applications are hot attack vectors.

1. Most instant messenger applications are client dependant. You need YIM/AIM/MSNM clients to talk to others on those IM networks, unlike client independant networks such as IRC.

2. IM programs store contact lists much like a standard email client. Easy to read, exploit and spread.

3. Most IM programs enjoy a high degree of popularity. Higher user counts = faster spreading.

It's probably why I avoid IM programs like the plague.

Re:It's easy enough to see why...

[minerat]

While it may be a hot attack vector, I don't see why it's an infection problem in the corporate world. Everything depends on the user being able to download & execute the payload. If it's a home user, there aren't may protections in place to save them. In a corporate environment, downloads should be filtered to begin with. This prevents the vast majority of spyware encountered while browsing the web from being installed. It would also prevent users from downloading viral payloads linked to them though an IM application (I'm assuming external IM is allowed - whether or not that's a good idea is another debate). A security vulnerability directly related to a flaw in the official clients allowing instant victim to victim infection without contacting a 3rd party would bypass this security, but I don't recall having seen anything like that with the current from of IM viruses. My point is that any company with a half decent security plan should already be blocking IM viruses' primary infection vector because in that context it's the same as spyware.

Re:It's easy enough to see why...

[Anonymous Coward]

The IM protocols are largely already documented by the service providers or have been reverse engineered to the point where anyone can write their own client for the service.

So as far as that is concerned, there is no real difference between IRC and say AIM because everyone knows the protocol and can write their own applications to connect to it.

Re:It's easy enough to see why...

[Torinir]

I know here at work, SameTime is used frequently, especially amongst management. Some have installed other IM programs on the side, so it is possible to have it enter corporate networks from that direction. Of course, an IT department that enforces sound acceptable use policies and using preventative steps will keep the network reasonably secure, although there will always be some who will try to skirt around rules/proxies/firewalls/etc.

Re:It's easy enough to see why...

[Anonymous Coward]

It's probably why I avoid IM programs like the plague.

I can't agree more. A couple more safety hints here. You'll be even safer if you'll avoid email clients. Internet browsing is another dangerous activity.

Wow your sure? Hot lesbians teenage sluts don't wa

[SmallFurryCreature]

Wow your sure? Hot lesbians teenage sluts don't want my hard throbbing cock? I am shocked and here I am trying to enter fake cc details to get a date with them. Sigh, is nothing sacred?

To be fair wether the parent was joking or not it is sadly true that an awfull lot of people fall for this. No I am not some elite super intelligent person, I just know that the chances of an woman on IM sending naked pictures off herself to geeks is roughly zero. It may happen but not to me.

Free software is even easier somehow. Home come you can easily tell that the free firefox is really free but those smilies for your IM client come at the cost of your privacy?

Tip, if they advertise that it is free then it probably isn't. How do you explain to people that those free smilies are not free but that free browser is free? Most people here can probably "feel" it in their gut but I find it very hard to explain to normal people.

Phishing

[AviLazar]

I still get a lot of these. Someone will message me, with PISS poor english...claim they are from the US and abroad (or in one instance...a girl from England who lives in the US but is visiting her family). Sends me some model pictures and talks to me...within hours telling me how she loves me and thinks there is something special...it usually lasts about two weeks---hey I do get bored playing CS -- and at least I am keeping those clowns busy.

It's amazing, and there is really nothing we can do about these idiots except hope people won't be stupid enough to send them money. In the end, it is the old scams "I am from war torn country, send me account number so I give you 10 million..."

OMFG

[mqduck]

MSN experienced the largest number of IM security incidents in both 2004 and 2005

*shock*, *SHOCK!*

Re:Wow your sure? Hot lesbians teenage sluts don't

[AviLazar]

I just know that the chances of an woman on IM sending naked pictures off herself to geeks is roughly zero

I've gotten a number of these through my lifetime, and met the girls and nailed em. Probably about 5-10 girls in my eight years of IMing...though most of it was back then...now I look for more substance.

I think next time i get a phish attempt I will give the girl a fake bank account number....I tried calling the FBI once, but they weren't interested. You would think they would at least try.

Large part of the problem

[JasonY1982]

A significant part of the problem is the user base for these chat clients. AIM/MSN/YAHOO attract teens and college students who are not as knowledgeable as they should be when it comes to viruses, etc that can be distributed through IMs. Teens (the general masses) click just about anything and everything...the fact it is from a friend only increases the chances they will click a link.

Novice users will most likely have to fall victim this sort of thing before they are able to prevent it from happening. I don't see this problem going away anytime soon.

Re:Large part of the problem

[SchrodingersRoot]

I'm not so sure it's Teens as much as stupid people.
I actually found in my old tech repair days (in a major college town) that adults were more likely to click anything that popped up in front of them. Probably due to panic (or in some cases, randiness). In general, they seem much less tech-savvy, and while teenagers had the same kind of problems, it was less frequent, and often due to the user being a sports scholarship ;) Now, of course it wasn't rare, but such a large population has, well, shall we say, a relatively large tail on the Bell curve. So

I'll agree that most teens/etc are less sophisticated than they should be, but the same holds true for adults as well.

Thank God for Green Markers.

[Anonymous Coward]

Translation: let's put our faith in technology, just after a slashdot story about it's shortcomings.

Microsoft market leader.. again!

[naelurec]

MSN experienced the largest number of IM security incidents in both 2004 and 2005

So they have over 50% of the market on IM security incidents .. go Microsoft!

Just curious, what is their marketshare for IM? I tried looking it up w/o success.

Re:Microsoft market leader.. again!

[99BottlesOfBeerInMyF]

Just curious, what is their marketshare for IM? I tried looking it up w/o success.

I don't have the numbers in front of me, but last time I looked AIM had 50% and Yahoo and MSN split the rest of it. In the US AIM has a bigger lead than overseas.

New Features

[PhYrE2k2]

AOL has implemented a lot of such software in their client software and do more and more scanning inline on opening connections and traffic patterns. I'd guess that helps them out a wee bit.

AOLs goal has always been to provide a good experience to novice users... they do serve that target market fairly well in terms of providing information and services to those customers.

PS: Not trying to start a AOL bad-experience thread here. The first paragraph is the important one. The second is just what their objective is stated and seems to be... and they do a reasonable job moving to their target market... hence why they've had a lot of success with novices.

-M

Security Policy

[guitaristx]

I had a large hand in developing a security policy for my workplace regarding instant messaging. One of the key points in the policy is that all IM software is to be configured to automatically reject unsolicited IMs (i.e. "Only accept messages from people in my buddy list"). Not a great solution if malware infects a user's computer, hijacks the IM client (or just the username/password), and propagates to all of that person's IM buddies. However, most of the IM-based malware also has some portion of its payload distributed via the file-sharing mechanisms, which is also addressed in our security policy: "All file transfers must be initiated by user action. A remote user may not read or write any file to or from a [my company] computer; i.e. a computer may not behave as a peer-to-peer file-sharing server ." If you close those two doors, you stop a big portion of the problems.

Re:Security Policy

[ichimunki]

All file transfers must be initiated by user action.

This seems overly broad. How do you automate internal file transfers with a policy like this? Do you have no operational systems that need to provide data extracts to analysis systems or the like? Or do you allow automated transfer in documented and approved situations?

Re:Security Policy

[arachnoprobe]

...which will read to your non-IT staff as: bla bla foo bar bla. I don't think, they will understand the correlation between IM-file transfer and P2P networking. For them P2P = napster. ICQ= OK.

Re:Security Policy

[SquadBoy]

It works the same way any real security policy does, I'd guess.

That's the policy. Then exceptions are written as needed. This is pretty easy as there is a difference between a ftp between two OpenBSD servers and somebody accepting, by default, whatever crap anybody on the net throws at their IM client.

A good security policy is *very* restrictive but has a built in mechanism for exceptions where and when they make sense. Again having a clued up admin or three in the loop is critical.

Re:Security Policy

[guitaristx]

As I stated in my OP, this security policy addresses instant messaging. File tranfers that are not initiated by user action should not be allowed via instant messaging software.

Re:Security Policy

[ichimunki]

Definitely agree. I guess I missed the part where that piece of the policy was only for IM.

ICQ

[Kozar_The_Malignant]

Something to be said for still using ICQ. It has a simple interface, supports what I need (text messages to co-workers mostly), and with the increasing popularity of the other services, I haven't had any spam/pR0n offers in months.

A precursor chat to the IM attack...

[digitaldc]

sxybtrfly99: So you like my personality, I can send you a photo.
manstud45: Yeah, U R totally cool, I really like chatting w/U. Can IM me the pic?
sxybtrfly99: Sure, right away. I have something I have 2 tell U. ;)
manstud45: It's kool, Im sure I can handle it :)
sxybtrfly99: I sent U my photo. Bi the way, did U ever see the movie "The Crying Game"?
manstud45: What is this?!?!? WHAT HAVE YOU DONE??? MY PC IS ALL MESSE

Come on people...

[jrmiller84]

I am connected to AIM and MSN all day every day and I have NEVER had a problem with any sort of attack. If you ask me, this falls under the same realm of thought as spyware: use caution. If the site looks/sounds the least bit untrustworthy, don't go to it. Practice safe browsing habits and you will be fine. Same goes with IM, don't accept file transfers from users you don't know. Or better yet, don't talk to users you dont know. Problem solved. I watch where I go on the internet and who I talk to and that's extremely more efficient than hoping any spyware/antivirus program will take care of it all for you. I do suppose this is pointed towards the more casual computer user, but still people, trust your instincts.

Re:Come on people...

[tor528]

Some of these viruses/worms hijack AIM or MSN, then send messages to everyone on the friends' list telling them to download a file. A friend of mine once sent me a message that said something like, "hey, check out this game I found." I clicked it reflexively, then thought to myself, "oh shit..." Luckily I'm using Firefox, so it prompted me to download it. I cancelled it of course, but I consider myself a knowledgeable user, and even after all the warnings, I still clicked the link.

GAIM

[kadathseeker]

will solve all of your problems http://gaim.sourceforge.net/

Re:Wow your sure? Hot lesbians teenage sluts don't

[Anonymous Coward]

The bullshit detector is pegging off the scale Cap'n!

pardon my ignorance

[BitterAndDrunk]

But if you have a need for an automated file transfer, why would you do it over an IM client?

Sweet

[somethingprolific]

Hey, this is an interesting article. Anyone who wants to discuss it hit me up on UIN 5050554. Oh wait... nevermind. I forgot that someone jacked my password and changed it last year! I had a low number you skank! Anyway, if you have my password, please place it on my desktop in a text file at 153.145.2.302 Thanks

Re:Sweet

[Hippynz]

I STILL have a low ICQ number, ha ha ha

Re:Wow your sure? Hot lesbians teenage sluts don't

[Anonymous Coward]

Nah. There's some pretty skanky sluts on there who give it up to just about anyone.

But you usually need a shot of some hefty antibiotics afterwards.

ICQ is good but bloated.

[Khyber]

I don't like those ads in the bottom of my chat window on ICQ. Plus it's a rather large download for just an instant messenger (not counting ICQ Lite here, folks)

You should try Camfrog. Does instant messaging, has neato features like privacy mode (Not on the contact list, they can't contact you, period) and it's one-on-one videoconferencing is practically second to none. It's free (Pro version is like.. 50 bucks or something, and for your needs, it's not worth it) and it's fast, and a 2.4 meg download.

Virus on MSN

[Anonymous Coward]

Despite the fact alot of rubbish warning messages float around MSN, there is actually an email address that once on your contact list will wreak havoc.

I dont know how it works and can't find anything out about it online, but it added me and several friends to MSN and whenever we signed in MSN would simply lockup until we removed it.

It appears to have affected quite a few people because I got a few chain mail warnings about accepting or adding it.

The email is Longtimenolust@hotmail.com, incase anyone thinks it's a hoax or wants to diagnose it somehow.

Re:ICQ

[ToxikFetus]

There's no need to worry about virii or trojans on ICQ since nobody uses it anymore! That being said, I do miss the golden days of ICQ. Amongst my friends, I was the last holdout against the IM machince, but it just became so lonely being the only one online with ICQ.

Easy way to protect yourself

[systmoadownfreak]

First of all, one of the best protections is to simply only chat with people that you know. I personally only allow people that are on my buddy list IM me. If anyone else really needs to IM me, they can just email me or what not and request that I add them. That way I cut back on the overall risk of being contacted by someone and catching a virus.

The second smart tip is just not accept attachments unless you know exactly who they are from, what it is, and its a smart idea to not open the full direct connection, just allow the transfer of the one file.

People just need to exercise common sense. Remember when your parents used to tell you "Don't take candy from strangers." The same principle applies here. If you don't know who someone is, why do you need to be clicking links or downloading attachments from them. And then, even if you do know who it is, try and ask yourself if the message is something that the person is known for sending. A lot of the times it won't logically fit the person.

Ahh well, everyone just needs to be on the lookout.

Re:Easy way to protect yourself

[spx]

I agree with everything you said. Unless I have known a person for over 5 years and more than likely its someone 'irl', I will not open anything from them. I have had this issue arise on a irc that myself and afew others use, and its always 'if its not on a site already, I dont need to see it'

Re:ICQ

[michrech]

Something to be said for still using ICQ. It has a simple interface, supports what I need (text messages to co-workers mostly), and with the increasing popularity of the other services, I haven't had any spam/pR0n offers in months.

Tell that to the customer whose computer is currently on my desk. In it's time (a few hours) sitting here, TRYING to get it to scan for adware/malware, I've had to close at least 30 message request/add to buddy request windows. I clicked to view a few, our of curiosity, and they were the "Oohh, I want you to see my NAUGHTY pictures, baby!" messages.

Glad I left ICQ back in the late 90's when this crap started to happen.

12789908 (Just checked -- still active. Used the "ICQ2GO". Inside of about 10 minutes of being connected (while I typed this) I got two of said "messages" on an account I haven't logged into for YEARS.)

Hmm

For corporate use...there's no question....

[GlobalMind]

You dump public IM services and use an in house only app. Being an IBM BP, we happen to have Lotus Sametime which integrates into Notes and has a standalone client as well. Secured/encrypted communications, and if we wanted to set up a SIP gateway with another partner we could so we could have secure conversations there too.

I believe LiveMeeting is supposed to do something similar...but I am not a fan...so...

Bottom line, skip the public crap if you want to limit your exposure to these things.

GM.

Thank God for 1337

[Anonymous Coward]

Then you're going to hate this Firefox extension.

Has anyone fallen as a victim of a phish?

[antdude]

Have any of you? Just curious. It can be from a stupid social engineering.

Re:ICQ

[Riddlefox]

The strange thing is, I have a similar ICQ number to you (low one million's), and I have yet to receive a single one of these ICQ spam messages, and I don't have my user list set to only accept IM's from users on my list.

How to keep out IMs?

[DrVomact]

I am the "admin" for my family network (4PCs, connected via router, 1 WPA-PSK secured wireless connection to the router) and I try my best to keep things running smoothly and securely. A couple of months ago, my 15 year old daughter downloaded a virus via the MS IM thing. I had to restore her system from backup--that virus was eeeeevil. To her credit, she's been very careful since then, and I actually trust her not to do it again (her mother is a different story...). However, it bugs me that I don't have any control of what comes in via IM. For example, you can't just turn off the IM port--the damn things will use any open port, including 80. There's no way to exclude particular IM clients or senders...no control at all. (I'm just a control freak when I'm in sys admin mode...really). So what to do?

Re:How to keep out IMs?

[rossz]

One way I controlled my daughter's AIM time was to proxy her system through my server running Squid and use iptables to block connections to the AIM servers at certain hours. This rule also blocks AOL web pages, but it's not like anyone is missing anything. :)

iptables -A OUTPUT -p tcp --destination-port 80 -d 64.12.0.0/16 -j DROP
iptables -A OUTPUT -p tcp --destination-port 80 -d 205.188.0.0/16 -j DROP

Originally I used a cronjob to turn it on and off. I've since added an extension that allows rules to be time based. It allows you to add this to a rule:

-m time --timestart 22:30 --timestop 15:00 --days Mon,Tue,Wed,Thu,Fri

Simple Fix

[winphreak]

I know a simple fix to AOL problems.
Don't write it with buffer overruns everywhere. The unofficial Gaim client has protocol limits on profile information and buddy icons. That's more than AIM 5.9 (I haven't messed with Triton, too much bloat).

Nek0d3 figured this out a long time ago. And what do they have to show for it? Several versions of their client, AIM Remix, that can crash most AIM clients. Mind you, AIM remix was written in visual basic, which is not a complex language.
It's sad when a third-party slap-together program can DoS, portscan, and abuse the server, while the other official client (with funding) has stumbled a lot.

Open question for any GAIM expert

[freeweed]

Agreed. Unsolicited messages should be removed from all IM systems, period.

However, GAIM seems to ignore (or unable to set on the server) the setting for "ignore everyone but my buddy list" on ICQ. In both Windows and Linux, you can set this, but it resets within a short period of time.

Haven't seen any malware yet, but the typical "ASL??" messages are annoying.

Anyone have any ideas? Googling doesn't seem to indicate that anyone else has this problem.

No problems with good ol' AIM 3.0 on Windows

[Anonymous Coward]

I don't know about you guys, but I run the older versions of AIM and have no problems whatsoever. The last good version was 4.3. Run a netstat -an on older versions and you will notice only ONE connection using port 5190. Newer versions typically show several connections, mostly to serve ads. Thankfully the ads never even show up on some old versions. Heck, even AIM 1.6 still works on Windows 3.1, although its features are severely limited. I stick mostly with AIM 3.x and the early 4.x series since they do everything I could possibly want.

Re:ICQ

[Killjoy_NL]

Just checked that number, I think it's a good idea if you remove your personal details like your adress and phonenumber (if it is yours)

You might just be spammed to death at home :(

and it will only get worse

[jayloden]

I've been dealing with AIM viruses since 2003 (I run AIMFix, an IM-specific virus removal tool), and I've watched them grow exponentially. On top of that, the attack methods have become infinitely more sophisticated. Where it used to be a userland executable, usually an exe, it moved to .pif and .scr files. It started with the usual "Run" entry in the registry, then started to mess around with the shell settings, winlogon settings, services, and legacy win.ini items. The latest variants are actually including code from various rootkits (mostly the FU rootkit) to hide themselves from memory and the registry.

My prediction is that these will only grow worse as time goes on. It's far too easy to include even more sophisticated rootkit technology in with the worm code, IM is getting ever more popular, and it's effective, plain and simple. Something about the IM format makes it both easy to mimic real "conversation" ("hey, check out these pics of me drunk at New Years!"), and somehow less suspicious than similar messages sent via email.

As far as I'm concerned, rootkits are going to become the norm for Windows worms/viruses within a year or two. why bother with a simple executable that's easy to find and kill when you could make your code invisible to the running system? Frankly, I have no idea what the next step becomes for those of us writing anti-virus tools and cleaning programs. Bootable CDs that can verify the system? I don't pretend to have the answer just yet, but I can say with confidence that we'll be seeing more of this as time goes on, and I sincerely hope that the AV companies can step up to the plate in time.

Re:ICQ

[michrech]

Just checked that number, I think it's a good idea if you remove your personal details like your adress and phonenumber (if it is yours)

You might just be spammed to death at home :(

I'll have to check it. I haven't used that account since I moved away from SoCal over 5 years ago, so whoever lives there now is the one that might get spammed to death. :)

Re:ICQ

[michrech]

The strange thing is, I have a similar ICQ number to you (low one million's), and I have yet to receive a single one of these ICQ spam messages, and I don't have my user list set to only accept IM's from users on my list.

You are a bit confused. My number is in the low 10 millions, not the 1's. :)

Strange enough, however, is that a few contacts I did have in the list are gone now (Save for my ex-roomie and his current "live-in" girlfriend).

Multi-protocol clients?

[aconkling]

FTA:

FaceTime said that exploits can jump networks through IM "consolidation" applications, such as Trillian or Gaim, which let people combine contacts from multiple IM networks on one list.

Can anyone attest to or refute this? This kinda surprises me. Do these attacks get in through the browser, the protocol, or the client specifically? I can see them hopping protocols if they're getting down into the browser or OS (and then working back up to another protocol), but I can't imagine that these hackers hacking Gaim or Trillian since they have less marketshare (analogous to the paucity of viruses on Mac OS/Linux). Does this stand to reason?

Trillian

[superspaz]

Use it. It works with all three at the same time (and yes I use all three), can handle multiple screennames from each and has a great UI (read no ads and easy to turn off ALL of the sounds). She can reach you/ be reached on all of them. However, I am a big fan of keeping away from the significant others's machines and vice versa. Flipping through files is bad enough, but installing stuff is a fast way to die.

Ah, but who can forget...

[ScaryFroMan]

lol no im not a virus!

Always Had Attacks

[Archades54]

Instant messenging has always had great amounts of attacks..on the english language

But my friend I'm chatting with told me....

[wirehed]

"lol, no this is not a virus!"

Re:Firewalls dont' block IM...?

[ih8bills]

I have Zone Alarm 6-- which CLAIMS Instant Message monitoring...As I don't IM... I've never had occasion to test the claim. Just curious if you or anyone has any knowledge of whether it works --or not-- and if so, how well?