• by Seana Mulcahy , October 31, 2005

Seems like no matter where you look everyone is Instant Messaging (IM). According to a 2004 Pew Internet & American Life survey, more than four in 10 online Americans use IM--about 53 million U.S. adults. About 11 million of them IM at work, and they appreciate its capacity to encourage productivity and interoffice cooperation.

Like everything else online, IM is being threatened. If you, like me, use IM for work and personal messages, this is a red flag waving--you are most likely at risk for viruses, Trojans, worms and hackers. According to IDC research, there are several things to be aware of when using an IM client. Here's a topline:

Open Connections. When engaging in file transfers, voice chat, or other file-sharing activities, the IM client reveals the user's true IP address. With this information a malicious user may concentrate on the host system for the purpose of hacking in to it, or as a target for a denial of service attack.

Identity Theft. IM clients commonly use little or no encryption for the transmission of login credentials. Guides exist on the Internet providing best advice on how to intercept and capture these credentials, which can thus be easily used to impersonate someone else.

Data Theft. The ability to tunnel through perimeter defenses makes for an efficient method of transferring confidential materials out of an organization. Internal users may use IM clients to transfer binary data such as customer databases and development source code to external contacts without alerting internal security or audit teams. With some IM clients, this may be achieved inadvertently through poor configuration of file-sharing services.

Loss of Privacy. The common failure to implement any form of encryption of the data means that all messages must travel in the clear, meaning that an observer can easily intercept and read this information. In the case where non- peer-to-peer connections are made, all messages must travel to a central server before being forwarded to the recipient where they may be logged and stored (note that users within the same office may be unaware that their traffic is being routed over the Internet). Similarly, the message recipient may also log and store this information for later use.

When your IM is attacked, that's called "spimming." Webopedia defines spim as:"spam over instant messaging... The spim typically contains a link to a Web site that the spimmer is trying to market."

The volume of spim was set to triple last year to about 1.2 billion--70 per cent porn-related, according to a report from the market research firm. Radicati Group. This is a mere trickle compared to about 35 billion spam, but the researchers warn that spim is growing at about three times the rate of spam, as spammers adapt their toolkit to exploit the many new IM users. Pew research found that nearly 40 percent of IM users under 30 have gotten spim, along with 27 percent of users aged 30 to 49. According to Pew, here are some quick tips to avoid spim:

Never post personal information on IM.

Never respond to a message sent unsolicited by a user you don't know.

Be careful posting your screen name on Web sites.

Do not click on links in messages that appear to be sent by someone on your buddy list.

Check out the site IM Logic's Threat Center to find out about the latest threats.

Set your preferences on your IM client to only accept messages from your buddy list.

If you have any other tips and tricks for avoiding spim, post them to the Spin Board.