Instant Messenger A Target for Malicious Attacks

Instant messenger (IM) users aren’t safe from harm. An increase in threats picked up by integrated message management firm Postini are detailed in its “2006 Message Management & Threat Report.”

Instant messaging clients include AOL Instant Messenger; MSN Messenger; and Yahoo Messenger. Each provider reports over one billion messages sent over its networks per day. Consumer and enterprise IM users numbered 300 million in 2005.

The IM population is subject to IM-borne viruses; worms; spam-over-IM (SPIM); malware including keystroke loggers; and phishing attacks.

“The issue of IM is that it’s being used on the public networks,” said Andrew Lochart, senior director of worldwide marketing at Postini. “IM is subject to all the same problems as email. It’s extremely fast and efficient at propagating to a buddy list.”

Click on graphic to view chart

Last year saw a 1,700 percent increase of IM-based threats over the previous year. The report cited data from IMLogic Threat Center, which identified over 2,400 unique threats in 2005. Nine out of 10 IM threats are identified by the same firm as highly destructive worms on the messaging network.

Click on graphic to view chart

Threats to IM clients are varied. The majority come from worms (90 percent) while the rest make their way over each of the networks as viruses and Trojans (nine percent) and client vulnerability (one percent). Like computer viruses, Microsoft remains the largest target with a recorded 57 percent of IM-based threats; AOL and its ICQ client combined account for 34 percent of threats; Yahoo Messenger adds up to just nine percent of threats.

“Attacks against IM networks were not evenly distributed; far more were written for the MSN network than AOL or Yahoo,” said Lochart. “We don’t know if it’s more MSN clients in the world or the anti-Microsoft sentiment among virus writers. If you were an MSN user you were at much greater risk than other IM users in 2005.”

Postini measures threats over IM networks sent through its servers. Data reported account for threats monitored throughout the 2005 calendar year.