IM and security

IvanV · May 21, 2006, 11:15 PM

I'm a little bit paranoid when it comes to security, so I'd like to know how big a risk is to use an instant messenger.

I assume that for IM apps to work, I must allow them to recieve packages (like p2p apps), and not just send (like browsers and downloaders).

From my (short) expirience with p2p, I learned that having an application that is allowed to recieve packages which it did not require is quite risky, so I'd like to know if IMs are any safer.

Erroneus · May 21, 2006, 11:44 PM

Well if you encrypt your data, which i know is possible with ICQ and MSN data through Miranda, you should be quite safe.

But this goes with everything containing personal data and password auth., use secure data if possible or else sniffing is to easy

thetaco123 · Jun 21, 2006, 07:33 PM

here something called imsecure http://www.zonelabs.com/store/conten...en&lid=nav_fim

Keep IM conversations private
Protect vulnerable IM connections

wee017 · Jul 3, 2006, 01:14 AM

Well, the only risk you run with IM is if you use Client-to-Client programs or when you send/receive files. In client-to-client programs it is extremely easy to tell someone's IP address:

Start>Run>cmd.exe
Type: netstat -n >openports.txt
Search for openports.txt
Open the Client-to-client program, start conversating with someone
Type: netstat -n >openports2.txt
Search for openports2.txt
Compare the two text files, there will be an extra IP in openports2.txt, that's the other person's IP.

Of course, the other person could be behind a proxy. And the other kinds of programs, client-to-server, hide your IP from the other person, but when sending or receiving a file or camera and/or audio conversations it establishes a direct link between the two computers, just repeat the process above while in a direct link and you have the IP.

Besides that, if you are scared that people might be looking at what you talk about what other people the only risk there are sniffers, and they're mostly within the same LAN. If you use internet in a LAN center or a wireless cafe, there's the most risk you'll have to have your conversations sniffed. Just use common sense, don't be stupid =D

kn00tcn · Jul 3, 2006, 05:38 AM

slow down, there's tcpview, so much easier than netstat

& http://www.secway.fr/us/products/all.php http://www.aimencrypt.com/

so i tested both with a tcp sniffer, before & after... msn appeared to be encrypted in a strange way already for some reason... aim wasnt, but after aimencrypt, it wasnt out in the open alright

what about DCC chat over irc... or something that uses SSL

wee017 · Jul 4, 2006, 04:38 AM

IRC wouldn't be considered IM. IRC is IRC. Internet Chat Relay. And MSN isn't encrypted =/ Your sniffer must be doing something wrong, I can sniff just fine anywhere in my network, make sure you're using an updated sniffer. And netstat is much better, you dont need to download any trial programs or nothing.. Just use cmd

kn00tcn · Jul 15, 2006, 08:45 AM

i dont 'do' trial hahaha.... no comment...

sysinternals' tcpview is freeware & instant... netstat is sittherewaitingforresultsware

& i dunno what my sniffer was up to, i had some other one, that i dont remember, a year ago, msn was unencrypted of course

& some irc networks have ssl support

May 21, 2006, 11:15 PM	#1
IvanV HH Assassin Guild Member Join Date: Dec 2004 Posts: 5,907 Rep Power: 333 System Specs	IM and security I'm a little bit paranoid when it comes to security, so I'd like to know how big a risk is to use an instant messenger. I assume that for IM apps to work, I must allow them to recieve packages (like p2p apps), and not just send (like browsers and downloaders). From my (short) expirience with p2p, I learned that having an application that is allowed to recieve packages which it did not require is quite risky, so I'd like to know if IMs are any safer. __________________ If anyone has Portal 2 and hasn't played the co-op and wants to do me a favour, let me know (PM me or whatever).

May 21, 2006, 11:44 PM	#2
Erroneus Get off my lawn! Join Date: Aug 2002 Location: Denmark Posts: 13,415 Rep Power: 119 System Specs	Well if you encrypt your data, which i know is possible with ICQ and MSN data through Miranda, you should be quite safe. But this goes with everything containing personal data and password auth., use secure data if possible or else sniffing is to easy __________________

Jul 3, 2006, 05:38 AM	#5
kn00tcn DriverHeaven Senior Member Join Date: Jun 2006 Location: Toronto Posts: 649 Rep Power: 0 System Specs	slow down, there's tcpview, so much easier than netstat & http://www.secway.fr/us/products/all.php http://www.aimencrypt.com/ so i tested both with a tcp sniffer, before & after... msn appeared to be encrypted in a strange way already for some reason... aim wasnt, but after aimencrypt, it wasnt out in the open alright what about DCC chat over irc... or something that uses SSL __________________ http://www.kn00tcn.net/site/ati-catalyst-profiles/ http://www.kn00tcn.net/FPSLimiter.rar

Jul 15, 2006, 08:45 AM	#7
kn00tcn DriverHeaven Senior Member Join Date: Jun 2006 Location: Toronto Posts: 649 Rep Power: 0 System Specs	i dont 'do' trial hahaha.... no comment... sysinternals' tcpview is freeware & instant... netstat is sittherewaitingforresultsware & i dunno what my sniffer was up to, i had some other one, that i dont remember, a year ago, msn was unencrypted of course & some irc networks have ssl support __________________ http://www.kn00tcn.net/site/ati-catalyst-profiles/ http://www.kn00tcn.net/FPSLimiter.rar

Jun 21, 2006, 07:33 PM	#3
thetaco123 DriverHeaven Newbie Join Date: Mar 2006 Posts: 12 Rep Power: 0	here something called imsecure http://www.zonelabs.com/store/conten...en&lid=nav_fim Keep IM conversations private Protect vulnerable IM connections

Jul 3, 2006, 01:14 AM	#4
wee017 DriverHeaven Lover Join Date: Oct 2005 Location: Behind you. Posts: 241 Rep Power: 0	Well, the only risk you run with IM is if you use Client-to-Client programs or when you send/receive files. In client-to-client programs it is extremely easy to tell someone's IP address: Start>Run>cmd.exe Type: netstat -n >openports.txt Search for openports.txt Open the Client-to-client program, start conversating with someone Type: netstat -n >openports2.txt Search for openports2.txt Compare the two text files, there will be an extra IP in openports2.txt, that's the other person's IP. Of course, the other person could be behind a proxy. And the other kinds of programs, client-to-server, hide your IP from the other person, but when sending or receiving a file or camera and/or audio conversations it establishes a direct link between the two computers, just repeat the process above while in a direct link and you have the IP. Besides that, if you are scared that people might be looking at what you talk about what other people the only risk there are sniffers, and they're mostly within the same LAN. If you use internet in a LAN center or a wireless cafe, there's the most risk you'll have to have your conversations sniffed. Just use common sense, don't be stupid =D

Jul 4, 2006, 04:38 AM	#6
wee017 DriverHeaven Lover Join Date: Oct 2005 Location: Behind you. Posts: 241 Rep Power: 0	IRC wouldn't be considered IM. IRC is IRC. Internet Chat Relay. And MSN isn't encrypted =/ Your sniffer must be doing something wrong, I can sniff just fine anywhere in my network, make sure you're using an updated sniffer. And netstat is much better, you dont need to download any trial programs or nothing.. Just use cmd