IM attacks on the increase

Organisations need to be aware of the security risks associated with instant messaging (IM), according to one security firm.

Security company Websense has reported a 300 percent increase of attacks that use instant messaging and malicious websites in the first quarter this year, compared to the fourth quarter 2004.

Dan Hubbard, senior director of security and technology research at Websense, said social engineering, and vulnerabilities within IM client technologies, were being used to gain access to hosts.

“IM will continue to be used as a social engineering tool to gather information about users and as a means of dropping malicious code onto user’s machines," Hubbard said. "The identity of users is often anonymous, and the very nature of real-time communications like IM presents a new opportunity for attack for hackers.”

According to a statement from Websense, its security labs have discovered sophisticated IM attacks. "Hackers have now begun to use IM as a new vector for phishing and pharming scams, by sending out mass messages to thousands of IM users which request the recipient to click on a link which takes them to a fraudulent website," the company stated.

"These malicious or fraudulent sites either request personal information from the end user or automatically download and run keyloggers, worms or viruses on the user’s machine -- creating an open backdoor for hackers."