Businesses have been warned to prepare themselves for an
onslaught of malicious worm attacks through corporate instant
messaging systems.
The number of new attacks released on to instant messaging, rose
17 fold in 2005 and could double again by next year, predicts
research based on an analysis of 600 companies.
At the same time, the sophistication of the attacks is
increasing, with a growing number of worms carrying payloads which
log key strokes, launch spam, or install as root kits to avoid
detection.
Andrew Lochart, director at Postini which conducted the
research, said, “In January we observed 25 unique worms and
viruses for instant messaging. By December we were seeing 300 new
threats. Over the course of the year there was a 17-times increase
in new threats being written.”
The number of instant messaging worms using mutation technology
to evade anti-virus software increased dramatically during 2005,
placing companies with anti-virus software covering their instant
messaging gateways at risk.
These worms mutate, allowing them to spread before anti-virus
suppliers are able to update their signatures. The Kelvir worm for
example, which mutated 140 times, last year forced a temporary
shutdown of the Reuters Messaging network.
Postini predicts that, although only a small percentage of
instant messaging worms carried malicious payloads last year, this
will increase in 2006.
“Phishing attempts, key stroke loggers, ID theft and fraud will
be where the action is in instant messaging. Users are not aware
they are at risk. If they see an instant message from someone on
their buddy list, they assume it is them. They don’t realise that
it could be a virus,” said Lochart.
Although technology is available to protect businesses against
instant messaging worms, it has yet to be taken up widely.
“The market penetration of these solutions is about where
anti-spam was five or six years ago. But we predict a large number
of companies will take it seriously in 2006,” he said.
Dave Roberts, chief executive of the Corproate IT Forum, said
that businesses would need to run awareness campaigns to alert
staff to the risks.
“Very experimental extremely clever people are exploiting
loopholes just because they can. The challenge is having awareness
campaigns and policies that keep people alert. Attacks of all sorts
are going to increase to limits that we can’t even conceive of,” he
said.
Postini predicts it is only a matter of time before worms are
developed capable of crossing multiple instant messaging
networks
Last year, 60% of the reported incidents in 2005, affected the
MSN Network, 34% AOL and ICQ, and 9% the Yahoo network.
The research shows that regulation and governance requirements
are driving more companies to encrypt their e-mails, using the
internet Transport Layer Security standard, which saw a 10% rise in
use in 2005.
“There are regulations having to do with privacy of customers
data [driving this]. In some cases it is simply good business
practice that keeps your sensitive business information secure.
Eventually we will reach a point when virtually all e-mail is
encrypted," said Roberts.
Court cases
A series of high profile court cases, which have led to large
firms being fined for failing to retrieve electronic documents
needed in court actions, is prompting more firms to invest in
archiving systems , according to Postini.
“Destroying documents is folly. Someone else will always have a
copy. If you keep a copy for yourself you have the entire context.
An e-mail that appears to be a smoking gun, could in context be
innocent,” Andrew Lochart, director at Postini said.
Other findings
- Instant messaging threats increased by 1700% in 2005
- Nine out of 10 instant messaging threats were highly
destructive worms
- Phishing reached record levels in summer 2005
- Directory harvest attacks doubled in December.