Instant Messaging (IM) applications are a staple of modern communication. If you're not using AIM, Yahoo! Messenger or a similar tool, chances are your child, spouse or neighbor is an avid user. While these tools are great for providing us with "always on" access to colleagues and friends, they pose a significant challenge to enterprise security. Many of these applications are used as a vector for spreading malware and phishing scams. Let's look at several strategies you can use to block IM traffic in your organization.
The simplest action you can take to limit IM traffic is to block the associated ports at the firewall. Unfortunately, that's not sufficient to completely block these applications. Developers realized many organizations are blocking IM and have created workarounds that allow applications to bypass filters by tunneling traffic through commonly used ports (e.g. port 80).
However, IM developers aren't the only ones who can be clever! Firewall administrators have developed two techniques to further stymie IM traffic.
Block the IP addresses associated with IM traffic. These addresses change on a periodic basis, so it's impossible to provide a comprehensive list. You can install these applications on a test system and periodically monitor the addresses they use.
Provide false DNS resolution for IM domain names. If you run your own DNS server, you can force all IM-related names to resolve to the loopback address of 127.0.0.1. However, it is important to note that this approach is not foolproof. Savvy users can create a local HOSTS file that bypasses the need for DNS resolution.
All of the techniques ...
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
we've looked at so far attempt to block network traffic. Now we'll look at an alternative approach. This method prevents users from installing IM applications in the first place. There are a variety of third-party applications you can use to do this, such as Microsoft's Software Restriction Policies. The following is the step-by-step procedure for using Software Restriction Policies:
Install the application you wish to block on a test system.
From the Start Menu, choose Run and enter "secpol.msc."
Expand the Software Restriction Policies tab.
Right-click on Additional Rules and select New Hash Rule.
Browse to the IM file and then apply the rule.
You'll be presented with the screen below, which includes the file's unique hash value.
[IMAGE]
When users try to execute the blocked program, they'll receive the following error message:
[IMAGE]
Of course, there's a catch! You'll need to do this for every version of IM software released by all of the major providers – AIM, Yahoo!, MSN and ICQ. That's certainly not a simple task!
As you may have realized by now, blocking IM applications is not an easy task -- there are flaws with each of the techniques you can use to limit this type of traffic. If you're serious about blocking IM traffic on your network, combine these techniques with strong desktop management policies and you'll have the best chance of keeping your network free of IM activity.
About the Author
Mike Chapple, CISSP is an IT Security Professional with the University of Notre Dame. He previously served as an information security researcher with the National Security Agency and the U.S. Air Force. Mike is a frequent contributor to SearchSecurity, a technical editor for Information Security magazine and the author of several information security titles including the CISSP Prep Guide and Information Security Illuminated.
