Are IM and Spyware Inevitable Partners?

Longtime readers of this column know my feelings about the various Instant Messaging (IM) programs that have proliferated throughout the Internet over the past few years. In general, I haven't been enthusiastic about using these tools, but more and more my clients ask me for an AOL Instant Messenger (AIM) or Yahoo! or MSN Messenger IM ID so that they can pop in with questions about projects or planning.

Of course, living in a household with kids, I know that IM is a de facto part of the childhood experience these days. Despite the availability of telephones (both cellular and plain old telephone service--POTS), kids seem to feel that they need to talk to their friends with messaging. I use Cerulean Studios' Trillian IM client because I don't want to have to install multiple applications to use IM features. Trillian's Pro version has worked well for me since its release. (Trillian also offers a free basic version of its IM client, available at http://www.trillian.cc.) Trillian lets me connect to AIM, MSN, and Yahoo! and access the IM features that these services offer without requiring me to use their dedicated clients, which makes using the services more bearable for me. I can categorize correspondents by task and type (e.g., business or personal) across various services without regard to which service each user is on.

Recently, I discovered another good reason to use Trillian instead of other IM clients. My kids upgraded their computer to AIM 5.5, the latest version of the IM client. In my weekly security scan of this computer, I discovered that AIM 5.5 installs a lot of stuff, including WildTangent monitoring software, so that AOL can track how its members use the games that AIM now includes.

The WildTangent software sets off my spyware scanner (I use Lavasoft's free Ad-aware program, available from http://www.lavasoftusa.com ). Although WildTangent doesn't collect personal data about users, I have a firm policy of killing spyware on the computers on my combination home-office network. The bigger problem here is that many businesses use AIM to provide quick connectivity between their internal and external users. Does any business want external software on its network that tracks employee behavior? You can kill WildTangent and still use AIM (although doing so is technically in violation of the AIM user agreement). However, the point is that the WildTangent software is automatically installed--you can't prevent the installation. If you use AIM in your business, you now have one more thing to worry about.

If you're a hardcore IM user, I suggest that you consider using Trillian as your basic IM client. And make sure you run spyware-checking tools on your computer after any upgrade, or simply as part of your general computer maintenance and hygiene routine. A Google search will return many free products worthy of your consideration.

End of Article

Everyone in my office uses AIM to communicate. It gets the info to everyone much faster. Now I'm worried that all the confidential information that has been sent out by people both in and out of the office has been compromised. I am so paranoid about spyware, and this slipped through the cracks because I've been a long time AIM user and I trusted them. Thank you so much for bringing this to my attention. I am really upset about this, and I'm consider dropping AIM because of this.

Sincerely,

Jennifer March 08, 2004

Just thought all should know that i downloaded Aim's new software and there was a worm attached to the unasked for wildtangent prg.... just a heads up for those of you out there that might not have anti virus software!!!

caytm March 13, 2004

David,
I too installed the lastest version of AIM. I spent half a day getting rid of Wild Tangent, and I dumped all of AIM. What a pain in the ars. I have down loaded Trillian, but after what AIM did to my machine I don't know if IMing is worth the hassle. I would like to have this added capability but my personal privacy is more important to me. You mentioned that you are keeping an eye on Trillians updates to see if they too cross over the spy line. I don't blame you. it seems that now adays on the web nothing is safe for private or corporate computer users. I think these invaders of privacy should be punished to the full extent of the law. A good hefty fine to a few of them might slow this trend down.
Sincerely,

John A. Hodgins March 15, 2004

I would not even consider Trillian. Take a look at Jabber AKA XMPP (www.jabber.org) this is an open source IM an XML router that has numerous clients for almost every conceivable OS.

Depending on the Jabber server you sign up with (you can also host your own) there are gateways to all the popular IM standards. This has the added advantage of not having a direct connection to the IM netwroks which can be exploited.

XMPP is currently a draft proposal with the IETF and is set to become the IETF endorsed standard.

Jason Huxley March 16, 2004

Encrypted IM is available for a fee, from Yahoo.
If its so necessary, then this is the only option anyone should consider for business use.
Otherwise anything can go in & out the door, & 3rd party servers get a shot at it as well.
g'luck all.

luke March 17, 2004

the idea of instant messaging runs parallel with the information age of on demand everything; people just aren't taking into consideration the security flaws that might exist. if people become more and more dependant on the service, what happens if someone decides to be malicious? it'll just turn into another target. more rigid standards and rules should be made, beyond just encrypting chats.

smoothness March 23, 2004

The latest BETA version of AIM now allows users to CHOOSE what to and what not to install, including Wild Tangent. Interesting. http://www.aim.com/get_aim/win/win_beta.adp

Jarrett April 10, 2004

Another good Instant Messaging choice in the line of programs is a much similar application compared to 'Trillian' is GAIM, typically for Linus, being the Gnome AOL Instant Messanger. Has support for AIM, Yahoo IM, ICQ, IRC, MSN, Jabber, and so on.. Although works best under Linux, I use it also under windows, I felt Trillian didn't work the way I felt an instant messanger client should. Check out GAIM's project website at gaim.sourceforge.net.

Alexander Delmore May 13, 2004

qoute John A. Hodgins - March 15, 2004
nothing is safe for private or corporate computer users. I think these invaders of privacy should be punished to the full extent of the law. A good hefty fine to a few of them might slow this trend down.

mate im so sick of wimps that are afraid of viglante action, don;t you reliase that if you continue to deferr to the "proper or-foritees", you will eventually have no freedom left(oh i dont' care cause ther not coming for me attitude is only short trerm buddy, reality sets in after but only if you observe and remember history)
In other word someone who won;t stand up for themselves is going to get taken advantage of, plain and simple.

So instead of whinging to the cops about that so-and-so, confront so-and-so first. Make them realise that YOU will not put up with their actions or behaviour. They wont understand this if you dont atulaise it for them, this is why most civilans are intimidated by police. If you really cared about it YOU would DO SOMETHING about it PERSONALLY, thus installing your persona as one not to be ****** with!
More laws equals more slaves required to finace those laws, end upo getting an efect a bit like entropy

The attitude of

Anonymous User May 12, 2005 (Article Rating:

)

mad ranter here again( abit more composed, with better spelling)

well im not sure on all the detail, but icq have a flash based version that you can run.

Some assumptions:
- flash is less of a security issue(is this true) since it runs in a browser?
- since it's flash, does it mean it is restricted to http calls only, if so what does this imply?

jabber's idea using xml seems good, but again what ports does it expose to the internet and how does it behave when doing so?

this is a bit unrealted, but has any one else notice thier winxp machine connecting to 224.0.0.2, i get these calls from a fresh winxp install. at the moment i just block outgoing trafic to this ip and others like it. My paranoia makes me lean towards the micorosft spyware scenario. Indeed this is a concern, for when you realise that 30% your bandwith is reserved by windows core modules for reporting of some kind.

Personally, i didn;t install the QOS bit for networking, and my networks still runs as expected (flaws included, for it is windows were talking about, one of THE largest viri in my opinion)
i metion this for it seems like spyware activity to me, traffic i didn't ask for is being propgated so i'll block it.

any ideas anyone?

Anonymous User May 12, 2005 (Article Rating:

)

You must be a registered user or online subscriber to comment on this article. Please log on before posting a comment. Are you a new visitor? Register now