March 24, 2005
Phishers Start Trolling Vulnerable IM Waters
It's the vulnerability and naivet of users that's really causing the problem.
Reports are starting to indicate that the phishers have discovered the instant messaging waters. Is anyone surprised? You shouldn't be if you understand the inherent vulnerability of messaging systems of all types. However, in IM's case it's the vulnerability and naivete of users that's really causing the problem.
That's because IM is a permission-based system. It is easier to block an instant message than it is to receive it if the sender is unknown to the receiver. The problem comes when users accept messages from strangers, and then click on the links that lead them to spam and phishing sites.
The best data about this is the recent study done by Mirapoint and the Radicati Group (See Radicati-Mirapoint Study Shows Bad E-Mail User Hygiene). It covers e-mail users, but it's instructive here because it indicates that as many as 10% of users actually buy spam products, and that over 30% click on spammer and phishers links. It's easy to believe that these same ratios apply to instant messaging users.
For some reason, people are trusting of people they don't know but get to meet in Cyberspace. And they just do things like that, and get themselves screwed. As a chief of security at an e-mail security services provider said to me, "People will click on damned near anything."
There are plenty of opportunities in the enterprise space to add security and spim-blocking features to public instant messaging systems. As far as I can tell from talking to vendors like FaceTime, Akonix, and IMLogic, not enough of you have taken advantage of those systems, and your employees remain vulnerable to all sorts of IM security breaches.
In all events, we need to educate our enterprise and consumers user communities. Maybe the only school that will count is that legendary School of Hard Knocks, but let's hope not, and let's hope banks and other vulnerable identity and credential theft candidates find a way to stop the spoofing that is the sinkhole into which these vulnerable people fall.
--John Dickinson, Editor, Messaging Pipeline
13%
25%
38%
25%
