IM attacks up nearly 80%, Akonix says -- and P2P is worse

Network World - Malicious code attacks over instant messaging networks are up almost 80 percent over last year, according to a new study from vendor Akonix.

In July, the company, which develops IM hygiene and compliance appliances and services, said it uncovered 20 malicious code attacks over IM in July. The total number of threats for 2007 so far is 226, the company said. That number is a 78 percent increase over the last year.

The company also said attacks on peer-to-peer networks, such as Kazaa and eDonkey, increased 357 percent in July 2007 over July 2006, with 32 attacks.

That report comes on the heels of a report by peer-to-peer network monitoring vendor Tiversa, which found contractors and U.S. government employees are sharing hundreds of secret documents on peer-to-peer networks.

In many cases, those users were overriding the default security settings on their peer-to-peer software to do so, according to Tiversa. Robert Boback, Tiversa's CEO, and retired U.S. Army General Wesley Clark, a Tiversa board member, testified earlier this week before the House of Representatives Oversight and Government Reform Committee.

The IM attacks where tracked by the Akonix IM Security Center, which is a collaborative effort between Akonix, its customers and other security and messaging vendors.

The code used in the attacks was either brand new malware or a variant of earlier code detected by the IM Security Center.

The new worms included Exploit-YIMCAM, Hupigon-SJ, InsideChatSpy, SpyPal, StealthChatMon, Svich and YahooSpyMon.

Akonix officials also said the attacks are moving beyond the nuisance stage and getting more malicious.

"Beginning at the end of last year we started seeing multi stage attacks where IM will deliver a URL and when a person clicks on it they get code loaded that will pull down other code," says Don Montgomery, vice president of marketing at Akonix.

Montgomery says the IM Security Center also is seeing two stage attacks with the second stage being the downloading of a Trojan that waits for users to log into specific banking sites to activate a key-logging program.

In addition, there are multi-vector attacks where a malicious URL may be delivered by IM but propagated using e-mail or come in via e-mail and go out over IM. And attacks, focused on consumer services AOL, MSN and Yahoo, are beginning to span networks.

Reprinted with permission from

For more information about enterprise networking, go to NetworkWorld.com
Story copyright 2009 Network World, Inc. All rights reserved.