Microsoft fights again IM spammers.

Redmond files law suit against firm accused of spimming Windows Live Messenger customers.

Microsoft has filed a law suit against mobile ringtone firm as part of its ongoing efforts to clamp down on instant messaging spam messages, which it says undermines users’ online privacy and security.

In a blog posting, Microsoft associate general counsel for internet safety enforcement, Tim Cranton, said Redmond is alleging that Funmobile “conducted a significant campaign to undermine the privacy of Windows Live Messenger customer accounts and to ‘spim’ our customers’ contacts”.


Microsoft is seeking to recover monetary damages as well as an immediate injunction to stop the activity. “Above all, we hope the lawsuit will send a clear message to all potential perpetrators that this kind of activity is not tolerated on our networks,” wrote Cranton.

Microsoft is alleging that Funmobile sent bogus IMs to customers, who were then asked for their IM username and password to log in. Once obtained by the company, these were then used to gain access to these accounts.

“They then ‘scraped’ or ‘harvested’ the contacts within each user’s account, and sent unsolicited bulk IMs to each of his or her contacts,” wrote Cranton.

Mickael Remond, chief executive of enterprise IM provider ProcessOne said the case highlights the dangers of using public IM clients.

“As enterprises increasingly use IM and chat applications for internal and customer communications, security is more important than ever,” he added.

“Enterprises need to be able to define the scope of their IM communications, and be able to set secure parameters. One of the benefits of IM over e-mail for enterprise security is actually that you can blacklist servers that can't be trusted, but also whitelist servers - for clients and partners, for example – who can be trusted.”


Phil Muncaster
V3.co.uk, 18 Jul 2009
Source: http://www.v3.co.uk/v3/news/2246328/microsoft-clamps-im-spam

Are You Sure About Your Instant Messaging Software Safety?

Instant messaging communication is a general and simple computer process involving PC users all over the world. It exists in peer to peer, spoken, written or gesticulated form. Today I'm going to concentrate on an instant messaging type of communication due to the fact that a vulnerability was identified in Lotus Instant Messenger. I suppose most of you know what instant messaging is. In fact, the name instant messaging can speak for itself. A potential denial-of-service vulnerability can be prompted by certain malformed Secure Sockets Layer (SSL) records which make the IBM® Global Security Toolkit (GSKIT) component fail and thus provoke the application to terminate.

I suppose that most of you really know what Instant messaging is. However, in order to know more about it, let me remind you briefly what it is. Instant messaging (IM) is a form of real-time communication between two or more people based on typed text. The text is transmitted through devices connected over a network like the Internet. Next, do you know what Web conferencing is? Web conferencing is used to organize live meetings or presentations through the Internet. In a web conference, each participant sits at his or her own computer and is connected to other participants through the Internet. This can be either a downloaded application on a computer of each of the attendees, or a web-based application where the attendees go to a URL or in other words website address, to get in the conference.

So what is IBM Lotus Sametime? According to Wikipedia, IBM Lotus Sametime is a client-server application and middleware platform that offers real-time, unified communications and collaboration for enterprises. Those capabilities involve presence information, enterprise instant messaging, web conferencing, community collaboration, and telephony capabilities and integration.

Some features of Lotus Instant Messaging might be similar to other well-known instant messaging programs on the net, for example Skype or Yahoo! Messenger. One of the files related to Skype include but are not limited to the following: SkypeIEPlugin.dll. Also, some of the files related to Yahoo! Messenger might include but are not limited to the following: YAHOOM~1.EXE and ymsgr_tray.exe.

How can attackers exploit the Lotus Instant Messaging and Web Conferencing vulnerability? The Sametime server in IBM Lotus Instant Messaging and Web Conferencing 6.5.1 creates error messages for a failed logon attack with different time delays which depend on whether the user account exists. This allows remote attackers to enumerate valid usernames.M3.jpg

Sametime integrates with a wide array of software, including Lotus collaboration products, Microsoft Office productivity software which incorporates Microsoft Outlook, portal and Web applications. Some of the files related to Microsoft Office might include but are not limited to the following: bcmsqlstartupsvc.exe, mofl.dll and owc11.dll. Also, some of the files related to Microsoft Outlook include but are not limited to the following: ACCWIZ.DLL, cb5.dll, DATAACC.EXE, EFD.EXE and gapi.dll. This vulnerability only affects IBM Lotus Instant Messaging and Web Conferencing (Sametime) servers that have configured SSL connections with their LDAP server. What is the solution to this security issue? In order to fix this particular problem, customers should upgrade their version of GSKit. When and how should they upgrade GSKit? What particular version of GSKit should you upgrade to? The answer is provided below:

* Sametime 2.5 and earlier versions did not contain GSKit; so no action is not needed for these customers;
* Windows servers: GSKit version 6.0.5.41 and any higher version of 6.0.5.xx does not contain the vulnerability.

Source: http://www.pc1news.com/news/0834/are-you-using-instant-messaging.html

IM Applications for IPhone. What's new in instant messaging software tools?

When push notification was installed to the iPhone system, a many of people were trying Instant Messagess pushed to their iPhone. I’d always figured Instant messaging applications were based around the “instant” part of the phrase, and someone pushing an IM to me might be disappointed if I don’t get back to them right away. Well, guess who’s been a big iPhone Instant Messenger since 3.0 came out? Go on, you’ll never guess. Yep, it’s me. I’d like my crow with a side of au jus, and a loaded baked potato, please.

First a quick word of warning: by no means are my comments here to be construed as any sort of a formal review. While I’ve tried to run all of these apps through their paces, I wouldn’t feel comfortable calling any of my comments a review — they’re more like first impressions.

That said, while there are 10 apps we tested out, it quickly became clear to me this was a race between Beejive and IM+ Push. The important criteria for me were: the ability to connect to multiple IM protocols (and multiple accounts of the same protocol), the ability to do push notifications, and the app not requiring its own server-side account to operate. Price, as they say, was no object. When you get right down to it, the difference between many of these apps is only $5-7. My afternoon brownie indulgence costs more than that.

Over the last week, I’ve been receiving push notifications from at least one of these apps during testing, if not more than one, and I didn’t notice a detrimental effect on my battery life — with the usual disclaimer that if I spent my entire train ride home IMing friends, I’d see a battery hit.

Without further ado, here are my findings.

IM+ with PushIM+ Push ($9.99)

IM+ Push is a very full-featured app with two specific features I enjoyed: I can set how long I’m online for up to three days (perfect for getting through a weekend); and I can change the wallpaper behind the messages. However, I found the app overall a tad on the slow side. As a speed comparison, by the time I had opened IM+ and viewed the IM, I would have also replied to the IM in Beejive. While it does claim to connect to Skype, I had some issues getting it connected, and never got a push from Skype.

IM+ LiteIM+ Lite (Free)

IM+ Lite is the free version of IM+ Push and the only differences between the two are that you can’t change the wallpaper and the push notifications are email only.

BeejiveBeejive ($9.99)

I found Beejive to be the fastest app in my tests. I could very quickly see what IMs had arrived, preview them and reply to them. Like IM+, I can change the background, but I can only be online for up to 24 hours (which was the standard time period for all the apps). There was one nice feature I found in Beejive that I couldn’t find a corresponding setting for in IM+: I can set how long I show as “available” after I close the app. One of the chief complaints from people I was IMing during this test were the frequent “crumpy is available”/”crumpy is away” notifications they were receiving. By staying “available” for 20 minutes, the person I was IMing with had a much better experience. It was a minor detail I hadn’t thought of until a few people complained about it.

One other feature I liked is I can set how many IMs from contacts are shown when I launch the app. The default is I only see the most recent message from each contact, but I set it do display more, up to and including all messages.

AgileAgile Messenger with Push ($9.99)

For the price, I found Agile Messenger to be a very poor solution. You can only connect to one account of each protocol (I have two AIM accounts: my personal and a work one). I also found the type size on the IMs to be too small to read, and there was noticeable lag when typing.

AIMAIM ($2.99/Free)

There are two AIM apps from AOL, one that’s free and one that’s $2.99. I’m grouping them together since the only differences between the two are that the free one has ads and the paid version does not. While I found the app to be very responsive, there are two big issues I had: I can only be signed into one AIM account, and all push notifications have an SMS-style popup. I couldn’t stop the pop-ups, but I could control how much information was displayed — the ranges are from “new IM” to the full contents of the IM, including sender information. The only reasons I’d recommend this app is if money really is an object, you only have one AIM account, and don’t mind the obtrusive pop-ups.

YahooYahoo! (Free)

Well, about all I can say is, “Yep, it connected to Yahoo.” You can only connect to one Yahoo account and there is no push notification, nor any announced plans for push.

PalringoPalringo (Free)

In my tests, Palringo failed on liftoff. It requires a server-side account, and when I went to setup the account via the iPhone app, the captcha image didn’t even display — really, who needs captcha on an iPhone app? The app does not currently do push, although as of this writing they have submitted a push version for approval. At this point, for a free IM app, I’d recommend IM+ Lite over this one.

skypeSkype (Free)

Since the purpose of this article is IM apps, I’m going to gloss over the voice portion of the Skype app, which is arguable its greatest benefit. However, I was able to connect to my Skype account and IM with friends just fine. There are no push notifications for IMs, however.

Fuze MessengerFuze (Free)

Fuze is another one that requires its own server-side account to run. You can also only connect to one account of each protocol, and there are no push notifications. Also, for some reason even after quitting the app, it kept me online, but I didn’t receive a test message I sent myself when I logged back in. As with Palringo, if you need an IM app that’s free, go with IM+ Lite.
Chart of Instant Messenger Features

For free apps, IM+ Lite blew the doors off the competition. I could connect to multiple protocols and multiple accounts.

In the paid category, while it was a close race, I felt Beejive edged out IM+ Push. While the ability to stay online longer than 24 hours was nice, I felt the speed and the ability to quickly see received IMs edged Beejive over the finish line.

Source: http://theappleblog.com/2009/07/15/10-instant-messaging-apps-for-the-iphone/
Author:

Secure Peer-to-Peer Networks Give Trust to File Exchange.

These local Peer-2-Peers LANs let you transfer files of any kind with your close friends only, wasting concerns over virus dangers that have discouraged many people from using public file-sharing networks like Kazaa, Emule, Torrent.

Jackson West, PC World

Stephane Herry says that he founded his private file-sharing network GigaTribe out of frustration at not being able to share files with his friends on Kazaa. Every time he searched for a file that he knew a friend had uploaded, he saw only similar files uploaded by strangers.

Why not, Herry thought, create a peer-to-peer (P2P) application that permitted only trusted sources to share files? Such a network would be far more secure, because you’d be sharing files exclusively with people you know and trust--not with complete strangers, some of whom may wittingly or unwittingly be spreading viruses.

Herry’s idea is proving to be popular. Some of the biggest names in public peer-to-peer file sharing now offer private alternatives. In its latest release, venerable file-sharing client LimeWire now allows users to share files privately with contacts that it pulls from Google or LiveJournal contact lists. Azureus Vuze, a popular BitTorrent client, added a FriendBoost feature to speed torrent downloads by sharing them within a group of trusted users.

In the past few years, private file sharing has evolved, steadily improving in speed, security, and functionality. Depending on what you're looking for, you can probably find a software product or Web app that’s perfectly suited to help you and your friends (or coworkers) share anything from spreadsheets to home movies legally, safely, and privately.

We took a look at four applications that promise secure, efficient file sharing among private groups: QNext, GigaTribe, 2Peer, and LogMeIn's Hamachi.
QNext

QNext; click for full-size image.File sharing is just one of the features offered by QNext. It's primarily designed to serve as an integrated communications suite, with IM, voice, and video-chat components. But it also allows you to share files securely--with no size restrictions--and it has special photo and music capabilities as well. Finally, QNext even lets you gain remote access to your computer through a standard Web browser.

Installation and set up are painless. You simply download the software (QNext is available from PC World's Downloads library), install it, and create an account--and you can begin adding IM accounts and creating folders of files that you want to share. Network configuration and input device detection--for hardware such as microphones and cameras--is automatic. To add friends, you enter your log-in data for popular instant messaging systems like AIM and Google Talk, and then ask your friends to download, install, and register for QNext.

Once you have one or more friends enrolled in your list of QNext contacts, you can set up shared folders through “zones.” Click File, Share Content to open the QNext explorer. Then click Share Folders and Files and drag and drop the data you want to share. You can set up secure sharing by adding only QNext contacts, or you can make the files publicly available to anyone with a Web browser by selecting 'Broadcast to Web browsers'.

The interface of the application opens with a vertical list of contacts from the IM accounts that you added during initial setup. You gain access to more features, options, and settings by clicking the blue monitor icon for the Explorer. In the Explorer you set up groups of shared files and folders, as well as permissions for access--one folder could be public, another could be for one specific user. The Explorer is also where you manage other settings, including chat, video, and audio. From there, you can set up shared files and folders, and browse and search data that others have shared with you.

One particularly nice aspect of QNext is that other users needn't have the application installed in order to receive messages, shared files, or photos, or even to listen to music streamed from your shared library. QNext's servers make much of your content available publicly via browsers, if you wish, so you can simply send a URL over IM or e-mail. If you want the transfers to be private and secure, however, both parties must have QNext installed.

You'll also need to have QNext turned on and running if you or your contacts need to access the data or use the machine via remote access. This is great if you have a machine at home or at the office that is online around the clock anyway. If you use a laptop, turning off your machine, letting it lapse into sleep or standby mode, or losing your Internet connection will cut off anyone who is connected to a download or stream from one of your music playlists.

Another potential bottleneck is bandwidth. Contacts can access files and streams only as fast as your machine can upload--and since most personal users on networks have limited upstream bandwidth, simultaneously downloading or streaming more than a few files music from your machine will quickly push it to the limit.

QNext is a free download available for Windows, Mac, and Linux operating systems. Versions for the iPhone, the iTouch, and Google Android-powered smartphones are currently in the beta stage.


Source: http://www.pcworld.com/article/168011/private_p2p_networks_add_trust_to_file_sharing.html

Opera Browser Application Unite – File Sharing, Instant Messaging, Note Taking & more.

Unite is a ‘plugin’ that was installed to a version of Opera 10 Beta. It’s an incredibly small server integrated into the Opera browser. This platform enables you to run various plugins or mini applications that accomplish different tasks such as file sharing, note sharing, photo sharing, secure notes and instant messaging.

Unite eliminates the need for a third party server that would normally proxy or relay the content, such as Yahoo Messenger, Flickr, Twitter. It’s essentially like setting up a web server on your own computer, without the hassle of manually installing various software, configuring them and getting a DNS (Domain Name System) account. It also makes the installation of new functionality a “point and click” process.

You will now be able to start any of the services listed in the left sidebar, such as file sharing. They are designed to be extremely easy to use. For example, to enable File Sharing, click on the File Sharing icon and then on Start. To protect your privacy, it will ask you to select the folder that you want to share.

After you click the OK button, a web page will open that will showcase the content you selected in the previous step. On the left, you’ll see your files, on the right the instructions for sharing with your friends and the permissions. All your friend has to do to access the files is to paste the link given in the right sidebar. A regular webpage will appear in your friend’s browser along with download links for all the files.

All the files are hosted on your computer and are never transferred to Opera’s servers. For the duration you wish to allow users to connect to your Unite services, you need to have the computer and browser open. Be aware that transferring unencrypted sensitive information is not recommended, as all transfers are done using HTTP. The Photo, Media and File Sharing use the same underlying technology while adding specific controls for each media type like a Flash music player and photo thumbnails.

This technology is not limited to the 5 bundled applications: Fridge (secure notes), Lounge (instant messaging), Photo and File Sharing, Media Player. It’s open to developers and uses well-known open standards such as HTML, CSS and JavaScript.

Below is a screenshot of the Lounge, a quasi-instant messaging application. To invite other people, the host needs to send a link to the other participants. They can use any modern web browser to join the discussion. It is similar in functionality to a private IRC channel.

The Fridge application lets you leave notes for friends or yourself, similar to the ‘Wall’ on Facebook or direct messaging in Twitter.

You can write applications — in the form of Opera Unite Services — that use this server to serve content to other Web users. Why is this exciting? Well, it allows you to interact with contacts, sharing data and services without the need for any third-party Web sites/applications to be involved at all. –Opera Developer Blog

Opera lets the geeks get a taste of the next paradigm shift in web browsing, a great way to win hearts, minds and developers. I’ve radically changed my tune about Opera after hearing from tens of fans and Thomas Ford, Communications Manager.

I invite each one of you to give Opera Unite a try. Download the alpha which is available for Windows, Mac and Linux; and let us know what you think in the comments. What applications should the developers start working on to further extend Unite’s functionality?

Author: Stefan is a computer science student who enjoys coding in C++, playing with 'network security' and supporting FLOSS. He's the guy behind the Tux Geek.