Introduction

Instant messaging (IM) and peer-to-peerservices are steadily increasing in popularity and are becoming a greater concern for securityprofessionals and network administrators. Instant messaging usage has increased dramatically inrecent years, and has become a mainstay in corporate environments, with or without the approval ofnetworking and security groups. According to a study by the Radicati Group published in July 2004,instant messaging is used in 85% of corporate environments in North America. According to thereport, it was forecast that there would be 362 million instant messaging users in corporateenvironments, with768 million accounts, using the same public instant messaging services availableto home users.

Peer-to-peer networks are also often accessed from work, where the higher available bandwidthmakes downloading large files more efficient. Instant messaging and peer-to-peer networks functionvery differently in terms of architecture and how they impact the network they reside on. Recently,however, these programs are starting to blur the lines between each other and now ship with many ofthe same features, such as file sharing and communicating with other users. This presents a problemfor network administrators and security professionals. Clients that access these services are ofteninstalled on workstations without permission or company consent, and are designed to work aroundmany of the typical security measures, such as firewalls, that have been put in place to stop theactivity of these services. Instant messaging and peer-to-peer applications open up a host ofsecurity issues in any environment where they are run, from the obvious risks of client-sidevulnerabilities to the less obvious issues and risks associated with copyright...