• PC World
• » Software
• » Antivirus and Security

Zone Labs, maker of the popular ZoneAlarm firewall, is extending its security expertise to instant messaging with the release this week of IMsecure Pro, software designed to block invaders from the most widely-used messaging programs.

IMsecure Pro 1.0 runs on a desktop system and protects against inbound threats like malicious code and spam, says Frederick Felman, Zone Labs vice president of marketing. Users can also choose to block certain IM features, such as file transfers and voice and video chats. The program also supports encryption for messages sent between IMsecure users. It can even stop you from inadvertently releasing private data.

Available as a $19.95 download from Zone Labs, the program includes one year of security updates. After that, the fee is $10 yearly. Zone Labs is also introducing a 15-day trial version of the Pro version and a bare-bones IMsecure 1.0 as a free download for personal and nonprofit use. Both programs run on all recent Windows operating systems.

Basic Blocking

IMsecure Pro applies Zone Labs' "guilty until proven innocent" security philosophy by blocking favorite hacker tricks like spam, IM-borne scripts, and buffer overflow attacks (such as was used by the Slammer worm). It also protects outbound data with 56-bit DES encryption when users at both ends are employing IMsecure Pro.

One interesting feature, MyVault, stores credit card numbers, your Social Security number, or other information you identify as critical and protects it with SHA-1 hashing. If a coworker, a child--or, in a moment of weakness, you--starts to release MyVault information over IM, MyVault blocks it from leaving your PC and warns you that you tried to send confidential data into the wild.

It's intended to thwart identity thieves who coerce people into revealing information, Felman says. "It's confidence fraud," he explains. The casual nature of instant messaging causes people to forget they don't really know the correspondent, he says. "And they give them more information than they should. MyVault reminds people that you shouldn't do that. If you start to type in certain information you've called confidential, it warns you and blocks it on the other side."

Spammers have clued into IM as a tool to gather data, Felman says; so IMSecure includes a Spam-Blocker function.

"They realize that mail names correspond with account names," and check for a valid e-mail address by sending an instant message, Felman says. Spam-Blocker keeps the unwelcome messages from appearing on your screen, protecting you not only from IM spam, but possibly from e-mail spam, too.

IMSecure Pro works with AOL Instant Messenger (AIM), Microsoft's MSN Messenger, and Yahoo Messenger, which, combined, are the choice of over 90 percent of IM users, according to Zone Labs. It also supports those IM programs when used through an aggregator application, such as Trillian. However, it does not support IM services other than those three, such as ICQ, even when it is running through an aggregator, Felman says.

The free version, IMSecure, offers only two of the Pro version's features. It blocks incoming buffer overflow attacks and provides encryption for one user ID on one of the three services. Zone Labs says this version is intended for personal and nonprofit use only. The 15-day trial version of IMSecure Pro includes all Pro features.

Enemies Everywhere

As the popularity of instant messaging soars with both businesses and consumers, IM proponents concede that it becomes more alluring to hackers, spammers, and identity thieves. And while even novice computer users now screen incoming e-mail for viruses, the rapid pace and firewall-penetrating capabilities of IM leave gaping security holes that attract malicious intruders and make businesses nervous.

Some 582 billion IMs are sent daily, according to marketing consulting firm Radicati Group. This could mean billions of useful or entertaining exchanges--and billions of security risks.

Since messaging programs penetrate firewalls, they operate in most work environments but are also convenient for the hackers who covet the data on your office network or your home PC, proponents concede.

And businesses sometimes react harshly when IM raises security concerns; 27 percent of companies that experience a network breach through IM have banned the use of messaging, according to Osterman Research. If, as Osterman estimates, nearly one in five workers uses IM for business, cutting off messaging eliminates a powerful productivity channel.

Zone Labs obtained the IM security technology by acquiring IMsecure, a two-person firm, about two months ago.

Felman says the most similar competitor is an AIM certificate service from Verisign, which also costs $19.95 for a client program, but both correspondents must have it installed to be effective.

• See more like this:
• IMSecure,
• Zone Labs,
• instant messaging,
• instant messenger,
• IM,
• AIM,
• MSN Messenger,
• Yahoo Messenger,
• Trillian,
• security,
• hacker,
• firewall