Spamming Google Talk

Here’s more evidence that Instant Messaging may be more trouble than it’s worth in the enterprise. While it’s enormously useful, it’s also common for users to not take the same precautions that they would with email. We’ve done a fairly good job of training users to be suspicious of emails coming from strangers and containing links or attachments, but people tend to trust IM to a greater extent for some reason.

Last week, Google detected a phishing scam that leveraged Google’s Google Talk instant messaging system. In the scam, an unsolicited chat message appears, encouraging the recipient to “check out a video” on a Web site called “ViddyHo”. The message then contains a TinyURL link, which takes the victim to a site where they are then asked to enter in their Google Talk or Gmail login.

The hacker could then access the victim’s Gmail, including all correspondence and the address book. Google did address the problem and has blocked the originating IP address. TinyURL also blacklisted the site. However, the hacker could still theoretically continue, resorting to other phishing URLs.

I don’t use instant messaging often, but I do from time to time, and I’ve seen these unsolicited messages pop up. Sometimes they can be confusing. They attempt to trick the recipient into thinking that there is someone they know on the other end, by taking a casual tone. It’s only natural, when somebody sends you an IM saying “Hi, how you doing, haven’t heard from you in a while”, to think that it must be an old acquaintance–but it’s not always the case. Before you engage in a conversation, make sure the sender is legitimate, and really is somebody you know!