Is MSN messenger a security risk on a corporate network?

  • Thread starter Thread starter David Lewis
  • Start date Start date
D

David Lewis

I am looking for proof both ways as to is MSN Messenger a security risk.
The boss seems to think so and wants it banished from the network, but I think
its a valuable communication tool. I need to be able to secure our network and
prove that it is not a security risk. I don't even know of any exploits on MSN IM?
 
Greetings David,

There are no known exploits at this time (not in any version that is actually supported on
the .NET Messenger network). The only real security risk is people sending files or
discussing confidential topics -- but really, that could be done via e-mail already (of
course, assuming e-mail is accessible).
____________________________________________
Jonathan Kay
Microsoft MVP - Windows Messenger/MSN Messenger
Associate Expert
http://www.microsoft.com/windowsxp/expertzone/
Messenger Resources - http://messenger.jonathankay.com
 
And if file transfers via IM are considered a "security risk", they can be
disabled on each client at the GPO / registry level.
 
Whoops! Sorry about that. I looked at the newsgroup, but not close enough at
the subject. ;^)
 
Hi Chris,

No problem =). I only correct stuff like this because I know there's plenty of people who'll
search for this information later (Google) and I like them to have the right information
(when my name is attached in the thread anyway).
____________________________________________
Jonathan Kay
Microsoft MVP - Windows Messenger/MSN Messenger
Associate Expert
http://www.microsoft.com/windowsxp/expertzone/
Messenger Resources - http://messenger.jonathankay.com
 
Understood. I find Google invaluable to find [your] responses to my postings
made even a few weeks ago; they seem to disappear from MS's newsserver
quicker than they used to.
 
Jonathan

Then where does company owners get information like this. This is not the first time I have heard this argument.
Can you refer me to any independant articles on the subject?

BTW whats the difference between windows messenger and msn messenger? They sure look close.
Why the 2 products?

"Jonathan Kay [MVP]" <[email protected]>
|>Greetings David,
|>
|>There are no known exploits at this time (not in any version that is actually supported on
|>the .NET Messenger network). The only real security risk is people sending files or
|>discussing confidential topics -- but really, that could be done via e-mail already (of
|>course, assuming e-mail is accessible).
|>____________________________________________
|>Jonathan Kay
|>Microsoft MVP - Windows Messenger/MSN Messenger
|>Associate Expert
|>http://www.microsoft.com/windowsxp/expertzone/
|>Messenger Resources - http://messenger.jonathankay.com
|>
|>> I am looking for proof both ways as to is MSN Messenger a security risk.
|>> The boss seems to think so and wants it banished from the network, but I think
|>> its a valuable communication tool. I need to be able to secure our network and
|>> prove that it is not a security risk. I don't even know of any exploits on MSN IM?
|>
 
Hi David,

I haven't seen any articles on e-mail vs. IM security, perhaps I could write one =).

There are several differences between the two clients. Most notably, MSN Messenger 6 has
support for display pictures, custom emoticons, has a different interface, etc. whereas
Windows Messenger supports SIP-based communications services, Exchange IM Server, etc. Which
one you use is up to you, and a matter of personal choice (and based upon your needs and
likes), however one thing to keep in mind, Windows Messenger must still be installed on
Windows XP in order for MSN Messenger to retain full functionality (Remote Assistance,
Whiteboard, Application Sharing, etc.).

MSN Messenger is centered around MSN technologies (Hotmail, MSN Member Profiles, MSN Mobile,
etc.) whereas Windows Messenger is centered around Windows technologies (Exchange Server,
Office Live Communications Server, Windows Netmeeting, etc.).

Both clients however can make use of Microsoft technologies, like the .NET Messenger service,
..NET Passport and .NET Alerts.
____________________________________________
Jonathan Kay
Microsoft MVP - Windows Messenger/MSN Messenger
Associate Expert
http://www.microsoft.com/windowsxp/expertzone/
Messenger Resources - http://messenger.jonathankay.com
 
I will be upgrading to exchange 2003 in the near future.

So are you saying that MSN Messenger can connect to an exchange server?

I had msn messenger installed on my windows 2000 desktop and I could not find
the option to log into an exchange server. So I downloaded windows messenger with
exchange support from microsoft.com and installed it. It said I had to let it uninstall my
old version of messenger. Now I noticed that I am missing some of the features of
msn messenger :) So if I want exchange and msn, which version of messenger should
I use?

Dave

"Jonathan Kay [MVP]" <[email protected]>
|>Hi David,
|>
|>I haven't seen any articles on e-mail vs. IM security, perhaps I could write one =).
|>
|>There are several differences between the two clients. Most notably, MSN Messenger 6 has
|>support for display pictures, custom emoticons, has a different interface, etc. whereas
|>Windows Messenger supports SIP-based communications services, Exchange IM Server, etc. Which
|>one you use is up to you, and a matter of personal choice (and based upon your needs and
|>likes), however one thing to keep in mind, Windows Messenger must still be installed on
|>Windows XP in order for MSN Messenger to retain full functionality (Remote Assistance,
|>Whiteboard, Application Sharing, etc.).
|>
|>MSN Messenger is centered around MSN technologies (Hotmail, MSN Member Profiles, MSN Mobile,
|>etc.) whereas Windows Messenger is centered around Windows technologies (Exchange Server,
|>Office Live Communications Server, Windows Netmeeting, etc.).
|>
|>Both clients however can make use of Microsoft technologies, like the .NET Messenger service,
|>.NET Passport and .NET Alerts.
|>____________________________________________
|>Jonathan Kay
|>Microsoft MVP - Windows Messenger/MSN Messenger
|>Associate Expert
|>http://www.microsoft.com/windowsxp/expertzone/
|>Messenger Resources - http://messenger.jonathankay.com
|>
|>> Jonathan
|>>
|>> Then where does company owners get information like this. This is not the first time I
|>have heard this argument.
|>> Can you refer me to any independant articles on the subject?
|>>
|>> BTW whats the difference between windows messenger and msn messenger? They sure look
|>close.
|>> Why the 2 products?
|>>
|>> "Jonathan Kay [MVP]" <[email protected]>
|>> |>Greetings David,
|>> |>
|>> |>There are no known exploits at this time (not in any version that is actually supported
|>on
|>> |>the .NET Messenger network). The only real security risk is people sending files or
|>> |>discussing confidential topics -- but really, that could be done via e-mail already (of
|>> |>course, assuming e-mail is accessible).
|>> |>____________________________________________
|>> |>Jonathan Kay
|>> |>Microsoft MVP - Windows Messenger/MSN Messenger
|>> |>Associate Expert
|>> |>http://www.microsoft.com/windowsxp/expertzone/
|>> |>Messenger Resources - http://messenger.jonathankay.com
|>> |>
|>> |>> I am looking for proof both ways as to is MSN Messenger a security risk.
|>> |>> The boss seems to think so and wants it banished from the network, but I think
|>> |>> its a valuable communication tool. I need to be able to secure our network and
|>> |>> prove that it is not a security risk. I don't even know of any exploits on MSN IM?
|>> |>
|>>
|>
 
PS I think I really need to see some sort of proof in writting that IM is not a security risk to a company.
That is the only way I am going to be able to convince ownership that it is not a security risk. They seem convinced
that some hacker is gona break in through IM. My first step to implementing it will be exchange only messenging.
I think that will go over without my issue. But enabling msn IM is another story.

"Jonathan Kay [MVP]" <[email protected]>
|>Hi David,
|>
|>I haven't seen any articles on e-mail vs. IM security, perhaps I could write one =).
 
Hi David,

Exchange 2003 doesn't actually have an IM server -- the Exchange IM Server is limited to
Exchange 2000 only.
Instead, you'll need to use Live Communications Server:
http://office.microsoft.com/livecomm

You cannot use the display pictures, custom emoticons, etc. in MSN Messenger with Exchange or
Live Communications Server, MSN Messenger is limited to the public .NET Messenger network
only, you *have* to use Windows Messenger 5 (which obviously doesn't support these things).
____________________________________________
Jonathan Kay
Microsoft MVP - Windows Messenger/MSN Messenger
Associate Expert
http://www.microsoft.com/windowsxp/expertzone/
Messenger Resources - http://messenger.jonathankay.com
 
wow I can't believe it
First the feature was free in 2000
and now they make you pay extra for it


"Jonathan Kay [MVP]" <[email protected]>
|>Hi David,
|>
|>Exchange 2003 doesn't actually have an IM server -- the Exchange IM Server is limited to
|>Exchange 2000 only.
|>Instead, you'll need to use Live Communications Server:
|>http://office.microsoft.com/livecomm
|>
|>You cannot use the display pictures, custom emoticons, etc. in MSN Messenger with Exchange or
|>Live Communications Server, MSN Messenger is limited to the public .NET Messenger network
|>only, you *have* to use Windows Messenger 5 (which obviously doesn't support these things).
|>____________________________________________
|>Jonathan Kay
|>Microsoft MVP - Windows Messenger/MSN Messenger
|>Associate Expert
|>http://www.microsoft.com/windowsxp/expertzone/
|>Messenger Resources - http://messenger.jonathankay.com
|>
|>
|>
|>> I will be upgrading to exchange 2003 in the near future.
|>>
|>> So are you saying that MSN Messenger can connect to an exchange server?
|>>
|>> I had msn messenger installed on my windows 2000 desktop and I could not find
|>> the option to log into an exchange server. So I downloaded windows messenger with
|>> exchange support from microsoft.com and installed it. It said I had to let it uninstall my
|>> old version of messenger. Now I noticed that I am missing some of the features of
|>> msn messenger :) So if I want exchange and msn, which version of messenger should
|>> I use?
|>>
|>> Dave
|>>
|>> "Jonathan Kay [MVP]" <[email protected]>
|>> |>Hi David,
|>> |>
|>> |>I haven't seen any articles on e-mail vs. IM security, perhaps I could write one =).
|>> |>
|>> |>There are several differences between the two clients. Most notably, MSN Messenger 6 has
|>> |>support for display pictures, custom emoticons, has a different interface, etc. whereas
|>> |>Windows Messenger supports SIP-based communications services, Exchange IM Server, etc.
|>Which
|>> |>one you use is up to you, and a matter of personal choice (and based upon your needs and
|>> |>likes), however one thing to keep in mind, Windows Messenger must still be installed on
|>> |>Windows XP in order for MSN Messenger to retain full functionality (Remote Assistance,
|>> |>Whiteboard, Application Sharing, etc.).
|>> |>
|>> |>MSN Messenger is centered around MSN technologies (Hotmail, MSN Member Profiles, MSN
|>Mobile,
|>> |>etc.) whereas Windows Messenger is centered around Windows technologies (Exchange Server,
|>> |>Office Live Communications Server, Windows Netmeeting, etc.).
|>> |>
|>> |>Both clients however can make use of Microsoft technologies, like the .NET Messenger
|>service,
|>> |>.NET Passport and .NET Alerts.
|>> |>____________________________________________
|>> |>Jonathan Kay
|>> |>Microsoft MVP - Windows Messenger/MSN Messenger
|>> |>Associate Expert
|>> |>http://www.microsoft.com/windowsxp/expertzone/
|>> |>Messenger Resources - http://messenger.jonathankay.com
|>> |>
|>> |>> Jonathan
|>> |>>
|>> |>> Then where does company owners get information like this. This is not the first time I
|>> |>have heard this argument.
|>> |>> Can you refer me to any independant articles on the subject?
|>> |>>
|>> |>> BTW whats the difference between windows messenger and msn messenger? They sure look
|>> |>close.
|>> |>> Why the 2 products?
|>> |>>
|>> |>> "Jonathan Kay [MVP]" <[email protected]>
|>> |>> |>Greetings David,
|>> |>> |>
|>> |>> |>There are no known exploits at this time (not in any version that is actually
|>supported
|>> |>on
|>> |>> |>the .NET Messenger network). The only real security risk is people sending files or
|>> |>> |>discussing confidential topics -- but really, that could be done via e-mail already
|>(of
|>> |>> |>course, assuming e-mail is accessible).
|>> |>> |>____________________________________________
|>> |>> |>Jonathan Kay
|>> |>> |>Microsoft MVP - Windows Messenger/MSN Messenger
|>> |>> |>Associate Expert
|>> |>> |>http://www.microsoft.com/windowsxp/expertzone/
|>> |>> |>Messenger Resources - http://messenger.jonathankay.com
|>> |>> |>
|>|>> |>> |>> I am looking for proof both ways as to is MSN Messenger a security risk.
|>> |>> |>> The boss seems to think so and wants it banished from the network, but I think
|>> |>> |>> its a valuable communication tool. I need to be able to secure our network and
|>> |>> |>> prove that it is not a security risk. I don't even know of any exploits on MSN IM?
|>> |>> |>
|>> |>>
|>> |>
|>>
|>
 
Back
Top