[ISN] Instant messaging used for leaks

[InfoSec News]

http://www.theinquirer.net/?article=17988

By Tony Dennis
20 August 2004

TECHNICALLY SAVVY CITY types who work in London's financial
institutions have woken up to the fact that their emails are being
tapped. So they've taken to using instant messaging (IM) instead.

This discovery came to light when a leading forensic firm, Kroll
Ontrack, spoke to Britain's FT. Kroll's Adrian Palmer told the FT that
City firms have recently been asking his firm if he can help reveal
how trading secrets have leaked out – probably through IM sessions.

The answer, of course, is that it's very difficult to capture
individual users' IM sessions. Particularly since the employers
themselves would probably have to inform their City workers that
they'd put such data capture tools in place.

But Kroll seems to be missing a trick. If City traders have worked out
ways to use IM on their desktops, they certainly will have spotted
that it is relatively easy to join a standard Yahoo! or Messenger IM
session via a mobile phone. All of Microsoft's smartphone offerings
come with a Messenger client by default and there's plenty of Symbian
apps that enable the likes of Nokia smartphones to participate in IM
sessions too.

Worse still, after having conversed on their mobiles via an IM
session, the canny trader could finally pass the crucial bit of data –
such as the name of the company whose shares are involved – via SMS.  
And that would be almost totally untraceable.

Seems like Kroll has opened up a whole new can of worms for the City
regulators to worry about.