irc and security threats

[Reginald Choudari]

hello,

we have been trying to get IRC access at my company since we do a lot of dev work with open source projects. currently we have been using a "workaround" while waiting for the infrastructure guys to deploy to us a "VDI solution" for us to use ... methinks it will take a long while.

their reasoning for not allowing access right off the bat is due to risks involving worms, viruses, trojans, etc.. which brings me to my question.

what are the real security threats in using IRC? worms/viruses/trojans require SOME user action to actually access a link or run an executable, so on and so forth.. what else could using IRC potentially make us vunerable?

thanks,
reginald

[s***@gmail.com]

Post by Reginald Choudari
what are the real security threats in using IRC? worms/viruses/trojans require SOME user action to actually access a link or run an executable, so on and so forth.. what else could using IRC potentially make us vunerable?

You'd be correct that the largest real risk is social engineering. This is a risk you are already exposed to with regard to email, so it should be nothing new to your security team.

The IP address that actually makes the connection to the IRC server will be visible, as this is a fundamental part of how IRC users are uniquely identified to the network. In the case of users behind a corporate firewall or NAT router this usually means the external address of the gateway or router. As this host will be "advertised" to other users as a function of how the IRC protocol works, it should be adaquitely secured against possible intrusion.

The exposed IP address creates three concerns - privacy, denial of service, and possibility of intrusion. If it is problematic to the company if users are seen by their hostname to be affilated with the company on IRC, it may be desirable to route IRC connections through an outgoing connection that isn't obvsiously associated with your company. I've already discussed the intrusion possibility, these attacks will be directed against the public IP of your gateway, which likely already fends off thousands of such attacks a day.

Denial of service attacks related to IRC should be a concern, but how serious of one depends on the behavior of your users on IRC and which users they interact with. There are malicious users in control of large, sophisticated botnets used for distributed denial of service. These botnets can be used for sustained DDoS attacks large enough to cripple the most robost networks on earth. The good news however, is that it's almost unheard of for people on developer-oriented channels and networks to be targeted by such attacks, unless they've gone out of their way to provoke someone capable of performing them. Keep your users out of the warez and hacking channels though, because it's a matter of time before you get attacked in these places.

In summary, stay in well lighted neighborhoods, be mindful of social engineering, always keep your OS and other software up to date, never connect from a computer that has it's own public IP address or has ports forwarded to it, keep the perimeter secure, and always be professional, rather than provocative on IRC, and your risk will be minimal.

[yamo']

Hi,

Post by Reginald Choudari
hello,
we have been trying to get IRC access at my company since we do a lot of dev work with open source projects. currently we have been using a "workaround" while waiting for the infrastructure guys to deploy to us a "VDI solution" for us to use ... methinks it will take a long while.
their reasoning for not allowing access right off the bat is due to risks involving worms, viruses, trojans, etc.. which brings me to my question.
what are the real security threats in using IRC? worms/viruses/trojans require SOME user action to actually access a link or run an executable, so on and so forth.. what else could using IRC potentially make us vunerable?

Without using dcc-send, irc is not dangerous at all.

I'm using irc since 1999 without any troubles : I only had a virus on
NT4 with a bad version of pirch 98 downloaded on an obscure web site in
1999!