Is using IRC safe? [closed]

Question

I recently started using Internet relay chat and found it really interesting regarding my work. Here i could find people who are working in the same technologies as I am. I wanted to install an IRC client (Chatzilla in Firefox) in my office computer for this purpose but my boss said that IRC is not allowed in the office as it is a 'entry point' for various viruses and trojans? I am using it at home but its not enough for me.

So could you provide me a clear picture of the security concerns regarding IRC so that I can perhaps convince my boss in installing it?

Answer 1

Unless you accept files via IRC, you're effectively safe. Just practice a sort of defensive computing where you don't click untrusted links, accept unsolicited files, etc.

The real security concern with IRC (on a lot of networks) is that your computer's host/ip are out there for the people you are talking to to view.** If you're talking with mature adults, this shouldn't pose a problem. If you're talking to someone who's just there to create mischief (or you really piss someone off) then they have your host/ip to attack.

So all in all, stick to safer networks where they will mask your hostname so attackers won't know who to attack. Freenode is a good one for open source software projects, but there are others.

And keep your client software up to date, of course. Or use a web-based client like mibbit.

**Unless you are covering your tracks using a proxy, a bouncer, using IRC on a shell box, or something similar. In this case, they will have the address of the machine that you are connecting directly to.

Answer 2

My guess is that your boss is confusing things. Many worms use IRC, but not to spread. They actually receive their commands from their master via IRC. This is only after they infected some system, though.

The Wikipedia article about botnets has more.

Answer 3

Also keep in mind, that IRC is just a protocol. Using an old outdated client of the most popular IRC software (mIRC), is a huge risk compared to using a linux client, the most recent version of mIRC or some other clients that are around. And of course the most worms/(evil) bots/spammers are using the big networks, so it also depends what network you connect to. QuakeNet, ircnet, etc. will usually have a lot of them.

Answer 4

IRC is more vulnerable than other networks, in many cases it's possible to find an IP, and thus one's computer, from a simple /whois, but a good firewall would block any attempts to actually use said IP.

If you can set up an IRC client on your home PC, or a spare server (oh sure, I have one in my pocket), I imagine you could make a good argument for tunnelling in being safe.

(To be fair, IRC is possibly the thing that's been MOST detrimental to my productivity :P)

Answer 5

You could mitigate the perception of a security risk by running the IRC client on a remote host and SSHing to that - this is trivial if you have an always-on *nix box at home - doesn't need to be particularly powerful.

This removes the IRC point of entry to your place of work - might appease the boss?

Answer 6

There's no such risk with the IRC protocol itself. The risk is when join a IRC network and get send various virus-infected files. Some IRC clients had vulnerabilities which were taken advantage of by the viruses, but the risk exists even for other programs.

Some keylogger malware/viruses sent their logs to IRC channels where it would be picked up by the virus author.

Here is some reading:

http://www.mirc.com/help/virus.html

Background information

In short: trojan worm attacks are attractively disguised files that you download and run, resulting in harmful and dangerous consequences ranging from takeover of your IRC channels, erasing of your hard disk, theft of your account passwords, etc. Almost always your infected machine starts to spread the worm by itself, by E-mail and IRC. These (Trojan) viruses and worms are not mIRC or IRC specific, they just spread like fire on IRC.

Trojans are typically files with suffices like ".ini", ".exe", ".com", ".vbs" or ".js" such as "dmsetup.exe". (http://www.geocities.com/SiliconValley/Heights/3652/dmsetup.html) These days nearly all trojans are spread in the guise of a bugfix, free game or other software. You probably downloaded one from a WWW or FTP archive, ICQ file exchange, or through IRC's DCC file transfer (by manual /dcc get or, even worse, an "auto DCC get" feature which allows anybody to send you anything, including not only trojans but also viruses, porn, and other illegal things). Typically the trojan needs to be run manually, and installs hacked files all over your disk silently.

Read the part "A small list of mIRC related viruses" (it's too long to quote here).

Answer 7

IRC is a lot less risky that browsing the internet, or getting email. If you're running a decent AV, and you never accept files from people, you should be fine.

The bigger risk with IRC is that it's a very simple protocol, and sends messages in plaintext, so unless you're connecting with SSl, sniffing it and reading your convo is childs play.

Answer 8

Your Boss doesn't allow IRC so the answer is that you could lose your job if you still install it on your office computer. Am amazed that your boss did allow the use of Firefox, though! Managers who are paranoid generally tend to disallow anything that's not a Microsoft product.

And from personal experience, trying to convince your Boss that you are right and he's wrong could be risky too. With luck, he'll give you just some nasty talk to get you to shut up. You would need something real convincing to get him to change his mind. Also, be aware that if you force him to change his mind, he might think that you've made a fool out of him. Been there, done that. Fortunately, my Boss had an ever Bigger Boss who also realized that I was right and that my Boss was lacking experience. So I kept my job and had a new Boss. My old Boss was sent home for a long holiday before he started to work somewhere else.

In other words, it might not be a very good idea to try to convince your Boss. (Especially on something trivial as IRC!)