A Systematic Characterization of IM Threats Using Honeypots
The popularity of InstantMessaging (IM) services has recently attracted the interest of attackers that try to send malicious URLs or files to the contact lists of compromised instant messaging accounts or clients. This paper focuses on a systematic characterization of IM threats based on the information collected by HoneyBuddy, a honeypot-like infrastructure for detecting malicious activities in IM networks. HoneyBuddy finds and adds contacts to its honeypot messengers by querying popular search engines for IM contacts or by advertising its accounts on contact finder sites. The deployment has shown that with over six thousand contacts the authors can gather between 50 and 110 malicious URLs per day as well as executables.