Emerging Technology Report

April 7, 2008

Christopher D Parr

1. What does it do?2. Why is it implemented?3. Installation4. Reports5. Conclusion6. Sources

The Symantec IM Detection Utility can quickly andeasily help you identify how many employees in yourorganization are using IM (Instant Messenger).

With the frequency of web attacks via IM increasingevery year, you need an IM security and managementsolution to protect against IM threats.

These IM threats include hackers, malicious code, bots,

and malware intrusions just to name a few. Secure yournetwork with this free software today!

System requirements :Windows 2003 with SP1 (or higher)Minimum 512 MB RAM

- Prerequisites WinPcap version 3.1 or higher (www.winpcap.org)

must be installed before running the application.

Internet Explorer v6.0 SP1 or higher

You must install the Symantec IM Detection Utilityon a machine that is connected to a hub or a switch that,

in turn, connects the network to the Internet.

If you use a switch, you must connect the Symantec IM Detection Utility machine to a monitor port that receives a copy of all

switched packets.

This setup is sometimes referred to as port mirroring.

Monitored Computers

Monitored Computers

IMDU

MAIN SWITCH

MONITORED SWITCH

1. Download all the files from https://www4.symantec.com/Vrt/offer?a_id=32584 to a single folder on the server.

2. Use SymantecIMDUInstaller.exe executable to install and uninstall the service.

3. Run the SymantecIMDUInstaller.exe file. A DOS window is displayed.

4. Type 1 and press Enter. Accept agreement.5. When the installer has finished, the DOS

window is redisplayed stating that you have successfully started the service.

Verifying the Installation

On the Windows desktop, right click onMy Computer and select

Manage>Services and Applications>Services.If the service is installed and started correctly,

the SymantecIMDU servicewill be in the list and its status will be Started.

For testing purposes, make sure to have some IMs up and running.

Accessing the Symantec IM Detection Utility Web interface

Launch Internet Explorer and enter the following URL:

http://localhost:50000

The scan is performed before the Web interface is displayed.

Results are displayed.

This is a handy tool to help detect vulnerabilities within

your network. It takes a little work to install thesoftware, but once it is installed, it is very easy to use.

It is useful to keep tabs on your employees and if theyare accessing IM when they shouldn’t be.

I give it 9/10 for it’s ease of use and also for the quality

of the reports. It loses a point for it’s initial setup.

I believe that this tool will become widely used.

1. WinPcap 4.0.2 download

http://www.mirrorservice.org/sites/ftp.wiretapped.net/pub/security/

packet-capture/winpcap/install/default.htm

2. Symantec IM Detection Utility download https://www4.symantec.com/Vrt/offer?a_id=32584

3. Google

http://www.google.com

4. PC World http://www.pcworld.com/article/id,136574/article.html