Solved

Is it secure to use PJIRC chat?

Posted on 2009-07-13
7
451 Views
Last Modified: 2012-05-07
Hi,

Is it secure to use the IRC applet on a website?

The files are:
irc.cab/.jar
pixx.cab/.jar
irc-unsigned.jar
secured-irc.cab
secured-unsigned.cab

Or will a hacker could use the accss or commands through the chat to compromise the security of a IIS server?

If You know of some security issues, please summarize them and list a solution, if You know them :)

Maybe its secure if whole website is through SSL?
Or maybe I should use specific securedirc files?
0
Comment
Question by:loopstudio
  • 3
  • 2
7 Comments
 
LVL 7

Expert Comment

by:Phateon
ID: 24839994
Any HTTP is NOT secure. It is always suggested that you use HTTPS. pjIRC per se is a project which has been developed with clear non-malicious intentions. However, if you were to unpack & recompile them .java archives, you can create a backdoor. It is always good to use a site which is trusted rather than using a site which is not trusted.
0
 

Author Comment

by:loopstudio
ID: 24840387
A)
So I hear You say.. If the whole site is in HTTPS and the PJIRC files are downloaded "as is" from original website, then everything should be as safe as possible?

B)
and/or do I need to do something specific to use the
secured-irc.cab
secured-unsigned.cab
files? Or will PCIRC work fine and secure in normal setup?

C) So all the commands thats possible to fire/write in the chatwindow, there should be no security-compromising commands?
0
 

Author Comment

by:loopstudio
ID: 24840399
an D)
Isnt there something about that people can log on to my chatgroup from whatever chat-client, maybe not using PCIRC, and will it through that way be unsecure?
0
Scale it in WD Gold

With up to ten times the workload capacity of desktop drives, WD Gold hard drives employ advanced technology to deliver among the best in reliability, capacity, power efficiency and performance.

 
LVL 7

Expert Comment

by:Phateon
ID: 24840419
What I meant was, if you use plain HTTP, people can sniff, edit, replay,etc. your HTTP session.
With an HTTPS session, you are better off! They can only replay.
0
 
LVL 33

Accepted Solution

by:
Dave Howe earned 125 total points
ID: 24841031
the traffic is not secure - ie your traffic to the IRC server is no more secure than it would be if you were using a local client (such as chatzilla or mirc)

however, the applet does not induce any vulnerabilities in your webserver - you are merely serving it, like any other web page or content, and it runs locally on the remote machine.
0
 

Author Comment

by:loopstudio
ID: 24842741
ok, so its just the "text" that poeple write forth and back in the chat traffic that can be sniffed?
And nothing can go through to my webserver, even I have their cab & jar files on my server?

If the above is true, I will close and reward points :)
Thanx
0

Featured Post

Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

It’s a strangely common occurrence that when you send someone their login details for a system, they can’t get in. This article will help you understand why it happens, and what you can do about it.
How important is it to take extra precautions to protect your online business? These are some steps you can take to make sure you're free of any cyber crime.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now