Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Bug

AOL Instant Messenger Remote Hole 343

Posted by michael from the makes-remote-administration-easier dept.
The DSL Guy writes: "The non-profit security team w00w00.org started off 2002 by uncovering a serious flaw in AOL's Instant Messenger protocol. With over 100 million people registered on the AIM service, this vulnerability poses a serious security risk for Internet users worldwide. This flaw can enable remote users to execute code on any machine logged into the AOL IM service. "So easy to hack, no wonder it's number one!" Details can be found at the w00w00 site."
This discussion has been archived. No new comments can be posted.

AOL Instant Messenger Remote Hole More

AOL Instant Messenger Remote Hole

Comments Filter:

  • How to protect yourself (Score:5, Informative)

    by Mwongozi ( 176765 ) <slashthree AT davidglover DOT org> on Wednesday January 02, 2002 @04:30PM (#2775186) Homepage
    For those who didn't bother to read the article:

    We recommend Robbie Saunder's AIM Filter (http://www.ssnbc.com/wiz [ssnbc.com]) to protect yourselves. A temporary solution is to go into your Preferences and in the Privacy section click "Allow Only Users on My Buddy List" under "Who can contact me."

    • Also, if you're just lazy, you can just wait.

      UPDATE: AOL will be fixing this in the server side within a day or two.

    • AIM Filter being the program that, if not a trojan, at least has various remote access abilities.

      See the bugtraq archive [securityfocus.com] for more information.

      Amusing that its use is recommended in the security advisory.

    • in the Privacy section click "Allow Only Users on My Buddy List" under "Who can contact me."


      you have nice friends. i don't. we get into wars where we warn each other off IM on a daily basis.


      now to go download the exploit and really sock it to 'em!

    • ``We have identified the issue and have developed a resolution that should be deployed in the next day or two,'' AOL's Andrew Weinstein said. ``To our knowledge, this issue has not affected any users.'' ``We'd encourage any software programmer that discovers a vulnerability to bring it to our attention prior to releasing it,'' Weinstein said.


      I'd appreciate it if AOL would get their act together and take some responsibility for writing the piece of crap and its corresponding holes. What ever happened to auditing code? This is just plain ignorance on how to deal with buffer overruns. And probably not a little of Window's holes that the programmers take for granted.

      I just don't like that AOL wants to buy time to spin the issue to save their face by releasing notice of the hole and the cure at the same time, but I also realise that half the jerks out there are going to run this little tool to blow a bunch of random machines on the Internet. Why exactly didn't AOL respond to messages over the holidays? Surely they were staffed by some. I guess they'll make sure to check to see if "they've got mail" next time.

  • You have mail! (Score:3, Funny)

    by Monte ( 48723 ) on Wednesday January 02, 2002 @04:30PM (#2775190)
    ...and now everyone has your mail!

  • Why not wait a day? (Score:2, Insightful)

    by MarkLR ( 236125 )
    Given that the message states AOL will do a server side fix in a day, why not wait ONE DAY before releasing the exploit details.

    • Re:Why not wait a day? (Score:5, Insightful)

      by Monte ( 48723 ) on Wednesday January 02, 2002 @04:33PM (#2775213)
      Given that the message states AOL will do a server side fix in a day, why not wait ONE DAY before releasing the exploit details.

      Perhaps the former was a result of the latter? There's a concept called "lighting a fire under their ass".

      • Re:Why not wait a day? (Score:5, Insightful)

        by ez76 ( 322080 ) <slashdot@@@e76...us> on Wednesday January 02, 2002 @05:04PM (#2775411) Homepage
        Perhaps the former was a result of the latter? There's a concept called "lighting a fire under their ass".
        Can someone please explain to me the moral or ethical mandate that supports/justifies this sort of vigilante thinking? Consider the following off-line scenarios, which to me seem equivalent (someone correct my thinking):
        • A test mode is discovered in a popular residential/commercial building security system whereby anyone can enter such a building by punching in a certain 23-digit code into the alarm keypad. w00w00 drives around town and posts a picture of the affected keypads and the first 21 digits of the code.
        • Certain model year GM vehicles' security systems can be foiled by holding down multiple chiclet keys at once and inserting a metal object into the driver's side door keyhole. w00w00 cruises local mall parking lots, opening the doors of random vehicles, putting a bulletin about the problem on the driver's seat, closing the door, and fleeing.
        • A template and generating function for test AT&T calling card numbers is discovered that permits anyone with the two to make free calls. w00w00 publishes the information.


        All of these actions could have theoretically been done in the name of improving security but in the short-term all they do is recklessly endanger it.

        These actions wouldn't fly in the real world without legal repercussions. And how can you claim that they are done in the interest of the public when so much anonymous public damage could result in the short-term? Is there anyone out there who really believes this isn't being done to take a stab at big corporations for big corporations' sake, by individuals who thrive in the gray area of the law?

        There is at least one long-term upside to w00w00's actions, though. Their actions will hasten the approval of legislation which makes online reckless endangerment as criminal on the Internet as it is in your neighborhood.

        • Re:Why not wait a day? (Score:5, Insightful)

          by YaRness ( 237159 ) on Wednesday January 02, 2002 @05:18PM (#2775487)
          it's different because you can't download a new keypad for your security system or car, but you can easily download and apply a patch for a program. it's a matter of distribution.

          additionally, in your analogy, for each poster up on the telephone pole, they would have included a box full of replacement keypads (or whatever) to fix the problem; w00w00 did list a place to download a proxy that will serve as a temporary fix. it's allowing people to be able to make the decision to protect themselves, instead of being subject to the whims of Big Bad Corporation X's product life cycle.

          just the old regulated security VS. freedom debate.
        • Well, the third one is totally unrelated, as it's not an "exploit" except in that you get to make free calls (unless you mean it bills them to some random person, which is still a fairly poor analogy). The second is also a poor comparison - perhaps if they left the flyer on the windshield. That said, I don't see how your real world examples are immoral either. If my burglar alarm was discovered to be flawed, I'd want to a) know as soon as it was discovered by white hats so I can make sure I'm not relying totally on my alarm and b) know how it's done so I can see if my version truly is affected and c) get phones SERIOULSY ringing at my alarm company. I don't want to find out weeks after the fact that there was a known exploit in my alarm, which presumably is known to burglars, and the company didn't tell me so I could go buy a deadbolt. Companies hate recalls. They cost money and don't return any profit. It's very rare for one to be issued thats not mandated by law.

        • Re:Why not wait a day? (Score:3, Interesting)

          by Monte ( 48723 )
          Can someone please explain to me the moral or ethical mandate that supports/justifies this sort of vigilante thinking?

          I'd like to start by stating that I don't condone w00w00's (gad what a name) actions, I was simply offering a possible answer to a question (which, for some reason, got modded up all to hell. I guess the SlashThink mindset agrees with all that appears to screw corporations).

          Now, in an attempt to answer your question - I think this sort of thing is defnitely a free speech issue, and I think in some cases it's justified.

          Let's take your example of a GM exploit - if I discovered such a thing and called GM about it (even if I were a registered/certified GM mechanic) - how many layers of corporate denial, obfuscation and red tape do you think I'd encounter? After all, a recall to fix the problem is going to cost some green, and I'm just some schmuck mechanic. So how long do you think it would take GM to fix the problem, versus the amount of time that someone who liked stealing cars figured it out?

          If instead of calling GM I phoned the local TV stations and demonstrated the problems - do you think that would speed up a GM recall? I sure do.

          Does this hurt the corporation? Yes. But then it was the corporation that created the exploit, or failed to close it. You reap what you sow.

          And how can you claim that they are done in the interest of the public when so much anonymous public damage could result in the short-term?

          The same could be said about an internet article that explains how to pick locks. Should such sites be shut down, in the name of the public interest?

          Their actions will hasten the approval of legislation which makes online reckless endangerment as criminal on the Internet as it is in your neighborhood.

          Which is the greater endangerment: the discription of an exploit, or the exploit's existance?
        • when the industry has a history of ignoring security breachs, or trying to hush them up, it become nessessary to take such actions to protect the people.
        • I am about to expose information that could be used to commit a crime. If this information is improperly used then I and all who have passed on this information can and should be summarily prosecuted according to the Laws Against Spreading Evil Information. But I'll take the chance.

          1. Humans are mortal
          2. Poking a big hole in a human can kill it
          3. Humans are the weak spot in bank security
          4. Humans fear having holes poked in them
          5. Guns are effective tools for poking holes in humans
          6. Pointing guns at humans can get them to do what you want
          7. Humans in banks will give you money if you point a gun at them
          8. To kill a human quickly, shoot it in the heart or head
          9. Explosives are also very effective

          My apologies to all for whom this information represents a decrease in personal security. But rest assured, your firewall will continue to function long after your life has drained away.
          • But rest assured, your firewall will continue to function long after your life has drained away
            1. Computers are breakable
            2. Poking a big hole in a computer can break it
            3. Guns are affective tools for poking holes in computers
            4. Firewall software doesn't run in broken computers
            5. To stop a firewall quickly shoot the computer just about anywere
            And remeber kids - If you shoot a brand computer don't peek inside or you might be breaking the DCMA
        • I don't know why I am responding to such obvious flamebait, but did any of you all actually read w00w00's bugtraq post?

          ------
          We contacted the AOL Instant Messenger group but never received a response. Normally we would be inclined to provide a fix, but it is illegal to reverse engineer the AIM executable (DMCA and AIM's license agreement to thank), so we are unable to provide a patch which will modify it. Instead, we recommend Robbie Saunder's AIM Filter (http://www.ssnbc.com/wiz/) to protect yourselves.
          ------

          They notified AOL, they got no reply. They did the right thing. End of story.


        • Can someone please explain to me the moral or ethical mandate that supports/justifies this sort of vigilante thinking?


          Information security tends to take a far back seat within the corporate world. Doesn't matter if it is management, administration, or development - infosec is a secondary thought if its even considered.


          Part of this is the specialized knowledge required to handle infosec issues (not that it couldn't be widely aquired). It takes a concious effort to implement a secure system. This is often considered additional effort. And additional cost.


          Another part of the puzzle is a general disbelief anyone could discover a vulnerability and would bother to take advantage of it. This discounts the number of technically minded individuals your infrastructure is exposed to on the net (compounded by automating attacks). It also ignores that even trivial applications can cause considerable damage (I have some friends working infosec for large corporations who went in to high gear with this announcement - AIM exists in many environments).


          Finally, infosec is rarely a consumer requirement. Functionality is what sells widgets. Unless the widget is touted as being secure (even IF its supposed to be secure), security won't sell as many widgets if the widgets don't blink and beep nicely. Thus infosec isues are not pushed during initial development.



          All of these actions could have theoretically been done in the name of improving security but in the short-term all they do is recklessly endanger it.


          So now it gets bloody. Damage gets done. Consumers begin to see how these strange little issues cause them pain. They begin to demand better, more secure products. Product goals begin to include infosec. Better products get produced.


          And those who would take advantage of vulnerabilities... quietly and to personal gain (or even loudly and publically) have fewer and fewer targets.



          There is at least one long-term upside to w00w00's actions, though. Their actions will hasten the approval of legislation which makes online reckless endangerment as criminal on the Internet as it is in your neighborhood.


          And its possible more attention will be paid to those who build faulty, and ultimately dangerous, data infrastructures. Maybe even legal liability.
    • Maybe what they meant was:

      If we had tried to co-operate with AOL they would have tried to quash all public disclosure (including sploits). Therefore, we are disclosing now and expect them to run around like deranged monkeys trying to figure things out. Thank you and good day.

      Or maybe they just hate AOL like I do and want to make them squirm...

      GTRacer
      - No AOL on my IP-enabled PS2, THX!

  • Info on AIM protocol (Score:3, Informative)

    by btellier ( 126120 ) <btellier@gm[ ].com ['ail' in gap]> on Wednesday January 02, 2002 @04:31PM (#2775195)
    Since we all know the holes won't stop here, anyone who wishes to further investigate problems can start their research here [aol-files.com] and here [aol-files.com].

    • Re:Info on AIM protocol (Score:4, Informative)

      by ichimunki ( 194887 ) on Wednesday January 02, 2002 @04:57PM (#2775371)
      Well, you can research the protocol all you want, but it is the client application that is the problem here. Now maybe the protocol makes security an issue when used correctly, but still it is up to the client developer to introduce the feature in a non-safe way.
      • Uhm, since this is a *closed source* application the only ways to test are by disassembly and throwing correctly formatted packets at the client. This requires you to know the protocol that the client application is using.

  • not any machine (Score:5, Informative)

    by hyperstation ( 185147 ) on Wednesday January 02, 2002 @04:31PM (#2775196)
    ...only windows machines. get your facts straight.

    This does not affect the
    non-Windows versions, because the non-Windows versions currently do
    not yet support the feature that this vulnerability occurs in.

  • Most of the writeup bashes the DMCA (Score:5, Interesting)

    by Bonker ( 243350 ) on Wednesday January 02, 2002 @04:32PM (#2775209)
    The guy spends most of his time bashing the DMCA and how hard it makes to offer patches to this sort of thing without AOL's permission:

    From the NTBugtraq letter:
    First, the Digital Millenium Copyright Act affects circumvention of anti-piracy mechanisms and reverse engineering. If a product is released in binary form only (i.e., AOL) to protect its technologies and one attempts to reverse engineer the file, it's a violation of the DMCA. It's no question who the lobbyists behind this law were: the big corporations. Not surprisingly, AOL Time Warner was one of the DMCA's biggest supporters. Find out more information about the DMCA at http://www.anti-dmca.org.
    • Eg Europe, where reverse engineering is explicitly legal regardless of any terms and conditions the software vendor may seek to impose.
    • The reverse-engineering clause only applies to technology designed to limit access to a copyrighted work. The DMCA is for protecting digital content. AIM has nothing to do with that.

      It's a bad law, for sure, but making false claims about what it covers does NOT help our cause.

  • Better Link (Score:3, Informative)

    by XBL ( 305578 ) on Wednesday January 02, 2002 @04:33PM (#2775218)
    http://www.w00w00.org/advisories/aim.html [w00w00.org] is a better link.

    Hey, if you guys want open-source IM, check out http://www.jabber.org [jabber.org] The server is open-source and it's a distributed XML-based network. Lots of different, cool clients too. JabberIM for Windows, and Gabber for Linux are the most mature ones though. There are bridges to the AIM and ICQ networks available on some servers, but the ones on Jabber.org have been blocked by AOL... nice huh?

  • Yet another reason (Score:3, Troll)

    by the_rev_matt ( 239420 ) <slashbot AT revmatt DOT com> on Wednesday January 02, 2002 @04:35PM (#2775227) Homepage
    I stopped using ICQ years ago because it was so script-kiddie friendly and AIM not long after. I'm quite happy using Jabber [jabber.org] with a gateway to Yahoo Messenger, thankyouverymuch.

  • Abstract Error (Score:5, Informative)

    by strider( corinth ) ( 246023 ) on Wednesday January 02, 2002 @04:35PM (#2775229) Homepage
    The abstract for the article is in error: it reads, "The non-profit security team w00w00.org started off 2002 by uncovering a serious flaw in AOL's Instant Messenger protocol... This flaw can enable remote users to execute code on any machine logged into the AOL IM service.". The flaw isn't in the protocol itself but in the client, and therefore doesn't actually affect "any machine logged into the AOL IM service". It sounds like AOL is going to prevent the sending of exploit packets at the server level to avoid requesting all of their Windows users to upgrade, but those of us using Linux or another OS should be fine regardless.

  • AIM will always be a problem (Score:3, Informative)

    by I_redwolf ( 51890 ) on Wednesday January 02, 2002 @04:36PM (#2775239) Homepage Journal
    ALWAYS, if the protocol isn't openly documented and severely tested over a communications line for security it is insecure.

    I recommend the majority of people I deal with use jabber (this is not some plug for jabber; it's just at the end of the day, it's more secure and yet accomplishes the same goal AIM etc etc have)

    If you are using AIM, do yourself a favor a pickup a jabber client, you won't be sorry.
    • Um, the protocol has nothing to do with this security issue. The security issue is in the Windows client implementation of this protocol. For another thing, the AIM protocol IS completely documented by AOL-- at least to the point where you can create a basic AIM clone using just that documentation.

      Once again, the problem is in the Windows client and not the protocol, and the protocol is openly documented. Get your facts straight next time.

  • Now they need a sound to go with their IM (Score:5, Funny)

    by A_Non_Moose ( 413034 ) on Wednesday January 02, 2002 @04:37PM (#2775244) Homepage Journal
    How about the "you got mail" dude do one that says "j00 g0t 0wN3D"!

    One of Many Instant Messenger Exploits (MIME for short), I'm sure.

    {if you are going to assinate a Mime, would you use a silencer?}

  • Bug in the implementation, not the protocol (Score:5, Informative)

    by noc ( 97855 ) on Wednesday January 02, 2002 @04:37PM (#2775247)
    The non-profit security team w00w00.org started off 2002 by uncovering a serious flaw in AOL's Instant Messenger protocol.

    The problem is in the implementation, not in the protocol. If it were in the protocol, that would make all clients at risk. As it is, only the official Windows client is vulnerable, because it implements game requests without checking for buffer overflow. I really don't understand why people still write code this way -- buffer overflows are so easy to prevent.

    Somewhat (but only somewhat) offtopic: why on earth doesn't ./ at leas browse through the links they post? It's not like they don't have the manpower. If they'd even looked at the article, they'd have caught this...

    • It's true that overflows are easy to prevent, by using a modern language like Java or O'Caml that has automatic bounds-checking on arrays. (To a lesser extent the C++ STL can help you with this, but you don't get any guarantees since the language is not safe.)

      But I don't agree that it is easy to prevent when you're writing your software in C or C-like C++. In fact, I think C and the typical memory model practically encourages you to write exploitable software. Sure, it's easy to look at a stupid little program and say, yes, that has a buffer overflow problem. But large programs like IIS or even AOL AIM are an awful lot harder to analyze. (Take a look at the IIS overflow again if you think it's easy. This was due to the interaction between two totally different modules, both of which did bounds checking, but assumed that the buffer was large enough to hold twice the amount of data after unencoding. Indeed it was, but not if you unencode twice!)

      If it is so easy to prevent, why do we continue to see loads of these kinds of bugs? You might argue that AOL programmers are stupid, and IIS programmers, and wu_ftpd, BIND, perl, quake 3 arena, sshd, (etc. etc.), but I think you'd be left with almost no programmers if you listed all the packages that have had buffer overflows in them. It is C's fault.

      Personally, I think it's ridiculous that people still write software that's not at all performance-critical in C and C++. Technology exists (see O'Caml at http://caml.inria.fr/) for making really fast programs that are guaranteed not to have this kind of security hole in them. All that's really needed is toolkits for interfacing with system libraries... (for non-interactive stuff like network daemons there's absolutely no excuse to be using C).
    • to use strncpy instead of strcpy...

      Anyway, I like AIM, it's easy for a brain dead code jockey to use. I've got enough rattling around in my head without having to be 31137 at instant messenger applications.

  • It couldn't be... (Score:4, Funny)

    by iiii ( 541004 ) on Wednesday January 02, 2002 @04:45PM (#2775296) Homepage
    It couldn't be, because
    AOL is deeply committed to your security. We use state-of-the-art technology to keep your personal information as secure as possible. We also have put in place privacy protection control systems designed to ensure that the personal data you share with AOL is safe and private. In addition, AOL keeps your password strictly confidential, and all authentication for the Service is performed on AOL's secure servers. Sites participating in the Service may not collect or store AOL password information.

    From this site. [aol.com]

  • Trillian (Score:5, Informative)

    by svwolfpack ( 411870 ) on Wednesday January 02, 2002 @04:48PM (#2775315) Homepage
    I've recently started using trillian (www.trillian.cc [trillian.cc]) for all my IMing needs... (yes, it does connect to the AIM server, among others such as MSN messenger, yahoo, and ICQ) I'm assuming it probably doesn't have this flaw, which is obviously a nice feature. And as far as I know, it's the only really solid alternative to a) having a billion separate IM programs b) using hated AOL software.

    • Re:Trillian (Score:3, Informative)

      by m3000 ( 46427 )
      I second that recommendation. Unfortunatly there is no Linux client yet, but whenever I'm in Windows it's THE best instant messanging program. And it finally support file transfers, the one thing it used to be missing. Plus it looks really cool, with many skins to choose from, and it lets you alias your buddy contacts, my main gripe about the official AIM client. It's well worth the download.
    • Don't forget it also offers a streamline IRC client. Trillian really is the best option right now with a terrific price (read: free) but please donate a few bucks if possible.

    • Re:Trillian (Score:5, Informative)

      by Daniel ( 1678 ) <dburrows@deb i a n.org> on Wednesday January 02, 2002 @05:26PM (#2775528)
      Well, there's always Everybuddy [everybuddy.com], which I used for a while. I never used the non-AIM services much though, so these days I've reverted to Gaim [sourceforge.net]. It has support for ICQ and other protocols (MSN, Jabber, IRC, Zephyr, ..?), but I've never tried it myself.

      Daniel

    • I've recently started using trillian (www.trillian.cc [trillian.cc]) for all my IMing needs

      Trillian is a Windows app, but it apparently works under Wine [codeweavers.com].

    • Re:Trillian (Score:3, Insightful)

      by infiniti99 ( 219973 )
      Trillian is a very nice idea, and solves the problem immediately. Unfortunately, it is not a long-term solution. Trillian is still at the mercy of the "big 4" (AIM/ICQ/MSN/Yahoo), and encourages the continuing use of these closed services.

      Remember the old days of the internet? How you couldn't send an e-mail from Prodigy to AOL because they were separate networks? That's what we have here, but in IM form. The solution was not to build some all-in-one Compuserve-Prodigy-AOL-bloat app, but rather to just decide upon an open email protocol. Trillian is the all-in-one approach.

      I recommend switching to Jabber. It will allow you to communicate with other IM services through serverside transport modules. Use transports as a transition, to communicate with people who have not yet switched to Jabber. The ultimate goal, however, should be to ditch the transports entirely.

      Most importantly, Jabber is its own open and distributed IM system, so you will always be able to chat no matter what the "big 4" do. Isn't it comforting to know that?

      If you don't care about promoting an open system, or don't see the problem with closed IM systems, then Trillian may be just the program for you. But remember it is not trying to solve the greater problem.
      • Jabber is great if you want IM without those pesky "friends" or "family."

      • Re:Trillian (Score:4, Informative)

        by Quarters ( 18322 ) on Wednesday January 02, 2002 @07:33PM (#2776255)
        Jabber is great except for four very pesky problems:

        1) You have to connect to a Jabber server
        2) You have to find a Jabber server that is running all of the message protocols you want/need
        3) Most servers are run by regular people, and they're not always on when you want/need them.
        4) Your buddy list is stored server side, so you can not easily move to another server. If your sever goes down you'll have to recreate your entire buddly list on a new server if you want access.

        Trillian, on the other hand, connects to the chat providers native servers and uses XML as a translation mechanism on the client side. The chances of Yahoo's chat server, AOL's chat server, ICQ's servers, or MSN's chat servers going down is very very slim. I used to use Jabber but gave up in frustration when the server I used disappeared for over a week.
    • It's also an ICQ client that doesn't try to get me order flowers, send SMS, play games, use video-conferencing, or pop up banners. It has a consistent UI compared to ICQ, and for some reason, I seem to get no spam ICQ via Trillian, whereas I get tons with ICQ2000b and the same UIN.

      Trillian is v.nice nowadays. If only it supported Jabber too - the windows Jabber client was kind of crappy last time I tried it.

      • Re:Trillian (Score:2, Informative)

        by afidel ( 530433 )
        To stop the ICQ spam, go under preferences, security and click accept only messages from ppl on my contact list, do not accept wwpager, do not accept email express messages all under ignore. Then under general click on my authorization is required befor users add me to their contact list.
    • Also worth mentioning is that Trillian has automatic 128bit encryption between Trillian clients (over AIM & ICQ only).
    • slight off topic, but im replying to svwolfpack...

      Msn messenger doesnt support socks5 correctly, but I was able to use trillian for msn thru socks. In fact every IM it has aol/icq/yahoo/msn and IRC works thru a socks server now.

  • Gaim and TOC (Score:5, Informative)

    by Saint Nobody ( 21391 ) on Wednesday January 02, 2002 @04:52PM (#2775336) Homepage Journal

    well, here's yet another reason to be using TOC (as opposed to Oscar, the newer of the two AIM protocols.) TOC is/was an open protocol, and i've had very little problem with it. admittedly, it doesn't have all the "features" that Oscar has, but if all you want is chat, and you don't care a whole lot about file transfers, et al. TOC is more than sufficient. plus, unlike Oscar, AOL doesn't seem to arbitrarily change the protocol. And it seems to be more stable, server-side. I've had countless instances of hearing the dispaired cries of "AIM is down" from throughout my dorm without having a problem. TOC goes down occasionally, but not nearly as much, from my experience.

    as for clients, i recommend Gaim for Linux. You can select the TOC protocol in the Account Editor window.

    <asbestos>yes, i know there's a million things that Oscar can do that TOC can't. but I don't care. TOC just works better from my experience, especially when clients have to release new versions to work around AOL changing the Oscar protocol slightly in order to screw over MS.</asbestos>

  • I'm actually really surprised that holes haven't been already found in these toys.

  • Heh... first hack... (Score:4, Funny)

    by tcc ( 140386 ) on Wednesday January 02, 2002 @04:55PM (#2775361) Homepage Journal
    Change that annoying incomming Email .wav file...

    "You've got nailed"

  • Best PR Spin (Score:5, Interesting)

    by VivianC ( 206472 ) <internet_update@y a h o o.com> on Wednesday January 02, 2002 @05:00PM (#2775387) Homepage Journal
    This has got the best PR response I've ever seen to one of these holes:

    From the Washington Post Story [washingtonpost.com]

    A security hole in AOL Time Warner's Instant Messenger program used by millions of users worldwide can let a hacker take full control of a victim's computer, according to security researchers and the company.

    An AOL spokesman said the problem will be fixed soon, and users won't have to download anything.

    Great idea! Why make the user download and test a patch? We can just use this hole that gives us full control of a vitim's computer...

  • w00w00? (Score:4, Funny)

    by fobbman ( 131816 ) on Wednesday January 02, 2002 @05:16PM (#2775480) Homepage
    "The non-profit security team w00w00.org..."

    Oh, so the 1337 are going the non-profit route? Nice to see that they are going somewhat legit here, but are we going to see mass-defacement support drives once a month looking for donations, a la PBS? Are they going to only release their best exploits during these fund drives? And how much do I have to donate to get reach the benefactor level where I get the "Bill Gates unrestricted Amex card" number as a gift of thanks?

    More importantly, did Microsoft "give generously" during the "Here's how to hack AIM" episode of "Sesame Street"?

    "Today's Sesame Street was brought to you by the letters M, S, N, and the number 1."

  • As far as I can tell, this only affects 4.7xx and above...
    AOL Instant Messenger (AIM) has a major security vulnerability in the latest stable (4.7.2480) and beta (4.8.2616) Windows versions.
    Most people I know stayed with version 4.3, as it doesn't have the super-annoying "AIM Today" window when you login. Of course, AOL doesn't make this available, so I keep my AIM 4.3 installer in a safe place. If it turns out that 4.3 has this bug, well, I'll be sad.
    • Tested vulnerable back to 4.3 (earliest one available to test). Vulnerability of versions 4.3 is not known; assume that ALL VERSIONS of AIM are vulnerable. (At least if you believe the fine people on Bugtraq).

      D'oh.
    • You can turn that annoying AIM Today window off rather easily; in fact, its always the first thing I do after setting up AIM anywhere.
    • From the person who found the hole:

      1. This vulnerable affects all AIM versions as far back as 4.3 (this is the farthest one back I've checked). I don't know if it affects the inline AIM used with Netscape. If it supports game requests, probably. Otherwise, it won't.

      -Legion

  • Check out this quote... (Score:5, Interesting)

    by VValdo ( 10446 ) on Wednesday January 02, 2002 @05:39PM (#2775614)
    from USAToday [usatoday.com]:

    Russ Cooper, who moderates a popular security mailing list and works for security firm TruSecure, said Conover's actions are irresponsible. "I think it's better to provide details of the exploit and then let other people write the actual code," Cooper said. "Unfortunately, these are fundamentally naive people with a very childish view of the world."

    Hmm. Anyone else sense a little hostility from the for-profit [trusecure.com] security industry...?

  • I have stopped using most of the Instant messagers except Odigo now. I like the see others in the website feature and the fact that you have all the others integrated as well is a plus.

    http://www.odigo.com

    Side note I am in NO WAY affiliated with them. I just happen to like their product.

  • i've an idea! (Score:2, Insightful)

    by waschebaer ( 545977 )
    a cool server side fix:

    exploit this hole from the main server on all clients, and make them automatically update to the latest version! No users have to download patches this way.
  • Noticed quite a few mesages exclaiming about trillian already. I love it. It just needs more skins (or I need to learn the differences between the old and new format).

    I will venture, rather safely, to say that Trillian is not affected by this exploit. The exploit is in the 'game request' feature in the AIM client for windows, a feature that has not yet been included in Trillian in the first place, and a feature that would obviously use different, hopefully better-bounds-checked code if it were there (since trillian uses its own libraries to do everything, no reliance on AIM).
  • if you've got Mac OS X - you should get fire
    http://www.epicware.com/fire.html

    works great, and handles AIM, ICQ, Jabber, irc, MSN, and Yahoo.

    from the "About Fire" dialogue

    Engineering
    Eric Peyton

    Interface Design
    Borrowed from America Online with flourishes courtesy Eric Peyton. Some ICQ ideas taken from various ICQ clones ...

    Icons
    Rick Roe, Blake Harris

    Fire Enhancements
    The following people have made enhancements to Fire
    Jason Fosback (jfosback@ubermind.com)
    Brian Fitzpatrick (fitz@red-bean.com)
    (way too many to list :-( and I forget)

    Underlying Engine (libfaim)
    Copyright 1998-1999 Adam Fritzler (afritz@iname.com)

    Underlying Engine (icqlib)
    http://kicq.sourceforge.net/kicq.shtml

    Underlying Engine (libyahoo)
    http://www.sourceforge.net/projects/gtkyahoo

    Underlying Engine (msn library)
    http://www.everybuddy.com

    Underlying Engine (firetalk/irc)
    http://www.penguinhosting.net/~ian/firetalk/

    HTML (AIML) Rendering/Reading Engine
    Copyright 1999 Stephen Peters (portnoy@portnoy.org)

    Fire.app Written in Objective-C against the Cocoa API's using the underlying libfaim Unix/Linux library written in C, the icqlib source code written in C, and the gtkyahoo source code written in C and C++. I am using the firetalk library in C for irc communication and the msn library was borrowed from everybuddy.

    Fire.app is released under the FSF GPL, as are libfaim, micq, and gtkyahoo. If you did not receive source with this version please contact Eric Peyton (epeyton@epicware.com) for the source, or visit http://www.epicware.com/fire.html.
  • It should be noted that the bug does not, "enable remote users to execute code on any machine logged into the AOL IM service," but is specific to Windows versions 4.3 and newer. They have confirmed that it does not affect Netscape's built in AIM, and assumably alternative OSes and alternative clients are safe. So let me include another shameless endorsement of Fire [epicware.com] ;)
  • Instead of calling these things "flaws" or "holes" or "exploits" I recommend a different term.

    Call them a "window."

    As in, "A window was discovered today into AOL instant messanger."

Slashdot Top Deals

The Tao is like a glob pattern: used but never used up. It is like the extern void: filled with infinite possibilities.

Close