🚀 go-pugleaf

Marc Luethi wrote:
> 
> Schau mal ob sie auf www.rootshell.com schon was zu ICQ haben

auf buqtraq war im dez n thread darueber :

----------
Von: BUGTRAQ / zhuxsh; alan / zhuxsh
An: BUGTRAQ / zhuxsh
Betreff: PUBLIC:      Vulnerabilities in ICQ
Datum: Sonntag, 14. Dezember 1997 16:20

  
/*

This is a little toy to demo the weaknesses in Mirabilis ICQ system.
There
are two major problems with the ICQ protocol clearly visible. As its an
unpublished proprietary system we can assume there may well be far more
lurking. Its also too apparent why they dont publish it - my guess has
to
be "embarrasment factor"

The first flaw is plain dumb. They send plaintext authentication. Not
only
that they send it once per session.

The second flaw is that they use easily guessable sequence numbers -
starting
from 0 each user session, they use UDP and to make life even easier
their
query service will tell you exactly what IP address to spoof as source
when
faking them. So you can find someone is on, find their IP and spoof
sequences
0->100 with a fair bet that somewhere before the 100th fake message
you'll
get several hits and spoof messages. If not you can winnuke the victim
so
he'll be back on a low sequence number 8)

Let us hope the proposed Rendezvous Protocol that is supposed to become
an internet draft is better designed and that the ICQ people switch to
it.
There really is no excuse for using crude plaintext and simplistic
sequence
spaces when five minutes thought could have resolved almost every
weakness
except password change without US export controlled crypto.

I've enclosed a demo that does password sniffing for ICQ. It requires
you
can work out how to set it up and it doesnt including spoofing code.

Alan

*/
------------------

die antwort von mirabilis:

---
Thanks for the vote of confidence.
Actualy, we don't publish the protocol since it's a work in progress and
we still have pretty major changes from version to version.
Password encryption will be addressed in the next client release,
spoofing client messages has already been addressed in our new version
 - ICQ98a, (which is not what you are using) and should not be possible
once we phase out older clients (hopfuly by the end of this month).
We apreciate your pointing out vulnrabilities to us and will do our best
to fix them in future releases.
-----

dann gings noch weiter, den rest kann ich bei bedarf noch posten

griessli
serge

-- 
What's this script do?
    unzip ; touch ; finger ; mount ; gasp ; yes ; umount ; sleep
Hint for the answer: not everything is computer-oriented. 
Sometimes you're in a sleeping bag, camping out with your girlfriend.