Major ICQ security hole (1998)

(opennet.ru)

49 points | by sysoleg 2 days ago

10 comments

  • compass_copium 3 hours ago
    >When a password of 9 or more characters is sent, their buffer is over-run, and it allows you to log in.

    Man, computers used to be fun

    • mingus88 3 hours ago
      It really was a fun time. I remember sitting in a coffee shop just sniffing WiFi traffic.

      A friend was a reporter for the local paper and interviewed the mayor. I turned my laptop around and showed my friend the mayors imap password. Just right there floating through the air.

    • masternight 1 hour ago
      I remember when ICQ used to give you the other persons IP address.

      Then you could use that to winnuke them.

    • wafflebot 49 minutes ago
      Lucky for me, my ICQ password was only 8 characters. And I used it on every website!

      (To this day I can recall my ICQ number faster than my childhood phone number or my social security number.)

      • r0fl 13 minutes ago
        [dead]
    • nubinetwork 3 hours ago
      Unix crypt only accepted 8 characters and ignored the rest. If your password was 123456789, it was considered the same as 12345678a.
      • a_bonobo 2 hours ago
        For local LAN play, Half-Life checked the CD key only for length I believe? It would happily accept 1234-56789-0123
    • saadn92 3 hours ago
      Yep, now everything is done through agents unfortunately.
  • SillyUsername 2 days ago
    So this is how my low numbered account was stolen back in the day - thanks for sharing.
    • orbital-decay 2 hours ago
      My UIN was merely 7-digit and when it got hacked the guy just logged in, chatted with my friends about random things, and left. I only found out because they were puzzled by "me" talking weird.
    • rashkov 4 hours ago
      Can’t believe I still remember my ICQ id
      • giantrobot 2 hours ago
        Mine is seared into my brain. It's also cheating a bit because it's only six digits.
        • wafflebot 12 minutes ago
          I was gonna drag you for making such a silly flex then I realized I'm just jealous because mine was eight
      • gersonazgo 3 hours ago
        I read your comment and realized I also do haha lol lfmao rofl
    • aussieguy1234 3 hours ago
      If it happened to me, my next move would be to steal it back
  • egeozcan 59 minutes ago
    This made me realize that I still remember my ICQ UIN! I cannot remember what I've had for lunch yesterday, btw.
  • waltbosz 2 hours ago
    AOL Instant Messenger had several remote code execution exploits. They worked just by sending an IM to someone. You could also crash their computer remotely, or maybe it would just create their client.

    Also their stored password encryption algorithm was easily reversible.

    • camcil 2 hours ago
      The AIM days are one for the books. What a time to be alive and interested in computerin'
    • jonhohle 2 hours ago
      Wasn’t that how audio avatars worked (not by crashing, but ACr)? What a time to be alive.
      • waltbosz 1 hour ago
        Don't know how they worked, but what you did to create one was rename a .wav to a .jpg .gif .bmp .etc
  • mannycalavera42 3 hours ago
    Tooooooooooooooooooooooooot! (startup jingle, good mems)
  • taspeotis 4 hours ago
    Rewrite it in Rust
    • Teknomadix 2 hours ago
      Ask an agent to rewrite it in Rust. #ftfy
  • myth_drannon 42 minutes ago
    I think I discovered that by mistake using Miranda client in 2002!

    The tech scene of the 90s in Israel was crazy. Mirablis was hiring high school students to do QA.

  • chuckhend 3 hours ago
    Uh oh!
    • pavel_lishin 2 hours ago
      There are some point of sales systems that use the same sound effect, and every time it's like I'm teleported back to the 90s, sitting in my room with a pepsi, browsing the web and chattin' with friends.
    • tehlike 2 hours ago
      Incoming file transfer
      • stavros 2 hours ago
        Oh god this instantly took me back to my the way teenage years' room felt and smelled.
  • leoli13579 24 minutes ago
    [dead]