Vulnerability Development mailing list archives

In regards to the insecurity of AOL Instant Messenger


From: "Adam Carr" <itsacarr () adelphia net>
Date: Mon, 5 Aug 2002 18:58:04 -0400

After seeing the recent emails about the hide windows while away =
function while I don't quite understand that as a security threat this =
does remind me of other insecurities of AIM and some questions I had as =
well.

The first threat to AIM users that I am aware of and have tested myself =
is under Direct Connects with another user. With a targets ip, it is not =
difficult at all to intercept the dcc's messages and to input your own. =
Quite frightening. A simple fix is to change the port which AIM direct =
connects on. Seeing as how my explanations are not that great I invite =
anyone else who is aware of this to explain that flaw in AIM.

Now my question, is how secure are normal "ims" on AIM. How difficult =
would it be to listen to anothers msgs and if at all possible, how could =
this be fixed.=20

I know AIM has\had it's share of other vulnerabilities so please speak =
up if you know of any. Thanks ...

Cheers ...
Adam





Current thread: