Slashdot Mirror
Despite AOL's Claim, AIM Worm Hole Still Wide Open
Clown of the month writes "There's a nasty worm hole in America Online's standalone AIM (instant messaging) software that won't be patched until the middle of October. This vulnerability, first reported to AOL by researchers at Core Security more than a month ago, is caused by the way AIM supports the rendering of HTML content via an embedded Internet Explorer server control. AOL coordinated with Core on the release of an advisory, on the understanding that the flaw was patched in the latest beta version. As security researcher Aviv Raff discovered, the underlying vulnerability was never fixed. In the demonstration, Raff simply sent an IM to trigger the launch of the calculator application. The attack scenario works without the target clicking on a link and only requires that the AIM user is logged on and accepting incoming messages."
Here's a perfect example of where an open-source solution beats the pants off a commercial one.
Let me welcome our new Dominion Overlords!
Err, people actually still use the AIM client supplied by AOL? Almost everyone I know is using a 3rd-party multi-protocol app like Trillian or Gaim (on Windows) or Adium or iChat on OS X. I'd be totally surprised to see someone actually running the [IMO] horrible client made by AOL.
...combined with excessive bloat are why I use Trillian.
Living With a Nerd
I didn't realize people still used AIM. I thought everyone "cool" had moved on to MyFaceSpaceBook
Uhhh, as far as I'm concerned if you still use AIM you deserve what you get, the only reason AOL itself is still around is because of our poor grandparents who don't know any better. I say "Boo on you" aol for taking advantage of our elderly community that doesn't know any better by forcing them to install additional programs such as "ViewPoint Media Player" if they want AIM. Its crap that you make Customers of your's download additional adware to help support your continued existence, just roll over and call it quits. Time Warner is the only way you have left. Period.
Could AOL and Core's warning be described as "Wormsign"?
We figured out a long time ago that it's easier to elect seven judges than to elect 132 legislators.
AOL creates a stable worm hole and you /. types want to close it? Bastards!
How can I believe you when you tell me what I don't want to hear?
I'll let some other troll post the goatse link.
UTF-8: There and Back Again
Adium is a sweet, multi-service, OSS IM client.
me: yada yada boobies!
nob: waffle waffle
me: boobies boobies!
nob: <exploit>Please click calculator icon</exploit>
me: no
FOILED!
Their death is slow, torturous, tortuous, and painful to experience with them, but when they refuse to change with the times, and provide secure computing experience, customer's move on to something else. A word of warning for FOSS developers here.
Today we see people suggesting strongly that users abandon MS's new OS for many reasons. This is the arguably dominant desktop OS across the globe, and they are losing face for nothing more than treating users and customers like idiots.
It won't take long before no one will use AIM, and that problem will go away. Sure, it will still be around on someone's machine somewhere, but that user will die of stupidity soon anyway.
I may sound sarcastic, but I'm not, this is how the end begins. Making stupid mistakes, letting end users suffer, and generally thinking that not creating superior products is necessary. I personally choose to suffer bad driver support or other shortcomings than allow the OS manufacturer spy on my computer use, or worse report it back to someone else.
Google dances around this line quite a lot, but seems to still respect the user, and their privacy. I am seriously hoping that this issue becomes a US Presidential election issue. Privacy, security, and consumer rights where software is concerned. The MS stealth update is nothing more than malware. Commercial companies found guilty of DDoS and other sabotage efforts should be fined, and corporate officers imprisoned.
Yes, I could make the hardware on my desk secure by unplugging the network cable, but I can also make my car safe from accidents if I leave it in the garage. Neither is a suitable answer. Common sense should be applied to this, if your vehicle suddenly stopped getting > 25mpg because you filled the tank with brand X gasoline it would be a case for federal investigations. My computers cost as much as my car, I spend a great deal of money each month on or via my network connection using those computers. It is time that personal liberties and security were treated the same whether it is in regard to computing, or any other activity.
voting with your feet will eventually kill off the AIM client, but it should a case for a fine, if not more that the hole was left open negligently.
Support NYCountryLawyer RIAA vs People
Then another reason to use proxy servers with your Trillian or GAIM accounts.
I had to uninstall AIM after my wife cought me cybering with a Russian chick...
I didnt read the details, but i would almost bet that they are using an IE control and dont imediatly know a way to fix the problem. So they are going to try and catch the exploit instead leaving them open to future creative attacks.
I also think the use of the ie control will be the root of many more issues that have yet to be uncovered. If they could run that control in a restricted security setting, it would go along way. If its just for display only, strip it of all security and go on.
If you just treat the entire control as hostile (it is IE isnt it), then it cant suprise you with something new and undocumented.
Im sure its issues like this that introduced IE's use of zones. Not that it handles it any better, but I can see the idea behind it.
Im a gamer, not a grammer major. This post is full of spelling and grammer mistakes.
So, what's the windows equivalent of rm -rf /
It's called Pidgin now, you r-tard.
As someone who uses SourceSafe for years, I just about peed myself after reading this.
Oh my $deity.... this is amazing! Unfathomable! Shocking and awe-inspiring!
AOL and AIM are still around???
If I knew the wedgies I gave you back in 6th grade would have resulted in this . . . I might have taken a moments pause.
AOL is a much bigger company than just the online service. For example, they own advertizing.com... Which I'm sure makes them a lot of money.
I've been using meebo.com for about a year and up until a couple of weeks ago, the only failing was that it didn't have file transfer capabilities. Now that they fixed that, the site is about as good as an IM client can get + no need to install software (and it even works on iphone etc...)
Oh yeah, and there's no need to remember multiple account password
fsckr.com - go fusk yourself!
The widespread use of instant messaging (IM) continues to increase the security risks for both organizations and individual users. While instant messaging can be a very useful communication tool, it is also subject to many security concerns. Recent attacks include new variations in the establishment and spread of botnets, and the use of compromised instant messaging accounts to lure users into revealing sensitive information. Variants of e-mail worms (such as the Mytob family) have also been spread through the use of instant messaging. The general risk areas related to instant messaging are:
Malware -- Worms, viruses, and Trojans transferred through the use of instant messaging. Many bots are controlled via IRC channels.
Information confidentiality -- Information transferred via instant messaging can be subject to disclosure along any part of the process.
Network -- Denial of service attacks; excessive network capacity utilization, even through legitimate use.
Application vulnerabilities -- Instant messaging applications contain vulnerabilities that can be exploited to compromise affected systems.
Aol recently announced that they will be moving the all their IM development over to ICQ Israel. Hopefully they will do a better job with the IM than aol were doing. Aol has never been a good IM. I dont know what people here think of ICQ, but back in the day ICQ was the best IM until the big corps like aol, yahoo and msn jumped in. Eventually ICQ turned a bit bloated and that's when I stopped using it. I hope ICQ make some big changes to the aol messenger.
This is precisely why I have stayed with the older versions that came with Netscape Communicator. Simply put, they're not vulnerable, as they do not rely on the existence of Internet Explorer in any way. There has never been any compelling reason to use any version of AIM > 4.3.
I used to think Trillian was the be-all end-all... a single client that accesses half a dozen networks. Beautiful, right? Sure, until you realize that Trill cheerfully eats up to 80% cpu on a system when it's actively doing something; and the wiki interface, while very cool, breaks within a few weeks of "normal" usage. Hmm. Now that I think of it, those two items may be related.
This work is licensed under a Creative Commons Attribution 3.0 Unported License.
I mean, unless they're near a black hole or are pumping an insane amount of power into it, the wormhole should have taken care of itself and collapsed in 38 minutes. In other news, a new season of Stargate, sans SG-1, starts tonight.
#include <signature.h>
What versions have this hole?
I'm using version 5.1.3036 from oldversion.com. It's the last version that doesn't start playing video/audio at random times.
hurm, it looks like they have to wait until the middle of October. Meanwhile, they can switch to meebo or pidig if they want to :P