Latest Hacker exploit
Latest Hacker exploit
ghost | 5770 Reads | AOL's Instant Messenger is the latest to be hit by hackers, in an "exploit" that allowed them to impersonate existing AIM users with the instant messaging system. The hack, first reported in Salon, involved setting up a new AOL account, and then linking it to an existing AIM account that belonged to a non-AOL subscriber. AIM is available at no charge to AOL and non-AOL subscribers alike, and the service claims that as many as 40 million people use it.
The hole involved the ability of AOL's online service to change the passwords of AIM accounts. To impersonate an AIM user who was not an AOL member, all the hacker had to do was open a new account with the same screen name. Although AOL asks for the AIM password, there were keyboard commands that would open the password-changing screen before the password check. The hack had been in use since as early as November; after Salon broke the story, an AOL spokesman acknowledged that the company was "aware of the it and are taking measures to defeat it."
The knowledge of the security hole was found by a 17-year-old who goes by the name of TangentX, and was passed around in private hacker chatrooms on AOL. Net4TV Voice reporters met this weekend in a chatroom with one of the friends of TangentX who calls himself "deft" and who described how the hack was done and how it was used.
<Voice> You could get AIM names that were already taken? Was this a bug in the AIM system?
Bug in the AOL system.
<Voice> How long was the bug there? Was it something new, or had it been around for awhile and just discovered?
Well, one exploit had been around for awhile, but when certain people find out, they tell everybody. Therefore they all died within a few days.
<Voice> That's how people get caught (and holes get closed).
AOL never catches anybody.
<Voice> How DID it come to light, if AOL didn't catch it?
I'm sure people just got angry and called AOL, and got AOL's "expert" programmers to fix the glitch.
<Voice> Was there a list you could get of AIM users so you could get their names to take over, or did you already have to know a name you wanted to take?
You had to think of names you wanted. People made programs to check names, so it was easier to do. I have one made by my friend portal, but in order to take or 'steal' the AIM's, you (also) needed the AOL software. See, you make a list of names, and once you find out they're available, you can take them. You make them into an AOL name through an exploit, then it's yours on AOL and AIM. To get the AIM all you had to do was go to keyword: aimpass on AOL and change the password and it's yours. After the exploits died, most of the aol names were 'suspended,' so you couldn't sign on with them. but if you had changed the AIM password, you could use it on AIM. That's how i obtained 'cormega' for myself, and some other names for some friends.
<Voice> How many names approximately have you 'obtained'?
Well, I was happy with my current AIM, and the new 'cormega' name, so I only got 3 names out of this deal. Others I checked were available though, such was NWA, Mariah Carey, and DarkMan. Some people have gotten well over 20 though.
<Voice> How long was this security hole open for?
A few days, there were 3 total, and I'm sure more will be found soon :)
<Voice> Was this hole open the whole time and just recently discovered? Or was it due to a server update with certain user-existant checks removed?
Well, from what I know, one hole was open for awhile, but wasn't mass-discovered until the past week. They were always around, just no one had discovered them. They don't disappear until they get hammered and abused, and AOL removes them.
<Voice> Once you got the names and changed the passwords, what could you do? What DID you (or your friends) do?
Well, once you made it into an AOL (name), you could use it on AOL. AIM has the option where you can update your e-mail address, so if you do that the owner cannot retrieve the password and it's yours, since aim has no technical support or terms of service like AOL does.
<Voice> Could you see the user's info when they signed up? Such as their home address and phone number?
nope. That topic is a whole other story :P
<Voice> But if you changed the password, then could you just to masquerade as them?
For the AIM's, you could just pose as them, and use it as a 'cool' name to have. I've gotten many IM's from the owner's friends and stuff, "what's up eddie!" I usually insult them severely and they don't instant message me again. :) I've got a log of a conversation with one girl, lol
<Voice> So it was only people who weren't AOL members with the same sn for AIM that were vulnerable, right?
yes.
<Voice> Could we see a screenshot of the program you used to steal AIM names?
as long as i can get a plug for my webpage in the interview, lol. :P - http://www.firebat.net/deft and also say I LOVE ASHLEY <3.
In the interview, Deft also indicated that there were many other holes in the AOL system, and also were hackers who had stolen the accounts of AOL staff members, allowing them access to management utilities and user information.
AOL has been hacked many times in its history, with CEO Steve Case's email having been hacked in a famous 1995 "exploit," the term that hackers use for their adventures. In September 1996, the Washington Post reported that AOL had cancelled 370,000 accounts in one three-month period for "credit card fraud, hacking, etc."
Net4TV Voice Editorial Comment Net4TV Voice is vehemently opposed to hacking and to the violation of the security of websites, communications, and private data. Our purpose in speaking with deft, whose true identity we do not know, was to gain some insight into how and why hackers are conducting these activities, as well as to learn what other holes in AOL might still be open to unauthorized entry by hackers.
