26th Sep 2002 [SBWID-5302]
COMMAND
AOL Instant Messenger file transfer hijacking
SYSTEMS AFFECTED
??
PROBLEM
In Joseph Musso a.k.a. Sil [www.silenttech.com] post :
When AIM gets a connection request or tries to connect to someone else
it acts as a server, the program I made rapidly tries to connect to the
target IP(every 450 milliseconds) on port 4443(Direct Connection) and
5190(File Transfer) it then intercepts the connection and steals
whatever data the target sends, they can receive text from their
"friends" but they cannot send it because all data they send gets sent
to you, I don't know the Oscar protocol, but I'm sure that if you where
to use it, you could send text back to the IM as the "friend" or maybe
as a fake screen name, this could be used to trick the person into
giving you passwords or personal information, even if the person just
happened to send something like "passwords.txt" to their "friend", you
now have those passwords.
SOLUTION
None yet