VOICE Home Page: http://www.os2voice.org
[Newsletter Index]
[Previous Page] [Next Page]
[Features Index]

October 1999

"Back side of the Moon"

By: Timur Kazimirov

"ICQ and possible security holes"

ICQ quicly became a very popular tool for interactive messaging and chatting on the Internet. I won't describe the positive sides of the ICQ programs but will stay on the negative because, while using ICQ, the user can taste the back side of it's abbreviation - "I See You". After an extensive investigation of the problem I can say that, without any doubt, ICQ will open your computer to the whole World. In other words, anyone "Could be able To See Your Computer".

The main reason why ICQ isn't safer than, for example, IRC clients is that ICQ not only sends TCP/IP packets to the server but listens for incoming conections also...

ICQ Spoofing

The idea of this method is to find the port where an ICQ client listens and send something (advertisement, false data, fraud, and etc...) from a fake ICQ UIN using the freely accesible description of the ICQ protocol. ICQ doesn't check the validity of a sender's UIN - this is the first bug!!!

And more - you don't have to be a professional hacker to know the IP address of a computer you want to attack - the ICQ server will help you in this. Simply request info about nick, e-mail, or full name of the person you want to spoof, and you will get the whole info (including the IP address if the client is online) about it. Mirabilis doesn't protect private info of his clients - second bug!!!

To have a little game with this method just start this program as follows:

  icqspoof spoofedIP spoofedUIN message startPort endPort
For example:
  icqspoof 27456401 Shutdown_immediately!!! 1024 6500
The attacked person will get a message "Shutdown_immediately!!!" from randomly choosed UIN, so could not be able to know who sent him this message.

ICQ Shooting

The idea for this method is based on the above, but instead of sending a message the big amount of determined data is sent so the client's ICQ program simply stopped. I won't describe this method in more detail - I will leave it for your own investigation. You can use this method to isolate a specific person from receiving messages addressed for him. By modifying this method we can get:

ICQ Substituting

The most dangerous method that is based on both previous methods. Idea of this method in substituting IP address of attacked person by blocking him from receiving messages using the second method first, and, then you can receive messages that are addressed to him. ICQ protocol isn't encrypted - all your data sent (including passwords) is sent unencrypted over the Net so the intercepting of such data is only a matter of time.


So, after analyzing how ICQ works, we can say that using ICQ at this moment isn't safe at all. To avoid risk of being spoofed (or substituted - which is much more dangerous) there is only one advice - do not use it ;) You can use IRC service to group and private chat and quick file transfer (ICQ does the same), and be much more safe.

[Previous Page ] [ Index] [Next Page
VOICE Home Page: http://www.os2voice.org