Major ICQ security hole (1998)

opennet.ru

77 pointssysoleg2 days ago40 commentsView on HN

SillyUsername2 days ago

So this is how my low numbered account was stolen back in the day - thanks for sharing.

rashkov8 hours ago

Can’t believe I still remember my ICQ id

gersonazgo8 hours ago

I read your comment and realized I also do haha lol lfmao rofl

giantrobot7 hours ago

Mine is seared into my brain. It's also cheating a bit because it's only six digits.

wafflebot4 hours ago

I was gonna drag you for making such a silly flex then I realized I'm just jealous because mine was eight

hdgvhicv1 hour ago

Mine was 7 but I had it fur 5 years.

I also remember my compuserve id which lasted a mere 6 months over 30 years ago, And that was 10 digits.

stingraycharles1 hour ago

Same like my Geocities homepage, never forget.

I feel like it's the same with your first phone number back when there were only landlines, etc. Some numbers are hard-wired.

aussieguy12347 hours ago

If it happened to me, my next move would be to steal it back

orbital-decay7 hours ago

My UIN was merely 7-digit and when it got hacked the guy just logged in, chatted with my friends about random things, and left. I only found out because they were puzzled by "me" talking weird.

taspeotis8 hours ago

Rewrite it in Rust

Teknomadix7 hours ago

Ask an agent to rewrite it in Rust. #ftfy

mannycalavera428 hours ago

Tooooooooooooooooooooooooot! (startup jingle, good mems)

keyle3 hours ago

KeeeKooo!

compass_copium8 hours ago

>When a password of 9 or more characters is sent, their buffer is over-run, and it allows you to log in.

Man, computers used to be fun

mingus888 hours ago

It really was a fun time. I remember sitting in a coffee shop just sniffing WiFi traffic.

A friend was a reporter for the local paper and interviewed the mayor. I turned my laptop around and showed my friend the mayors imap password. Just right there floating through the air.

saadn928 hours ago

Yep, now everything is done through agents unfortunately.

nubinetwork8 hours ago

Unix crypt only accepted 8 characters and ignored the rest. If your password was 123456789, it was considered the same as 12345678a.

a_bonobo7 hours ago

For local LAN play, Half-Life checked the CD key only for length I believe? It would happily accept 1234-56789-0123

masternight5 hours ago

I remember when ICQ used to give you the other persons IP address.

Then you could use that to winnuke them.

bestham1 hour ago

Or run NetBus :-D

NexRebular43 minutes ago

Just to end up connecting to NetBuster.

wafflebot5 hours ago

Lucky for me, my ICQ password was only 8 characters. And I used it on every website!

(To this day I can recall my ICQ number faster than my childhood phone number or my social security number.)

reinvantveer51 minutes ago

This made me almost spit out my coffee in laughter. This just made my day, hahaha

chuckhend8 hours ago

Uh oh!

tehlike7 hours ago

Incoming file transfer

stavros7 hours ago

Oh god this instantly took me back to my the way teenage years' room felt and smelled.

scun1 hour ago

like hamsters

pavel_lishin7 hours ago

There are some point of sales systems that use the same sound effect, and every time it's like I'm teleported back to the 90s, sitting in my room with a pepsi, browsing the web and chattin' with friends.

notpushkin3 hours ago

I only recall this beibeing used by McDonald’s in Russia, which seems to check out (no pun intended) considering your username :-)

waltbosz7 hours ago

AOL Instant Messenger had several remote code execution exploits. They worked just by sending an IM to someone. You could also crash their computer remotely, or maybe it would just create their client.

Also their stored password encryption algorithm was easily reversible.

camcil7 hours ago

The AIM days are one for the books. What a time to be alive and interested in computerin'

jonhohle7 hours ago

Wasn’t that how audio avatars worked (not by crashing, but ACr)? What a time to be alive.

waltbosz6 hours ago

Don't know how they worked, but what you did to create one was rename a .wav to a .jpg .gif .bmp .etc

Hydraulix9894 hours ago

AIM's built-in HTML parser had a bunch of super-linear parser complexity bugs, leading to people building "punters".

egeozcan5 hours ago

This made me realize that I still remember my ICQ UIN! I cannot remember what I've had for lunch yesterday, btw.

myth_drannon5 hours ago

I think I discovered that by mistake using Miranda client in 2002!

The tech scene of the 90s in Israel was crazy. Mirablis was hiring high school students to do QA.

urvader3 hours ago

> Mirabilis / AOL really needs to fix this problem.

runep1 hour ago

ICQ sent messages directly between peers when both were online and unfirewalled and there were no verification that you were who you claimed. I had a lot of (friendly) fun spoofing other ICQ numbers. Or sending someone a message from themselves.

SG-1 hour ago

i still remember my ICQ number all these years later.

SXX37 minutes ago

CVE-2012-2122: A Tragically Comedic Security Flaw in MySQL

https://www.rapid7.com/blog/post/2012/06/11/cve-2012-2122-a-...

> ... Since the authentication protocol generates a different hash each time this comparison is done, there is a 1 in 256 chance that ANY password would be accepted for authentication. ...