Film-Tech Forum ARCHIVE: Junk messages on AIM

This is topic Junk messages on AIM in forum Film-Yak at Film-Tech Forum ARCHIVE.

To visit this topic, use this URL:
https://ft-forum.com/ft/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=8;t=000895

Posted by Ken Lackner (Member # 1002) on 05-09-2002, 01:28 AM:

Every once in a while I get IM's from people I do not know with links to adult sites. This usually happens within a few seconds of signing on. This has happened at least a dozen times. How the heck are these people getting my screen name???? I know that if you visit public chat rooms you will get spam, but I do not use AOL, only AIM. Only my friends know my screen name. To my recollection, the only public place I have posted my screen name was on this forum, under the thread "AOL Instant Messaging" several months back. Do you think there could be lurkers pulling this shiot?

------------------
This one time, at Projection Camp, I stuck a xenon bulb....

Posted by Ron Lacheur (Member # 1126) on 05-09-2002, 02:16 AM:

I think there just bots sending out those messages to random AIM contacts. I had the same problem on ICQ.

Posted by Brad Miller (Member # 2) on 05-09-2002, 02:27 AM:

It's probably just Joe. (Joe is secretly the one who is resposible or ALL of the spam and viruses floating around these days. He pulls in a six figure income each year from his Norton and McAfee paychecks alone! Currently I understand he is working on a specialized virus that will KILL all of the DLP machines opening weekend of Episode II.

)

Seriously though, there are programs that scum like this can run to track your login names on AIM and ICQ and they use it as yet another form of cheap advertising.

Posted by Paul G. Thompson (Member # 655) on 05-09-2002, 03:43 AM:

I never had this problem with AIM or Microsoft's IM. However, I have with ICQ, which I never use anymore. For SPAM, Microsoft's Hotmail email address is the worst. But, like AOL, ALL of that stuff can be tuned out by selecting only email addresses you want to accept email from.

With both programs, it is a pain in the butt to archive acceptable email addresses, but because of the scum bags, sometimes you have no choice if you want to maintain your privacy.

Posted by Jerry Chase (Member # 660) on 05-09-2002, 11:50 AM:

I steadfastly refuse to use instant messaging of any flavor because of potential security risks. I'll quote a brand new warning about AIM, and I suggest getting rid of AIM if you can.

"AOL Instant Messenger (AIM) has a major security vulnerability in all
stable (not beta) versions dating back to 4.2. This vulnerability
will allow remote penetration of the victim's system without any
indication as to who performed the attack. There is no opportunity
to refuse the request. This does not affect the non-Windows
versions, because the non-Windows versions currently do not yet
support the feature that this vulnerability occurs in.

This particular vulnerability results from an overflow in the code
that parses a request to run an external application. This works with
any TLV type > 0x2711, because 0x2711 is filtered on the AIM server
side from the first vulnerability we reported. It appears that we
were correct in our original advisory when we stated, "This may be
more generic and exploitable through other means, but AOL has not
released enough information about their protocol for us to be able to
determine that."

IMPLICATIONS

This has the same implications as the original advisory, so I will
include the paragraphs from the first advisory:
AOL Instant Messenger (http://www.aim.com) has over 100 million
users. The implications of this vulnerability are huge and leave
the door wide open for a worm not unlike those that Microsoft
Outlook, IIS, et al. have all had (Melissa, ILOVEYOU, CodeRed,
Nimda, etc.). An exploit could download itself off the web,
determine the buddies of the victim, and then attack them also.
Given the general nature of social networks and how they are
structured, we predict that it wouldn't take long for such an
attack to propagate.

The particular overflow described supra allows a payload can be
several thousand bytes long, which leaves lots of room for
creative shellcode. In addition, the shellcode can have null
bytes in it."

I'm not going to point to the source or the warning because of other information on the page.