Re: [Full-disclosure] ICQ 6 protocol bug?



Valdis.Kletnieks@xxxxxx wrote:
On Sat, 14 Feb 2009 23:26:48 +0200, James Matthews said:


ICQ is known to have a few remote bugs. I use meebo.com instead of a client
due to these issues.


At which point you're probably trading known bugs for unknown bugs. ;)

Of course, this is a battle the user can't win. The other option is to
toss the proprietary ICQ client and use some other open-source client like
Pidgin - at which point you're trading known ICQ bugs for unknown Pidgin bugs.
At that point, your best bet is to consider 2 things:

1) What client am I most likely to see actual attacks against?
2) What client am I the most worried about attacks?

(Note the two don't have to be the same - widespread ICQ attacks may be more
common, but maybe you worry more about getting hit with a Pidgin attack because
it possibly means you're being targeted....)


Pidgin seems to spontaneously self combust without it being attacked.
Which is just a little bit more disruptive.

So there's the trade off: do i worry about attacks or worry about my
conversation being randomly disrupted?

But in summary, nobody seems to know of anything new, so I need
to watch the icq traffic with wireshark to see what's what.

At the very least, messages from unknown parties can be ignored
and it seems to be the rendering(again!) that has caused problems.

Darren

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: [Full-disclosure] ICQ 6 protocol bug?
    ... At which point you're probably trading known bugs for unknown ... toss the proprietary ICQ client and use some other open-source ... Pidgin - at which point you're trading known ICQ bugs for unknown ... What client am I most likely to see actual attacks against? ...
    (Full-Disclosure)
  • Re: Anomaly Based Network IDS
    ... is NOT used to detect attacks. ... > one single zero day attack. ... > time looking at past security bugs knows they could be anything. ...
    (Focus-IDS)
  • Re: Anomaly Based Network IDS
    ... > Crying wolf: False alarms hide attacks ... > one single zero day attack. ... > security vulnerability not yet shown to the public. ... > time looking at past security bugs knows they could be anything. ...
    (Focus-IDS)
  • Re: Countering chosen-plaintext attacks
    ... If you assume that attacks ... Those unknown attacks are ... That's not a 'protocol' in my understanding of the word. ... idea I had in my humble design WEAK4-EX. ...
    (sci.crypt)
  • The generals are playing it very dirty. Hit man paid by junta.
    ... Burma's opposition politician attacked by unknown perpetrator - Zarni ... Aye Thar Aung, a member of the 'Committee Representing People's ... frequent attacks by unknown perpetrators. ...
    (soc.culture.burma)