My UIN was merely 7-digit and when it got hacked the guy just logged in, chatted with my friends about random things, and left. I only found out because they were puzzled by "me" talking weird.
I seem to vaguely recall some buffer overflow for Sun Solaris, which was fun to login with. I do wonder what fun AI would have had crawling through these old code bases to find the crazy exploits available back then
There are some point of sales systems that use the same sound effect, and every time it's like I'm teleported back to the 90s, sitting in my room with a pepsi, browsing the web and chattin' with friends.
AOL Instant Messenger had several remote code execution exploits. They worked just by sending an IM to someone. You could also crash their computer remotely, or maybe it would just create their client.
Also their stored password encryption algorithm was easily reversible.
That matters not at all, unless you reveal how many digits it is. Why isn’t anyone in this thread willing to reveal theirs? Just brag about it?
Mine also began with a 2. It was 279866. My girlfriend’s was slightly lower, as she introduced me to the new service. We both felt like pioneers in those halcyon days.
Mine was quickly usurped by a Russian hacker. The profile was replaced by Cyrillic writing. I never knew how they did it. None of my other accounts or socials have ever been usurped like that!
I remember a lot of low number ICQ accounts being taken over back in the day, including my own and several security-minded friends. Because of how prevalent it was and how it was the only account we'd had compromised we assumed they found a flaw or had access to reset passwords, or could social engineer support etc.
It's good to finally know there was a critical flaw like the one in OP that was likely used.
Mine was in the 3.5 million range. My roommate at the time had a 6 digit number and didn't sign up that much before me, I remember it felt wild that they had grown so quickly. And then not long after that it was all 8 digit numbers.
And also yes, the last time I looked, my account was all cyrillic.
ICQ sent messages directly between peers when both were online and unfirewalled and there were no verification that you were who you claimed. I had a lot of (friendly) fun spoofing other ICQ numbers. Or sending someone a message from themselves.
> ... Since the authentication protocol generates a different hash each time this comparison is done, there is a 1 in 256 chance that ANY password would be accepted for authentication. ...
So this is a buffer overflow on the server side! Could probably have been used for RCE on their infrastructure. No NX, no ASLR, etc. of course it would be difficult to work it blindly without the binary or some sort of info leak.
68 comments
[ 1.8 ms ] story [ 50.6 ms ] threadI also remember my compuserve id which lasted a mere 6 months over 30 years ago, And that was 10 digits.
I feel like it's the same with your first phone number back when there were only landlines, etc. Some numbers are hard-wired.
"What's your old password?"
"something_more_than_8_characters_long"
"Let me check. The result of the check is... ERROR. Great, what's your new password?"
Man, computers used to be fun
Then you could use that to winnuke them.
(To this day I can recall my ICQ number faster than my childhood phone number or my social security number.)
> This could lead to remote code execution over Bluetooth with no additional execution privileges needed.
[0] https://www.cve.org/CVERecord?id=CVE-2020-0022
Also their stored password encryption algorithm was easily reversible.
Mine also began with a 2. It was 279866. My girlfriend’s was slightly lower, as she introduced me to the new service. We both felt like pioneers in those halcyon days.
Mine was quickly usurped by a Russian hacker. The profile was replaced by Cyrillic writing. I never knew how they did it. None of my other accounts or socials have ever been usurped like that!
It's good to finally know there was a critical flaw like the one in OP that was likely used.
And also yes, the last time I looked, my account was all cyrillic.
I forgot my ATM PIN though.
The tech scene of the 90s in Israel was crazy. Mirablis was hiring high school students to do QA.
https://www.rapid7.com/blog/post/2012/06/11/cve-2012-2122-a-...
> ... Since the authentication protocol generates a different hash each time this comparison is done, there is a 1 in 256 chance that ANY password would be accepted for authentication. ...