Account Compromise with Vulnerabilities in ICQ Website and ICQ Instant Messenger

Levent Kayan, security researcher is cautioning that there are vulnerabilities in both the ICQ Internet site and the ICQ IM (instant messenger) pertaining to Windows, which can let hackers compromise the ICQ account of any end-user, thus published ESecurity Planat in news on July 28, 2011.

Moreover, the researcher says that ICQ does not verify website members' profiles properly and even does not evaluate status messages that users can chose without restrictions, adequately for examining if they carry malware. Kayan lately uncovered one same kind of vulnerability inside the Skype client. The H Security published this in news on July 27, 2011.

Understandably, in case the victim goes to the ICQ website alternatively the ICQ client and views the cyber-criminal's or hacker's profile, there'll take place an execution of the implanted malicious JavaScript available from the server hosting ICQ. Apparently, with this method, session cookies can be stolen, facilitating the hackers for aping victims, alternatively acquiring admission into folders stored on a hijacked computer.

Describing this particular attack, security specialists state that it's known as Persistent XSS (Cross-Site Scripting) attack because of an absence of authorization of inputs as well as sanitization of output with respect to the 'feeds' admission. The researcher cautions that there maybe other input spaces too which get affected. The vulnerability's 'enduring' characteristic implies that attackers are capable of crafting web-pages that run malware whilst Web-surfers access them.

Commonly, XSS is an extremely frequent kind of security flaw existing online. They're normally spotted in websites, however, as numerous IM applications utilize HTML layouts such applications too can be susceptible.

Kayan the researcher said that a hacker could easily compromise remote users' session IDs as also exploit the flaw for enhancing the attack medium within the victim's inherent application as well as operating system. According to him, the said hackers in the identical way compromised ICQ websites that were utilized within critical XSS flaws. He added that XSS vulnerabilities of the reflected kind needed attackers for duping users into following maliciously created URLs, though for the persistent kinds they could be abused straight away within the existent websites.

Related article: Ascend Media Litigated by Facebook for malware and Scam

» SPAMfighter News - 8/10/2011