Rendered at 18:04:09 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
compass_copium 2 days ago [-]
>When a password of 9 or more characters is sent, their buffer is over-run, and it allows you to log in.
Man, computers used to be fun
mingus88 2 days ago [-]
It really was a fun time. I remember sitting in a coffee shop just sniffing WiFi traffic.
A friend was a reporter for the local paper and interviewed the mayor. I turned my laptop around and showed my friend the mayors imap password. Just right there floating through the air.
moray 1 days ago [-]
I had to do the same at a friend's house once because he forgot his email password that was still saved in the browser!
And what about "borrowing" internet access by using a WiFi connection that used WEP? Learning the process and getting the first password was so satisfying...
frmrtntn 1 days ago [-]
In the early 2000s a lot of people rolled with no encryption at all! In high school I'd drive around the nearby neighborhoods at lunch until I found an open wifi network so I could browse the net. Never took long to find one.
mingus88 1 days ago [-]
If vendors didn’t make it a default setting that would still be the case today
I remember when SunOS shipped enterprise servers with pretty much every service enabled. And the patching process was so cumbersome and risky many admins never bothered applying the recommended patch clusters
So much to explore and poke at!
masternight 2 days ago [-]
I remember when ICQ used to give you the other persons IP address.
Then you could use that to winnuke them.
yyaakkqq 1 days ago [-]
today you can use a WhatsApp call. or meet/teams/zoom...
bestham 1 days ago [-]
Or run NetBus :-D
NexRebular 1 days ago [-]
Just to end up connecting to NetBuster.
miek 2 days ago [-]
[flagged]
wafflebot 2 days ago [-]
Lucky for me, my ICQ password was only 8 characters. And I used it on every website!
(To this day I can recall my ICQ number faster than my childhood phone number or my social security number.)
wildpeaks 1 days ago [-]
I often half-joke that my ICQ number is the last thing I'll forget if I get Alzheimer, long after my own name.
jghn 1 days ago [-]
Mine is still burned into my brain but I managed to get locked out a couple of decades ago so can't even do a nostalgia login.
jghn 1 days ago [-]
8? That was fancy. Mine was 7, all lower case characters, and I also used it on every website!
r0fl 2 days ago [-]
[dead]
nubinetwork 2 days ago [-]
Unix crypt only accepted 8 characters and ignored the rest. If your password was 123456789, it was considered the same as 12345678a.
Now I'll always have the nagging question about the recycle bin with engineer in it.
a_bonobo 2 days ago [-]
For local LAN play, Half-Life checked the CD key only for length I believe? It would happily accept 1234-56789-0123
sshagent 1 days ago [-]
I seem to vaguely recall some buffer overflow for Sun Solaris, which was fun to login with. I do wonder what fun AI would have had crawling through these old code bases to find the crazy exploits available back then
shakna 1 days ago [-]
They still are. [0]
> This could lead to remote code execution over Bluetooth with no additional execution privileges needed.
> ... Since the authentication protocol generates a different hash each time this comparison is done, there is a 1 in 256 chance that ANY password would be accepted for authentication. ...
SillyUsername 4 days ago [-]
So this is how my low numbered account was stolen back in the day - thanks for sharing.
orbital-decay 2 days ago [-]
My UIN was merely 7-digit and when it got hacked the guy just logged in, chatted with my friends about random things, and left. I only found out because they were puzzled by "me" talking weird.
486sx33 2 days ago [-]
[dead]
netsharc 1 days ago [-]
I wonder whether the password change mechanism asked for the old password... or if the same flaw existed.
"What's your old password?"
"something_more_than_8_characters_long"
"Let me check. The result of the check is... ERROR. Great, what's your new password?"
rashkov 2 days ago [-]
Can’t believe I still remember my ICQ id
giantrobot 2 days ago [-]
Mine is seared into my brain. It's also cheating a bit because it's only six digits.
stingraycharles 1 days ago [-]
Same like my Geocities homepage, never forget.
I feel like it's the same with your first phone number back when there were only landlines, etc. Some numbers are hard-wired.
hdgvhicv 1 days ago [-]
Mine was 7 but I had it fur 5 years.
I also remember my compuserve id which lasted a mere 6 months over 30 years ago, And that was 10 digits.
wafflebot 2 days ago [-]
I was gonna drag you for making such a silly flex then I realized I'm just jealous because mine was eight
gersonazgo 2 days ago [-]
I read your comment and realized I also do haha lol lfmao rofl
aussieguy1234 2 days ago [-]
If it happened to me, my next move would be to steal it back
egeozcan 2 days ago [-]
This made me realize that I still remember my ICQ UIN! I cannot remember what I've had for lunch yesterday, btw.
pwarner 1 days ago [-]
2726304
I forgot my ATM PIN though.
berofeev 22 hours ago [-]
71191733
Gareth321 1 days ago [-]
Mine began with a 2. Just saying.
ButlerianJihad 1 days ago [-]
That matters not at all, unless you reveal how many digits it is. Why isn’t anyone in this thread willing to reveal theirs? Just brag about it?
Mine also began with a 2. It was 279866. My girlfriend’s was slightly lower, as she introduced me to the new service. We both felt like pioneers in those halcyon days.
Mine was quickly usurped by a Russian hacker. The profile was replaced by Cyrillic writing. I never knew how they did it. None of my other accounts or socials have ever been usurped like that!
thomc 1 days ago [-]
I remember a lot of low number ICQ accounts being taken over back in the day, including my own and several security-minded friends. Because of how prevalent it was and how it was the only account we'd had compromised we assumed they found a flaw or had access to reset passwords, or could social engineer support etc.
It's good to finally know there was a critical flaw like the one in OP that was likely used.
jghn 1 days ago [-]
Mine was in the 3.5 million range. My roommate at the time had a 6 digit number and didn't sign up that much before me, I remember it felt wild that they had grown so quickly. And then not long after that it was all 8 digit numbers.
And also yes, the last time I looked, my account was all cyrillic.
darkwater 1 days ago [-]
In my case because I use it as a random seed or parts of it as PIN, cause I will never forget it and it's "secret" enough.
vaylian 1 days ago [-]
More importantly: Are you and your girlfriend still in contact with each other today?
FroshKiller 1 days ago [-]
Mine was 8966646, which is cool because it has 666 in it.
waltbosz 2 days ago [-]
AOL Instant Messenger had several remote code execution exploits. They worked just by sending an IM to someone. You could also crash their computer remotely, or maybe it would just create their client.
Also their stored password encryption algorithm was easily reversible.
Hydraulix989 2 days ago [-]
AIM's built-in HTML parser had a bunch of super-linear parser complexity bugs, leading to people building "punters".
camcil 2 days ago [-]
The AIM days are one for the books. What a time to be alive and interested in computerin'
jonhohle 2 days ago [-]
Wasn’t that how audio avatars worked (not by crashing, but ACr)? What a time to be alive.
waltbosz 2 days ago [-]
Don't know how they worked, but what you did to create one was rename a .wav to a .jpg .gif .bmp .etc
runep 1 days ago [-]
ICQ sent messages directly between peers when both were online and unfirewalled and there were no verification that you were who you claimed. I had a lot of (friendly) fun spoofing other ICQ numbers. Or sending someone a message from themselves.
mannycalavera42 2 days ago [-]
Tooooooooooooooooooooooooot!
(startup jingle, good mems)
keyle 2 days ago [-]
KeeeKooo!
Graziano_M 19 hours ago [-]
So this is a buffer overflow on the server side! Could probably have been used for RCE on their infrastructure. No NX, no ASLR, etc. of course it would be difficult to work it blindly without the binary or some sort of info leak.
PedroBatista 1 days ago [-]
AI is really a dangerous technology, look how fast it’s discovering major security flaws!
urvader 2 days ago [-]
> Mirabilis / AOL really needs to fix this problem.
taspeotis 2 days ago [-]
Rewrite it in Rust
jghn 1 days ago [-]
It'd be blazingly fast!
Teknomadix 2 days ago [-]
Ask an agent to rewrite it in Rust. #ftfy
Subdivide8452 1 days ago [-]
Am I correctly understanding that ICQ had an 8 character limit on the passwords?
chuckhend 2 days ago [-]
Uh oh!
pavel_lishin 2 days ago [-]
There are some point of sales systems that use the same sound effect, and every time it's like I'm teleported back to the 90s, sitting in my room with a pepsi, browsing the web and chattin' with friends.
notpushkin 2 days ago [-]
I only recall this beibeing used by McDonald’s in Russia, which seems to check out (no pun intended) considering your username :-)
pavel_lishin 1 days ago [-]
Hah! I haven't been to a Russian McDonald's in ... certainly over a decade, maybe longer.
tehlike 2 days ago [-]
Incoming file transfer
stavros 2 days ago [-]
Oh god this instantly took me back to my the way teenage years' room felt and smelled.
scun 1 days ago [-]
like hamsters
myth_drannon 2 days ago [-]
I think I discovered that by mistake using Miranda client in 2002!
The tech scene of the 90s in Israel was crazy. Mirablis was hiring high school students to do QA.
SG- 1 days ago [-]
i still remember my ICQ number all these years later.
Man, computers used to be fun
A friend was a reporter for the local paper and interviewed the mayor. I turned my laptop around and showed my friend the mayors imap password. Just right there floating through the air.
And what about "borrowing" internet access by using a WiFi connection that used WEP? Learning the process and getting the first password was so satisfying...
I remember when SunOS shipped enterprise servers with pretty much every service enabled. And the patching process was so cumbersome and risky many admins never bothered applying the recommended patch clusters
So much to explore and poke at!
Then you could use that to winnuke them.
(To this day I can recall my ICQ number faster than my childhood phone number or my social security number.)
> This could lead to remote code execution over Bluetooth with no additional execution privileges needed.
[0] https://www.cve.org/CVERecord?id=CVE-2020-0022
https://www.rapid7.com/blog/post/2012/06/11/cve-2012-2122-a-...
> ... Since the authentication protocol generates a different hash each time this comparison is done, there is a 1 in 256 chance that ANY password would be accepted for authentication. ...
"What's your old password?"
"something_more_than_8_characters_long"
"Let me check. The result of the check is... ERROR. Great, what's your new password?"
I feel like it's the same with your first phone number back when there were only landlines, etc. Some numbers are hard-wired.
I also remember my compuserve id which lasted a mere 6 months over 30 years ago, And that was 10 digits.
I forgot my ATM PIN though.
Mine also began with a 2. It was 279866. My girlfriend’s was slightly lower, as she introduced me to the new service. We both felt like pioneers in those halcyon days.
Mine was quickly usurped by a Russian hacker. The profile was replaced by Cyrillic writing. I never knew how they did it. None of my other accounts or socials have ever been usurped like that!
It's good to finally know there was a critical flaw like the one in OP that was likely used.
And also yes, the last time I looked, my account was all cyrillic.
Also their stored password encryption algorithm was easily reversible.
The tech scene of the 90s in Israel was crazy. Mirablis was hiring high school students to do QA.