-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Thursday, June 13th, a mail appeared on the Bugtraq (do not confuse with Bugtraq.org) mailing list titled, "Sensitive IM Security - MSN Message Sniffing". Someone brought it to our attention on IRC (greets to all our friends in #!GOBBLES, and all our friends who have been with us there), and we took a look at the code. A few minute later, we sent the author email concerning the insecure sscanf() statement in his code, and suggested that he fix it (along with many other problems in the code). His response: "There is no problem." One of his friends, from underground.co.kr, suggested to us that this was an intentional feature, and that there had already been discussion of comprimising hosts, targetted from the IP's in the access_log's. We then immediately wrote up an advisory/alert and sent it out to the mailing lists. We received immediate criticism. This is expected however, for any of our actions. We're doing a good job of making friends in this security world, although we are quite famous, and in the end that's really all that matters. Soon, the author of the msn666 posted to the mailing lists stating "there is no problem", and also indicating that even if there was a bug, it woudln't be significant because no one will "use this as a server like apache or mysql", which is quite nonsensical to us. It's a sniffer, not a daemon. Look at the massive (in)security history with tcpdump -- again, not a daemon, but a process that can be _REMOTELY_EXPLOITED_. After this dialouge, we quickly wrote up a second advisory, and published a fully working proof-of-concept exploit. And yet, the author continues to deny the existance of a bug. Look, if it wasn't actually a "backdoor", and was just lame coding, we apologize for the statements we made, and will give your underground.or.kr friend hell for lying to us about your true motivations. However, seeing as how you've handled it since then, it'll be hard to convince us that we're wrong -- logic is on our side. As of today, the hole is still present in msn666. Maybe it'll get patched. GOBBLES Security -----BEGIN PGP SIGNATURE----- Version: Hush 2.1 Note: This signature can be verified at https://www.hushtools.com wlwEARECABwFAj0LbEYVHGdvYmJsZXNAaHVzaG1haWwuY29tAAoJEBzRp5chmbAPs8UA ni5CX+nfanPe01E8/bDi0sFpwLiVAJ4nCU4q9fXPH88P1Vj6vWqYK2/7FA== =i8/v -----END PGP SIGNATURE-----
