AOL communities get hacked again
Published: 29 Jun 2001 14:28 BST
AOL's ICQ servers were hacked on Monday for the second time this year, it was revealed last night.
The ICQ homepage was defaced by the hacking group Innocent Boys, while a separate server ICQgroup01.icq.com was simultaneously attacked by the notorious Men in Hack (MiH) crackers who added a defaced page to the community page.
The free peer-to-peer ICQ software uses the Microsoft IIS Web server. "This has more holes than Swiss cheese," said Mark Read, systems security analyst for computer security company MIS Corporate Defence Solutions. "It seems that Microsoft doesn't understand the terms of bounds checking -- I strongly suspect that within the next couple of weeks another hack of this system will be found."
The two main vulnerability exploits of IIS that crackers are targeting at the moment are the index server buffer overflow for which no official patch has yet been released, and the IIS 5 remote printer overflow, said Read. "Microsoft has released patches for known exploits, but people install servers and don't install the patches or subscribe to any bugtraq mailing lists," he said.
AOL said that the electronic defacement vulnerability was quickly patched, and that no customer details were accessed. But Read argues that it is difficult for AOL to be certain of this. "When you do a search on ICQ, you don't know if this is directing you to another server, or carrying out the search on the screen being defaced where data could be compromised," he said.
On Tuesday, the UK Web site of the fast food chain Burger King was defaced for the third time this year, this time by a cracker operating under the nickname of MrAgent. The flash-enabled site was hacked using a similar IIS buffer-overflow vulnerability.
Is your PC safe? Find out in ZDNet UK's Viruses and Hacking News Section.
Have your say instantly, and see what others have said. Click on the TalkBack button and go to the Security forum.
Let the editors know what you think in the Mailroom. And read other letters.
Did you find this article useful?
40 out of 71 people found this useful
- Share this article:
