ICQ 6.5 HTML Injection Bug

The venerable IM is vulnerable. SecuObs.com reports that popular instant messenger ICQ (”I seek you”), version 6.5 is vulnerable to HTML-injection attack.

What does this mean?

The incoming message window in the vulnerable ICQ client works like a mini web browser. An attacker can try to exploit the vulnerability by sending specially crafted message to the remote ICQ client. The malicious message can contain text data which will be interpreted and displayed in the incoming message window as a HTML code. Potentially an arbitrary HTML code could be injected.

There are two risks that have been identified:

1.  Information disclosure

For example, an attacker can inject <IMG> tag that could lead information disclosure (such as remote client’s IP address, browser version, OS version, etc.)

2.  Spoofing

An attacker can spoof ICQ client software’s system messages, interface elements (buttons, links) in the message window, etc. For example, it could be used for forcing of the ICQ users to click on attacker’s malicious link.

The vulnerability exists in the lastest build of ICQ 6.5, and may affect older versions as well.

As of yet, ICQ has not issued an update to fix this vulnerability. To be safe until they do, I suggest using an alternate, compatible IM client  such as Trillian, Adium, Pidgin or Digsby.

Digsby

Digsby is a multi-protocol instant messaging program that adds social networking and email notification integration. Digsby’s IM support is extensive. Digsby connects to AIM, WLM (MSN), Yahoo, ICQ, Google Talk, Jabber and Facebook Chat.

Social network support includes Facebook, Myspace, Twitter and LinkedIn, giving you the ability to update your status and get live updates from your contacts.

And Digsby gives you email notifications for Gmail, Yahoo Mail, Hotmail, AOL, IMAP and POP3 mail accounts. If you need to connect to multiple networks, Digsby is worth a closer look.

Background

Digsby began as Steve Shapiro’s school project as he worked on his MBA at Rochester Institute of Technology. The project grew to a team of developers, now operating as dotSyntax LLC. After two years of development, Digsby was first released in a private beta in February 2008, and to the public in March 2008. Since that time, Digsby has quickly grown to become one of the most popular multi-protocol IM programs on Windows.

Customization

One of Digsby’s great features is the ability to personalize the look. You can create or download new skins to change the entire look of Digsby.  You can switch the chat theme, load custom emoticon and sound sets.

Requirements

Currently Digsby is only available on Windows (XP or Vista), but Mac OS X and Linux versions have been promised.

Installation Notes

In late 2008, the Digsby installer was changed to include a number of “utilities” of dubious value. Most of these additional utilities are adware supported. Installation of these additional programs is fortunately optional, but be cautious to read each installation screen carefully and choose decline for these “extras.”

Useful Links

• Digsby – official site
• Digsby Blog – official Digsby company blog
• Digsby Forums – official Digsby support forums
• Digsbies.org – fan site with a feature wish list, skins, conversation themes, emoticon  and sound sets
• irc://irc.freenode.net/digsby – IRC chat with the digsbies; frequented by the developers
• Digsby Widget – embed this on your blog and visitors can chat directly with you

ICQ Beta for Windows Mobile

AOL announced an open beta of a new Windows Mobile application called ICQ Mobile. 

ICQ Mobile brings much of the functionality of their desktop app to your Windows Mobile device. 

Device Support

ICQ for Windows Mobile supports devices with Windows Mobile 5, Windows Mobile 6, and Windows Mobile 6.1 operating systems, including:

• T-Mobile Dash and Wing
• Sprint HTC Touch and Diamond
• AT&T Samsung Blackjack II and Epix
• Verizon Wireless XV6800 and XV6900
• Sprint Samsung Ace
• AT&T Pantech Duo and Matrix Pro
• Motorola Q
• Most Palm Treo’s

Why ICQ? 

AOL’s decision to create ICQ Mobile has some people scratching their heads. ICQ is arguably the granddaddy of instant messaging, but has largely been passed over in favor of WLM, Yahoo! Messenger or even Facebook.  ”ICQ? I haven’t used that in ages!” They are forgetting basic geography — the world is round. The mobile market is global, and ICQ still enjoys great popularity outside of North America. 

You can check out the ICQ Mobile beta here.

Useful Links

• ICQ Mobile Beta
• ICQ Web Site
• ICQ Discussion Discussion Forum
• Windows Mobile Discussion Forum

Introducing Instan-T

Instan-t 4.0 is a very effective Instant Messaging software that connects users to the four major IM networks (AOL, MSN, ICQ and Yahoo!), allowing the exchange of instant messages using a single application.

This IM software offers several unique features, such as its Skin Technology, its Multi-Network Chat that allows you to chat with users from multiple IM networks in the same chat room, and its Email signature integration that allow your email recipients to see your online status and start chatting with you without downloading any software.

Instan-t 4.0 can be used behind a proxy or firewall which makes it ideal for use both at home and at work. With users all around the world, Instan-t doesn’t have annoying ads and it is offered as a freeware version by IM solution developer Interactive Networks Inc.

• Download instan-t 5.0
• Discuss in the forum

Sebastian Haro  represents press and communications from Interactive Network Inc.