4 ms·

Not to be a negative nancy, but in all likelihood there’s serious vulnerabilities in the AOL client. If you connect to this, anyone else connected to it can pro

Not to be a negative nancy, but in all likelihood there’s serious vulnerabilities in the AOL client. If you connect to this, anyone else connected to it can probably pwn you. So maybe run it in a VM or something.

dontbenebby 4y ago
- franga2000 4y ago
  Maybe the parent post was edited since, but your response seems entirely disproportionate here. Running old proprietary software which connects to untrusted servers in a secure environment like a VM is very good advice. Saying you shouldn't do it because hacking is a crime is even worse than saying you shouldn't lock your doors because stealing is a crime. I say worse because in that case at least your point about deadly force could possibly apply - you can physically stop a robber if you happen to be home. Good luck beating up a 12 year old script kiddie stealing your e-banking creds through a Tor reverse shell you aren't even aware is installed on your computer because you ran what is essentially a web browser from before sandboxing was invented on your primary computer.
  - dontbenebby 4y ago
    >Maybe the parent post was edited since, but your response seems entirely disproportionate here. Maybe it was, I don't know. What law in PA requires a proportionate response? If you don't like the laws of PA, register to vote and work to change them. >Running old proprietary software which connects to untrusted servers in a secure environment like a VM is very good advice. Yes, but the problem is most people don't know how to do that, so it's not useful to the types of people who have the freedom and time to experiment... the newbies... who are often quite young. >Saying you shouldn't do it because hacking is a crime is even worse than saying you shouldn't lock your doors because stealing is a crime. There's a difference between "lock your doors" and "lock your doors, get bars on your windows, set up an alarm, live on the third floor with no elevator, and keep a phone and a weapon next to a bed behindn a locked door" (which seems to be the level of "reasonable" security some folks here seem to want, to draw analogies from the physical world. >Good luck beating up a 12 year old script kiddie stealing your e-banking creds through a Tor reverse shell you aren't even aware is installed on your computer because you ran what is essentially a web browser from before sandboxing was invented on your primary computer. I'll just get a new credit card number or report the ach as fraudulent. I have MFA on my bank accounts plus code words. (I changed to a different one for each entity after a tour Dachau.) It sounds like in the scenario you describe, we should give that 12 year old a job, rather than invent ever creative ways to punish them for not wanting to be a low level minimum wage customer service representative because from ages 12 to 18ish they responded to adults like an adult would, while they weren't thankful the kid only acted out electronically in cheeky, playful ways.
    - hvdijk 4y ago
      > Maybe it was, I don't know. What law in PA requires a proportionate response? Nobody said it was illegal, but a disproportionate response is not likely to go over well with other people here. Whether that is a problem depends on whether you are trying to get along with other people, so will leave that for you to decide.
      - dontbenebby 4y ago
- somehnguy 4y ago
  I take it you must be aware that the threat of a felony means next to nothing when it comes to computer hacking, right? If it did people and companies wouldn’t be getting owned left and right, and the security industry wouldn’t be so huge. It’s very good and realistic advice. Ignore it at your own risk I suppose, just don’t be surprised when the obvious happens.
  - dontbenebby 4y ago
    >I take it you must be aware that the threat of a felony means next to nothing when it comes to computer hacking, right? I literally just warned you that's not the case. Even if the FBI doesn't prosecute, you can respond physically[0], but I was more speaking in the context of someone hacking wifi, where they're in close physical proximity, not the other parent's example of a remote attack. (That's why you hack... because you can do it remotely.) For context, I had a neighbor literally hack a speaker I was using to do personal, private calls, protected by PA's 2 party consent state. I don't like when people invade my privacy, repeatedly, then do a shocked Pikachu[1] when the result is to respond like an Appalachian with multiple degrees and ten years of policy experience paired with the skills of a woodsman trained by the Boy Scouts just before they went bankrupt. [0] https://www.ft.com/content/307ece16-38cb-11e4-9526-00144feabdc0 https://www.ft.com/content/307ece16-38cb-11e4-9526-00144feab... [1] https://knowyourmeme.com/memes/surprised-pikachu https://knowyourmeme.com/memes/surprised-pikachu
    - legalcorrection 4y ago
      No no no. You cannot respond to a hacker with deadly force, except in a special circumstance where you reasonably fear imminent death or serious bodily injury. I’m not going to sit here and argue with your other misguided points, but that is dangerously wrong.
- marcus0x62 4y ago
  Which part of the GP are you saying falls under the CFAA?
  - dontbenebby 4y ago
    Someone hacking someone who installed the software in the OP. Was that part not clear?
h2odragon 4y ago
There were rumors that AOL ran scanners looking for mailing addresses to send disks to. I think its possible but perhaps it wouldn't have been an "official" effort: they had some employees that would pay for address lists without concern for their provenance or suitability.
jeroenhd 4y ago
The official AOL client at one point relied on an RCE vulnerability in the client <-> server communication to thwart MSN's compatibility [1]. The client would be exploited by the server and sent new code to execute, making it impossible for most competing clients to be compatible with its protocol. If that's the programming style that was deemed acceptable for release, I can almost guarantee you that the old, unmaintained client will definitely have some other vulnerabilities left over in its protocol. [1]: https://www.geoffchappell.com/notes/security/aim/index.htm https://www.geoffchappell.com/notes/security/aim/index.htm
- ElectricTurkey 4y ago
  You are confused, AOL and AIM are two totally different pieces of software, which use different protocols and serve different purposes. The exploit in question has literally nothing to do with AOL, it's for AOL Instant Messenger. MSN never tried to access AOL's service network, but certainly AIM's.
  - Dwedit 4y ago
    I think it's pretty likely that the AOL client and AIM could have shared some code for instant messages.
    - ElectricTurkey 4y ago
      They did not, at least not until much later, many years after AOL waned in popularity -- possibly in part due to lack of money to pay enough engineers. Initially AOL's was done (GUI and non-GUI functionality) via their client API called FDO and sent assembled packets out like everything else. AIM on the other hand was a classic simple GUI app using a different protocol and used none of AOL's FDO stuff. Much later AOL used some OSCAR (AIM) libraries to piggy back the AOL client on-to AIM for buddies and IMs, but even so these were not a part of the exploits that kept popping up for AIM, and long after AIM's drop in popularity as well.

dontbenebby 4y ago

franga2000 4y ago
Maybe the parent post was edited since, but your response seems entirely disproportionate here. Running old proprietary software which connects to untrusted servers in a secure environment like a VM is very good advice. Saying you shouldn't do it because hacking is a crime is even worse than saying you shouldn't lock your doors because stealing is a crime. I say worse because in that case at least your point about deadly force could possibly apply - you can physically stop a robber if you happen to be home. Good luck beating up a 12 year old script kiddie stealing your e-banking creds through a Tor reverse shell you aren't even aware is installed on your computer because you ran what is essentially a web browser from before sandboxing was invented on your primary computer.
- dontbenebby 4y ago
  >Maybe the parent post was edited since, but your response seems entirely disproportionate here. Maybe it was, I don't know. What law in PA requires a proportionate response? If you don't like the laws of PA, register to vote and work to change them. >Running old proprietary software which connects to untrusted servers in a secure environment like a VM is very good advice. Yes, but the problem is most people don't know how to do that, so it's not useful to the types of people who have the freedom and time to experiment... the newbies... who are often quite young. >Saying you shouldn't do it because hacking is a crime is even worse than saying you shouldn't lock your doors because stealing is a crime. There's a difference between "lock your doors" and "lock your doors, get bars on your windows, set up an alarm, live on the third floor with no elevator, and keep a phone and a weapon next to a bed behindn a locked door" (which seems to be the level of "reasonable" security some folks here seem to want, to draw analogies from the physical world. >Good luck beating up a 12 year old script kiddie stealing your e-banking creds through a Tor reverse shell you aren't even aware is installed on your computer because you ran what is essentially a web browser from before sandboxing was invented on your primary computer. I'll just get a new credit card number or report the ach as fraudulent. I have MFA on my bank accounts plus code words. (I changed to a different one for each entity after a tour Dachau.) It sounds like in the scenario you describe, we should give that 12 year old a job, rather than invent ever creative ways to punish them for not wanting to be a low level minimum wage customer service representative because from ages 12 to 18ish they responded to adults like an adult would, while they weren't thankful the kid only acted out electronically in cheeky, playful ways.
  - hvdijk 4y ago
    > Maybe it was, I don't know. What law in PA requires a proportionate response? Nobody said it was illegal, but a disproportionate response is not likely to go over well with other people here. Whether that is a problem depends on whether you are trying to get along with other people, so will leave that for you to decide.
    - dontbenebby 4y ago
somehnguy 4y ago
I take it you must be aware that the threat of a felony means next to nothing when it comes to computer hacking, right? If it did people and companies wouldn’t be getting owned left and right, and the security industry wouldn’t be so huge. It’s very good and realistic advice. Ignore it at your own risk I suppose, just don’t be surprised when the obvious happens.
- dontbenebby 4y ago
  >I take it you must be aware that the threat of a felony means next to nothing when it comes to computer hacking, right? I literally just warned you that's not the case. Even if the FBI doesn't prosecute, you can respond physically[0], but I was more speaking in the context of someone hacking wifi, where they're in close physical proximity, not the other parent's example of a remote attack. (That's why you hack... because you can do it remotely.) For context, I had a neighbor literally hack a speaker I was using to do personal, private calls, protected by PA's 2 party consent state. I don't like when people invade my privacy, repeatedly, then do a shocked Pikachu[1] when the result is to respond like an Appalachian with multiple degrees and ten years of policy experience paired with the skills of a woodsman trained by the Boy Scouts just before they went bankrupt. [0] https://www.ft.com/content/307ece16-38cb-11e4-9526-00144feabdc0 https://www.ft.com/content/307ece16-38cb-11e4-9526-00144feab... [1] https://knowyourmeme.com/memes/surprised-pikachu https://knowyourmeme.com/memes/surprised-pikachu
  - legalcorrection 4y ago
    No no no. You cannot respond to a hacker with deadly force, except in a special circumstance where you reasonably fear imminent death or serious bodily injury. I’m not going to sit here and argue with your other misguided points, but that is dangerously wrong.
marcus0x62 4y ago
Which part of the GP are you saying falls under the CFAA?
- dontbenebby 4y ago
  Someone hacking someone who installed the software in the OP. Was that part not clear?

h2odragon 4y ago

There were rumors that AOL ran scanners looking for mailing addresses to send disks to. I think its possible but perhaps it wouldn't have been an "official" effort: they had some employees that would pay for address lists without concern for their provenance or suitability.

jeroenhd 4y ago

The official AOL client at one point relied on an RCE vulnerability in the client <-> server communication to thwart MSN's compatibility [1]. The client would be exploited by the server and sent new code to execute, making it impossible for most competing clients to be compatible with its protocol. If that's the programming style that was deemed acceptable for release, I can almost guarantee you that the old, unmaintained client will definitely have some other vulnerabilities left over in its protocol. [1]: https://www.geoffchappell.com/notes/security/aim/index.htm https://www.geoffchappell.com/notes/security/aim/index.htm

ElectricTurkey 4y ago
You are confused, AOL and AIM are two totally different pieces of software, which use different protocols and serve different purposes. The exploit in question has literally nothing to do with AOL, it's for AOL Instant Messenger. MSN never tried to access AOL's service network, but certainly AIM's.
- Dwedit 4y ago
  I think it's pretty likely that the AOL client and AIM could have shared some code for instant messages.
  - ElectricTurkey 4y ago
    They did not, at least not until much later, many years after AOL waned in popularity -- possibly in part due to lack of money to pay enough engineers. Initially AOL's was done (GUI and non-GUI functionality) via their client API called FDO and sent assembled packets out like everything else. AIM on the other hand was a classic simple GUI app using a different protocol and used none of AOL's FDO stuff. Much later AOL used some OSCAR (AIM) libraries to piggy back the AOL client on-to AIM for buddies and IMs, but even so these were not a part of the exploits that kept popping up for AIM, and long after AIM's drop in popularity as well.