David Cassel
AOL Instant Messenger is hacked
Three 17-year-olds take credit for inserting pornographic images into America Online's widely used chat service.
Users of the latest version of AOL’s Instant Messenger (AIM) software started encountering an unpleasant surprise on Saturday morning: At least three crackers — malicious hackers — began inserting pornographic images into “AIM Today” and vandalizing content on at least four screens of the chat software.
Since last August, users who launched the latest versions of AIM also launched an informational “AIM Today” window — but as late as 4 pm PST Saturday, if users clicked on the “entertainment” link on AIM Today, followed by a click on any of the following three links advertising the chance to “Meet New People” who wanted to discuss the categories of “Celebrities,” “Soap Operas” or “Comedy,” they would pull up pages displaying pornography, as well as sound files apparently containing messages from the two crackers (“Yeah, fuck you, Sirk owns this shit” — “This is Neon, fuck you Sirk”).
No matter which of the top three “Meet New People” categories are chosen, the content appears to have gone haywire. At the Celebrities link, a series of four pornographic images cycles in an animated GIF. On the Soap Operas link, a Prodigy song plays in the background as a MIDI file. On the Comedy link, below a fifth pornographic image, are pointers to the Aryan group National Alliance.
The chatter and X-rated images appeared next to ads for TV shows broadcast on the AOL-owned Warner Brothers network, including “Charmed” and “Felicity.” AOL officials did not return phone calls over the weekend, but the incident occurred at the same time as the AIM home page was boasting: “Potential AIM Security Issue Resolved.”
An online chat interview with one of the crackers, who identified himself as Sirk, gave some clues as to the methodology. When new members join the AIM service, they can apparently include HTML code in their screen names. That code can include tags that call off-site images and sound files or display text — material that appears where the screen name should appear listed under “Meet New People.”
Sirk — whose name appears throughout the cracked pages — identified himself as one of three 17-year-olds from Connecticut who had been studying AIM for security holes. “I’m surprised somebody hadn’t thought of doing it sooner,” he messaged, “knowing that the AIM Today ‘meet new people’ section is all done through [HTML] links.” He says he hopes to write computer programs that will automatically generate the code to insert images and text into AIM Today — or even re-route AIM Today visitors to a Web page fishing for their password and screen name.
This is not the first time AIM has experienced security holes. Two years ago users discovered that their AIM accounts could be hijacked if the corresponding AOL screen name was not already taken. Sirk taunted AOL for their apparent security holes and their restrictive Terms of Services, but his motives appeared simple: “I’m doing it because I can, and I will.” But he did offer a bombastic message for AOL.
“I’m only hoping that they are upset, and realize that they can’t just program everything like 7th graders.”
He also had a message for AIM users worried about security: “Before using AIM, they should do a little research and find out that this is all part of the territory,” said Sirk. “If you are using a program that’s got as many loopholes and gaps as Swiss cheese, then prepare for the consequences.”
So long, Douglas Adams, and thanks for all the fun
The author of "The Hitchhiker's Guide to the Galaxy" was a geek's geek. The Net will miss him.
As soon as the news began to spread that author Douglas Adams had died Friday from a sudden heart attack at age 49, tributes to the science fiction humorist began to blossom all across the Internet. There has always been a strong correlation between computer geekdom and science fiction, so it’s not that big of a surprise that the author of “The Hitchhiker’s Guide to the Galaxy” would be remembered fondly online. But Adams was more than just a science fiction satirist — he was also passionate about technology in the here and now, a geek’s geek who was paying close attention to current developments even as he focused his fiction as far ahead as the end of the universe.
Continue Reading CloseAnd justice for all
Metallica's pursuit of Napster inspires protests and parodies across the Web.
Metallica is currently Public Enemy No. 1 for many music-loving webheads — and the Net is throbbing with protests and parodies of the heavy-metal band that filed suit against Napster and demanded that more than 300,000 folks who have traded tunes like “One” and “Enter Sandman” online be blocked from the music-swapping service. Last week, as Napster won a Webby Award for best music site and Metallica drummer Lars Ulrich geared up to debate rapper and outspoken MP3 supporter Chuck D on “Charlie Rose,” there was hardly a corner of the Web that wasn’t riffing on Metallica’s attack and the Net’s ability to free the music. Here’s a quick roundup:
Continue Reading CloseWazzup, Elian!
An AP exec gets a lesson in Net-age protesting and backs down on threats against makers of an Elian parody, which contained photos from the Miami raid and voices from a Budweiser ad.
The Associated Press photo was splayed across newspapers and magazine covers across the nation — little Elian, screaming with fear, as an FBI trooper points a gun in the direction of his head. Once the picture became a sensation, it was merely a matter of time before someone online turned it into a parody; and sure enough, someone did, animating the Elian photo to the soundtrack of the popular Budweiser “Wazzup!” commercial.
Within hours, the smart alecks behind the parody were engaged in a legal tiff with officials from the Associated Press, who forced them to take the site down. Now, however, the satirists appear to be winning concessions from a “chastened” AP.
Continue Reading CloseThe HampsterDance comeback
The dancing hamsters that took the Net by storm are back, and gunning for a career as rappers.
Did you think the HampsterDance was one of those odd, fleeting phenomena that temporarily titillated the Net’s funny bone and then disappeared into the ether? Well, you were wrong. The HampsterDance is back in town and, if Deirdre LaCarte has her way, on its way to becoming a media empire.
LaCarte, creator of the wildly successful Web page filled with animated dancing rodents, recently unveiled her new “interactive” hamsters. At HampsterDance2.com, viewers can speed up and slow down both the music and the dancers. Individual hamsters can even be dragged to different locations on the screen; clicking on them pauses their motion so the dance steps can be started at different times.
Continue Reading CloseEven “MacGyver” is no match for an AOL security breach
A computer security consultant loses his Instant Messenger account to a hacker, who finds the screen name too good to give up.
Habeeb Dihu chose the name “MacGyver” for his America Online instant messaging account because, like the TV detective, he was adept at tinkering with equipment. But on Feb. 8 the Chicago computer security consultant encountered a problem even the real MacGyver would have a hard time solving.
“I suddenly got a message saying my screen name was being logged off of AOL Instant Messenger because I’d logged in elsewhere,” he says. Two weeks had passed since AOL said it had plugged a security hole which allowed unauthorized access to AOL Instant Messenger (AIM) accounts, but someone was demonstrating that the hole was still open — and had claimed Dihu’s account.
Continue Reading ClosePage 1 of 3 in David Cassel