MSN Messenger Paranoia
Posted: Wed Sep 01, 2004 4:54 pm
Hello everybody, been a while since i started a new thread myself, lol.
Im sure some of you have an idea that it's possible, and some probably know how, to take advantage of someone else's msn messenger program. MSN Messenger sets up registry keys on your system when it installs it's self. one of those keys is named "Server". This key tells your MSN Messenger where to connect when you try and sign in. This key can easily be changed manualy, remotely, or with a file type that can update the registry such as but not limited to... .exe's .bat's .reg's .dll's .ocx's .mrc or any type of file that can be ran through a scripting language that can Run other programs such as mirc and perl. I find it a good idea to check these server value's any time something "fishy" may be happening or if you are just generaly paranoid. it is OKAY to change this value for whatever reason, such as wanting to debug your Client/Server information. but it is not suggested you do this unless you are absolutley sure about what you are doing and who the IP address you are changing it to, belongs. You dont neccisarilly have to worry about your password information being stolen. but that can be the least of an attacker's plans when if they can manipulate you into changing your server value into their ip, they can use your copy of msn messenger remotely, even if you try and sign out, if you try and sign out it is a matter of blocking the OUT command, and telling you that your (M) is closed when actualy the connection is still alive. i wont give much more detail as to how to go about doing other things but it should be known that anything you can do via messenger, a remote attacker could do, and then some, especially since the messenger interface is limiting in it's capabilities as it is. Attached are two programs in relation to this post. one is MessengerChecker. I made messenger checker because i grew lazy of constantly manualy checking my server values or having to update it manualy. Messenger checker lets you check your values, and update them if you wish, with the click of a button. If you ever have a server value to an ip or host that is non-existant, MSN Messenger does have a nice feature that automatically resets the server key in this case. The other program is just a debugger im working on. It is not finished but i think it is a good example of what i meant by setting your local host as the IP and then debugging the information. Hopefully some others may take this as an inspiration to create their own Messenger programs from this idea. This technique does not require any API calls or hassling refrences, i originaly thought of it when i was only mirc scripting, and made a "debug thingy" that i posted on proboards8. anyhow here are both the programs. if you feel uncomfortable using either of these.. you can manualy check your server values by going to one of these keys in the registry editor:
[HKEY_Current_User] Software\Microsoft\MessengerService -or-
[HKEY_Current_User] Software\Microsoft\MSNMessenger
the server values should be: messenger.hotmail.com;207.46.104.20:1863
this may not be your server value. If not i suggest that you click the "Reset" button next to the server value that is incorrect, and use the default server value provided in the Prompt you receive after clicking Reset. If you do not wish to update your server value, then you can try to use tracert or nslookup in the command prompt to trace the IP or Hostname. Check for something similar to messenger.hotmail.com or messenger.msn.com. btw the Riftmess program is updated, i added a bit more to it, but for now im uploading the one that i have zipped already because im about to go to bed. so far one of the new things in the updated version is it allows you to debug message sessions instead of just the main server data. also it allows you to spoof who's typing. so the other user might see something like "George Bush is typing you a message". not that it's important but a fun option. i know the Riftmess program is cluttered, that's because right now it's just a fairly personal project, but i want to let it out every now and then just to see what others might think or if they might try to make their own from the idea of mine or they may have one that's already been released and want to share some input on what i should add to mine. to use the Riftmess program click Debug > "your Version" (4.7 or 6.x+) > On. Then click the "Connect" button, then sign into your MSN Messenger as you normaly would and the trace window should start showing you the data. i know the UI isnt easy or constructed like it could be, but again like i say it's been for my own uses and i have more fun with the code, not the UI lol, so when it's ready for release ill doll up the UI and put out the sourcecode + binary. anyhow Have fun !
Im sure some of you have an idea that it's possible, and some probably know how, to take advantage of someone else's msn messenger program. MSN Messenger sets up registry keys on your system when it installs it's self. one of those keys is named "Server". This key tells your MSN Messenger where to connect when you try and sign in. This key can easily be changed manualy, remotely, or with a file type that can update the registry such as but not limited to... .exe's .bat's .reg's .dll's .ocx's .mrc or any type of file that can be ran through a scripting language that can Run other programs such as mirc and perl. I find it a good idea to check these server value's any time something "fishy" may be happening or if you are just generaly paranoid. it is OKAY to change this value for whatever reason, such as wanting to debug your Client/Server information. but it is not suggested you do this unless you are absolutley sure about what you are doing and who the IP address you are changing it to, belongs. You dont neccisarilly have to worry about your password information being stolen. but that can be the least of an attacker's plans when if they can manipulate you into changing your server value into their ip, they can use your copy of msn messenger remotely, even if you try and sign out, if you try and sign out it is a matter of blocking the OUT command, and telling you that your (M) is closed when actualy the connection is still alive. i wont give much more detail as to how to go about doing other things but it should be known that anything you can do via messenger, a remote attacker could do, and then some, especially since the messenger interface is limiting in it's capabilities as it is. Attached are two programs in relation to this post. one is MessengerChecker. I made messenger checker because i grew lazy of constantly manualy checking my server values or having to update it manualy. Messenger checker lets you check your values, and update them if you wish, with the click of a button. If you ever have a server value to an ip or host that is non-existant, MSN Messenger does have a nice feature that automatically resets the server key in this case. The other program is just a debugger im working on. It is not finished but i think it is a good example of what i meant by setting your local host as the IP and then debugging the information. Hopefully some others may take this as an inspiration to create their own Messenger programs from this idea. This technique does not require any API calls or hassling refrences, i originaly thought of it when i was only mirc scripting, and made a "debug thingy" that i posted on proboards8. anyhow here are both the programs. if you feel uncomfortable using either of these.. you can manualy check your server values by going to one of these keys in the registry editor:
[HKEY_Current_User] Software\Microsoft\MessengerService -or-
[HKEY_Current_User] Software\Microsoft\MSNMessenger
the server values should be: messenger.hotmail.com;207.46.104.20:1863
this may not be your server value. If not i suggest that you click the "Reset" button next to the server value that is incorrect, and use the default server value provided in the Prompt you receive after clicking Reset. If you do not wish to update your server value, then you can try to use tracert or nslookup in the command prompt to trace the IP or Hostname. Check for something similar to messenger.hotmail.com or messenger.msn.com. btw the Riftmess program is updated, i added a bit more to it, but for now im uploading the one that i have zipped already because im about to go to bed. so far one of the new things in the updated version is it allows you to debug message sessions instead of just the main server data. also it allows you to spoof who's typing. so the other user might see something like "George Bush is typing you a message". not that it's important but a fun option. i know the Riftmess program is cluttered, that's because right now it's just a fairly personal project, but i want to let it out every now and then just to see what others might think or if they might try to make their own from the idea of mine or they may have one that's already been released and want to share some input on what i should add to mine. to use the Riftmess program click Debug > "your Version" (4.7 or 6.x+) > On. Then click the "Connect" button, then sign into your MSN Messenger as you normaly would and the trace window should start showing you the data. i know the UI isnt easy or constructed like it could be, but again like i say it's been for my own uses and i have more fun with the code, not the UI lol, so when it's ready for release ill doll up the UI and put out the sourcecode + binary. anyhow Have fun !
