Persistent XSS Attack Exposes Vulnerability in ICQ Web Version

The internet is home to numerous vulnerabilities that cybercriminals can exploit to gain unauthorized access to sensitive information. One such vulnerability has been discovered in the web version of ICQ, a popular instant messaging platform. According to security researcher Levent Kayan, this flaw allows hackers to compromise the accounts of unsuspecting users and steal session cookies.

The attack, known as a Persistent XSS (Cross-Site Scripting) exploit, occurs when an attacker injects malicious JavaScript code into the ICQ website or client. This code is then executed by the victim's browser, giving the hacker access to their account and allowing them to steal sensitive information.

Kayan discovered this vulnerability after noticing that the ICQ website fails to properly verify user profiles and status messages. He found that users can upload malware-laden files without restriction, which can be exploited by hackers to gain unauthorized access to accounts.

The researcher cautions that there may be other input spaces affected by this vulnerability, potentially allowing hackers to steal session cookies and gain access to folders stored on compromised computers. This is a serious concern for ICQ users, as it could lead to the theft of sensitive information or even allow hackers to take control of their accounts.

To mitigate this risk, Kayan recommends that ICQ users avoid clicking on suspicious links or opening attachments from unknown senders. He also suggests keeping software up-to-date and using reputable antivirus programs to protect against malware.

The discovery of this vulnerability highlights the importance of web application security and the need for developers to implement robust measures to prevent attacks like Persistent XSS. As technology continues to evolve, it is essential that users remain vigilant and take steps to protect themselves from emerging threats.

In related news, Kayan also uncovered a similar vulnerability in Skype's client software, which was reported by H Security on July 27, 2011. The discovery of these vulnerabilities serves as a reminder for users to prioritize their online security and be cautious when interacting with unfamiliar websites or applications.

Icq web version