ICQ can be fed crafted updates

Because the Instant Messaging client ICQ fails to verify the authenticity of updates downloaded from the web, it is possible to substitute trojans for genuine updates. An attacker would, however, need to be able to reroute the resolution of the IP address for update.icq.com to his own server by, for example, interfering with the router or cache poisoning the DNS server.

Shortly after installation, ICQ searches for and downloads updates. Because updates are not carried out via a secure SSL connection with certificate verification and are not signed, it is possible to insert third party files. Daniel Seither, who discovered the problem, has written two Python tools to illustrate the problem.

The first tool creates a zip file from an arbitrary .exe file and an update.xml metafile which purports to contain information on the update. A simple Python web server then serves these files (after spoofing the DNS) to the IM client, which then installs the fake icq.exe update.

Tests by heise Security using calc.exe found that the Windows calculator was launched instead of ICQ when ICQ was started. Attackers could of course deliver trojans in place of the calculator. Seither reports that he informed the vendor, but has yet to receive a response. US-CERT has also issued a warning relating to this issue.

Because it is not possible to switch off automatic updates, Seither is advising users to switch to another IM client until the problem has been resolved. The basic problem of failing to use digital signatures for updates is known to affect many other products.

(trk)