AIM+ SpyWare

["Pedram Amini" <pedram.amini () tulane edu>]

        Users of AIM+ are unwittingly sharing information about
themselves every time they connect to AOL. Aside from the spyware, AIM+
in my opinion is an excellent AOL instant messenger wrapper.

        What is AIM+? From the website (www.big-o-software.com): "AIM+
is an add-on to AOL's Instant Messenger for Windows. It integrates
automatically and flawlessly with AIM, adding crucial features like
IM/Chat Logging (with an integrated History Browser), Ad Removal,
Cloning, Customizable Buddy List Window, and Translucent Windows."

        I noticed some odd traffic which upon examination became
immediately identifiable as belonging to AIM+. In version 2.1.1 build 59
(as well as the latest release 2.2 build 63 and probably earlier
releases) an HTTP connection is made to www.big-o-software.com
(63.242.135.29) referencing a PHP script which stores the following
information:

        - AOL instant messenger screen name
        - AIM+ information:
                - all your AIM+ settings
                - AIM+ version
                - AIM+ paths
        - OS and version
        - Computer network name
        - CPU and RAM information
        - Screen resolution
        - Current UID (NT)

        The author of course also gets your IP address and login time
for free from the request. I wrote the author about this issue on
5.6.2002 and have received no response to date.

        There is a simple fix for those who would like to continue using
the software while removing the spyware:

        - Open AIM+.dll from your AIM+ install directory with a hex
editor
        - Locate the string "tracking"
        - Null out the entire URL

        Here are the approximate addresses of the strings to remove in
the latest two releases of AIM+:

        2.1.1 build 59  0x126a0
        2.2 build 63    0x13790

        If you want to be really lazy you can download replacement dll's
from my website, again for the latest two releases of AIM+:

        http://pedram.redhive.com/advisories/AIM+/

-pedram