Re: ICQ Pass Cracker.

[vlad () SANDY RU (Vladimir Dubrovin)]

Hello Blue Boar,

27.01.00 8:02, you wrote: ICQ Pass Cracker.;

B> Please elaborate.  Is there a local ICQ password on the HD that can be
B> poked at?  Do you know what the allowed character set is?  Or are you
B> talking about bruting the ICQ servers?  If it's the latter, 8 characters
B> can take a long, long time across a network, and that's assuming there is
B> no lockout feature.

B>                                         BB

ICQ  99b  stores  plain  text  passwords  (both  ICQ password and POP3
password  for  e-mail  notification) in the (uin).dat file among other
setting. Absolute offset in the file isn't fixed (this file looks like
some database format), but it must be stored inside (at least a lot of
trojans  can steal ICQ passwords). I don't have a time and pleasure to
parse ICQ database format, but the password always precedes
"Family       ú¦ • Friends      û¦ > Co-Workers"
phrase  with  very short offset (probably fixed). Crack looks trivial.
Passwords are stored as ASCII (Not Unicode). Charset isn't stored, ICQ
always sends characters without charset convertation.

By  the  way  -  is seems that passwords are stored independing on ICQ
security settings.

  +=-=-=-=-=-=-=-=-=+
  |Vladimir Dubrovin|
  | Sandy Info, ISP |
  +=-=-=-=-=-=-=-=-=+