Shoutbox

That is not my point. While Messenger Plus! does not open ports for listening, it does connect via the network to other computers on the internet (the update service for one) and these connections are made in the following manner:

1) Resolve the IP address for msgpluslive-update.net
2) Make a connection to this IP address
3) See if there is an update, if there is then download it.

Step 1 is exploitable using DNS spoofing. Step 2 is exploitable (in some cases) using ARP spoofing. Step 3 is exploitable (fake update response sending malware instead of patch) once either step 1 or 2 have been exploited.

In order to determine the update protocol I could simply inject myself between the client and server as a transparent proxy using DNS/ARP spoofing in a classic man-in-the-middle attack, then monitor all network traffic on that connection. I could then follow the messages sent and received and use the information gathered to create my own application that simulates the update server's behaviour.

Other than using an SSL certificate to fully authenticate the server and encrypt network traffic, I am unaware of any feasible method of preventing man-in-the-middle attacks from succeeding.