quote:
Originally posted by Burningmace
That is not my point. While Messenger Plus! does not open ports for listening, it does connect via the network to other computers on the internet (the update service for one) and these connections are made in the following manner:
1) Resolve the IP address for msgpluslive-update.net
2) Make a connection to this IP address
3) See if there is an update, if there is then download it.
Step 1 is exploitable using DNS spoofing. Step 2 is exploitable (in some cases) using ARP spoofing. Step 3 is exploitable (fake update response sending malware instead of patch) once either step 1 or 2 have been exploited.
GREAT.
No, seriously, that's wonderful. Now let's make sure that we don't use our computers to make any sorts of requests, HTTP or otherwise, because there might be someone performing a man-in-the-middle attack.
