Date:   September 24, 2004
Vendor: America Online Inc.
Issue:  E-mail address disclosure and possible AIM account hijacking.
URL:    http://groups.aol.com / AOL Keyword: Groups
 
Notes: 
 
The following vulenerability in AOL's groups@aol feature can result in the
disclosure of an AOL Instant Messenger user's e-mail address and lead to
possible account hijacking.  This exploit has existed for quite some time
now and is being actively exploited in some capacities.
 
 
Service Overview:
 
Users of America Online (AOL) can great what is known as a group by logging
into http://groups.aol.com or going to AOL Keyword: Groups.  These groups
let AOL users create an online community where people can write each other
messages, meet and find other people, create photo display areas, manage an
events calander, and do many other things.  Anyone who uses an AOL related
product with a screen name has the ability to join these groups.  E-mail
only users are also able to sign up but only at a limited capacity.  Users
are able to invite other members to the groups with an invitation feature
that is available once logged in.  With this invitation feature, the user
can invite more members by addressing invitations to either an e-mail
address or an AOL related screen name.
 
 
Exploitation:
 
This group invitiation feature can lead to AOL Instante Messenger (AIM)
account e-mail address disclosure and account hijacking.  AIM users are
required to enter an e-mail address (whether real or not) during signup. 
This e-mail address is where lost passwords will be sent if the user
forgets their password and goes to: http://www.aim.com/help_faq/forgot_password/password.adp?.  
This e-mail address is 
also where group invitations arrive when users of an AOL Group request that a screen 
name join their group.  If a user sends a group invitation to a screen name with an 
invalid e-mail address (i.e. the user entered a fake one when signing up or no longer 
has access to it) then an error message will be generated by the MAILER-DAEMON at 
that e-mail host address.  This error message will then be sent back to the e-mail 
address of the user who sent the invitation.  The message will disclose the e-mail 
address that is no longer in use that is associated with the invited screen name.  At 
this point an attacker has multiple means to attempt to gain access to this e-mail 
address.  If the e-mail address was through a free e-mail service such as Hotmail or 
Yahoo, the attack can simply go to the website and recreate the user name.  If the 
e-mail address is through an ISP, they 
can simply signup for the username or find someone to create an alias for them.  
Finally, the user can also e-mail a web admin and engineer them into created a 
temporary e-mail account with this name.  Then all the user has to do is go to the 
above mentioned password request page and request the password for that screen name.
 
 
As a result the attacker now has the password to the account and can take
full control.  They can change the password, sign on the screen name, and
update the registered e-mail address to one of their liking.   At this
point there is absolutely nothing the victim can do.  America Online does
not support home users with AIM in any capacity.
 
 
AOL Groups can also result in e-mail address disclosure via another method.
 There does not appear to be any limit to the amount of group invitations
that can be sent to one screen name.  A user can create a script to send
thousands of group inivitations in a matter of minutes.  If all of these
invitations are directed towards one screen name, there is a good chance
that it will completely fill the inbox of a user with a message quota.  As
a result an error message will bounce back to the attacker that notifying
him that the target's inbox is full.  At the same time the message will
also include the target's e-mail address.  The attacker now has the ability
to possibly use information from this e-mail address to attempt to obtain
access to it.  Possible options include: brute force password cracking and
sending an e-mail trojans.
 
 
Solutions: 
 
There are a few possible solutions to some of these problems at this time. 
The first is to sign on your AIM screen name and make sure you e-mail
address is valid, up-to-date, and that you have access to it.  The only
other option to stop the e-mail attack is to have your account on a server
with no quota or that will not respond will a mailbox full message that
discloses your address.
 
 
Vendor Response:
 
Numerous attempts to report this bug to AOL and get a fix have been made. 
These reports like many others in the past have simply gone ignored.  This
vulnerability report will hopefully lead to a heads up to anyone who might
come under attack and will perhaps lead to a fix. 
 
 
 
Credits:
 
I would like to thank all of the people who continually spam me with these
inivitations for motivating me to put all this information into a report.
Also, go Virginia Tech!
 
 
 
-Steven
steven@lovebug.org