- This topic has 4 replies, 4 voices, and was last updated 18 years, 4 months ago by
.
-
Posts
-
Okay, in regards to the “Can you view webcams without permission” the current answer is no. That exploit was patched around 2001, and it hasn’t been revived since.
For those you you interested in how it worked, Your “client” would send a spoofed invitation packet. This invitation packet was forged to look like it came form the other person as a request for you to view their webcam. Because Yahoo! did not worry about checking the sequence numbers or IP addresses on the incomming spoofed packets, this then would send back an invitation to your client allowing you to view their stream. When you invite someone to view your stream, you don’t have to click accept or not, because they know you started the connection. The basis of the exploit was making Yahoo think that the person started the connection allowing you to connect without the person knowing.
This was patched as I said before. Now Yahoo! associates sequence numbers with invitation requests so the connection can’t be forged unless you are able to packet sniff the persons current connection. To packet sniff someones current connection, they would have to be on your home network, or you would have to preform some type of Man-in-the-middle attack to gather access. This is far more difficult than what a simple proggy could do.
Honestly, your better off just not worrying about it, and if your that hard up for a peep show.. go walk around your neighborhood looking in peoples windows.
Btw, I’m not really gonna hangout here much, I have a forum of my own to host, I just happend upon this article while searching for YMSG10 protocol specs.
The second then I wanted to mention was about how to get an IP address from a user on messenger. The information in the FAQ isn’t correct (or just outdated). The only IP address you will get from IM’s or Viewing webcams on Yahoo! is that of the chat server your connected to. This is because Yahoo! now handles the connection, no direct connection means netstat won’t work. I once wrote a tutorial a few years back for the lame questions in Hackers’ Lounge:2 called The Ultimate Lamers Guide, it explains some of the old “hacks” that you could do to get an IP address, etc. its really outdated but the section on getting IP’s actually is still relevant. it can be grabbed off of my site at [link removed by moderator] get it while you can cause I stopped carrying that document due to google showing my site as a “hackers” site instead of an information resource, but it will be there for a while, just long enough for some of you to get it and pass it around if you like.~Synfire
As far as I am aware the two mentioned still do go into direct connection. Especially super webcam, as Yahoo! don’t wish to use their bandwidth for such expensive operations. This is backed up by the Official Yahoo! Help pages…
Yeah, super webcams do go P2P and so do PM’s, but only those that are between 2 “buddies.” I’m not sure if you both have to be on each other’s buddy list, or just the one sending the message has to have you on his, but either way, IM’s do go P2P if they are between buddies. Regular webcam, chat rooms, and non-buddy pm’s do go through the yahoo servers. The only other P2P connection on yahoo is a file transfer.
- You must be logged in to reply to this topic.