A historical security flaw in the ICQ messaging service, dating back to 1998, has resurfaced in discussion as a notable example of early internet infrastructure vulnerabilities. The primary issue involved a server-side buffer overflow triggered when a user submitted a password of nine or more characters. Because the system appeared to have an eight-character limit for passwords, exceeding this length could potentially allow an attacker to bypass authentication or execute remote code on the service's infrastructure.
Commenters on Hacker News discussed the technical implications of such flaws, noting that in the late 1990s, modern security mitigations like NX (No-Execute) bits and ASLR (Address Space Layout Randomization) were not standard. This lack of protection made it theoretically possible to exploit buffer overflows more easily, provided the attacker could navigate the system without a binary or information leak. The discussion also touched on the era's general lack of verification; for instance, some users noted that ICQ occasionally sent messages directly between peers without verifying the sender's identity, which allowed for the spoofing of other users' account numbers.
Beyond the specific ICQ overflow, the conversation highlighted broader security trends of the era, such as easily reversible password encryption and vulnerabilities in competing services like AOL Instant Messenger (AIM). For example, one commenter noted that AIM's built-in HTML parser suffered from super-linear complexity bugs, which led to the creation of 'punters'—tools designed to exploit these inefficiencies. These historical examples serve as a baseline for how early instant messaging protocols prioritized connectivity over robust security, leading to a landscape where sniffing unencrypted traffic or spoofing identities was a common occurrence before modern encryption standards became ubiquitous.