A group of teenage hackers who say they've been stealing America Online Instant Message user names and masquerading as them to steal credit card and other personal information from the users' friends and families have shown MSNBC just how they do it.
They demonstrated their tactics to MSNBC on Jan. 24. The network says a letter they sent the technology press Jan. 23 claims they use the names "just for the pure joy of trying to ruin friendships by insulting friends who have no idea they are talking to a hacker and not the victim."
MSNBC also says the hackers contacted the tech press because AOL hadn't responded to their notice about the security hole. AOL spokesman Rich D'Amato tells MSNBC the online service knows about the hole and is "deploying measures to defeat it.
"When hacker behavior crosses the line into illegal action, we'll certainly bring it to the attention of authorities," D'Amato says.
One of the teen thieves, calling himself TangentX, told MSNBC AOL is "so easy to abuse it's pathetic." D'Amato wouldn't say how many people the teen hackers had hit or even isolate the timeline, claiming those details could impede the investigation.
TangentX told MSNBC he and two others found the security hole last fall, discussed it in private chat rooms for hackers on AOL, and the exploit spread. TangentX says four hundred names had been stolen as of Monday. AOL says 45 million people have created AOL Instant Message screen names as of last August. AOL also owns ICQ, a popular instant message program claiming 50 million registered users.
TangentX told MSNBC he and others found several ways to make an Instant Message user name into an AOL account without the passwords - resetting a password for a screen name through a security hole, or taking a user name and creating a new AOL account for it, then changing the password.
TangentX demonstrated it to MSNBC Monday night - getting a screen name, accessing the account, and sending an Instant Message from that screen name "in a matter of minutes."
