Hello guys, how are you? I am here to tell you that we have some EPIC news we have also managed to revive MSN Messenger (versions 4 and I think 5 too? 5 is untested but according to Google, MSNP 7 which we have managed to revive is created for MSN Messenger 5), all of this thanks to our friend @BasicallyMachine’s effort, MSNP 8 is also coming soon so stay tuned. If you are interested, here is the invite to our server: Project Reconnected . Have a good day! 
Update: according to the dev, server supports versions of MSNP from 2 to 8 now.
Update: here is some new screenshots:
You are looking at MSN Messenger 3 and 2, I was told that MSN Messenger 1 works as well.
Btw, we have managed to reach 400 members mark! thank you guys, your support and faith in us allowed is to get this far, join our server and stay tuned because it’s obvious that this is only the beginning 
TLDR: Security nightmare, likely vibe coded, use at your own (very high) risk
Decided to play around with this out of curiousity.
First off, HOST modifications for patching??
Not only will this break practically anything relying on Microsoft accounts because of redirecting login.live.com (which also would send your Microsoft account credentials or auth token to their servers, which given my later findings I don’t think you should trust that), not only do the MSN Messenger 1.0 - 4.7 (MSNP2 - 7, MSNP1 does not exist) clients use a much less destructive method of patching via a simple Registry string, but most of these endpoints save for messenger.hotmail.com are not used by those versions at all. loginnet.live.com also was never used by any official WLM client. Also:
HOSTS entry for your own DuckDNS domain? Why not just point it to that IP address?
And:
You’re launching publicly before you have messaging, the most important cornerstone of an IM platform implemented. Trust me when I say this, never launch something long before it’s even remotely ready to be used. I learned this lesson the hard way.
There’s a server binary provided, it seems to be .NET so let’s fire up ILSpy and see what it’s got in store.
We’ll start with this, this is how stored accounts are loaded:
Accounts are stored in the accounts.ini “database”, but the most important thing to note here is how the password is stored.
It’s stored in plain text, and then converted into the MD5 hash only during the auth process (highlighted in screenshot):
I don’t think it takes much thinking to realize how much of a flaw this is. If a leak of the production server’s accounts database ever occurs, that’s the entire userbase’s credentials exposed on the internet for anyone to see. If anyone reuses their password on other sites, which is more likely than you probably think, and they don’t change their passwords on every single site in time, then it’s game over.
Another thing to note is the error messages in the 911 error. MSNP never had error messages within the command like that, other than a few payload error commands (such as 511) added later on (which worked differently) and IIRC MSNP24 also switched to payload error commands in a similar vein as errors like 511.
No documentation that I’m aware of has ever said that that’s how error messages should be, nor do any other implementations that I know of, so really the only logical reason I can find for this occuring is an AI hallucination. Or incompetence on a level not seen since Dan Quayle.
Let’s move on to the TWN implementation, which
HandleTWNInital() sets c.Email from whatever the client sends, then hands off to CreateTWNChallenge() which just gives the Passport server parameters:
The actual token verification is handled in HandleTWNTicket():
So instead of checking for a login token/Passport Compact Token/whatever you wanna call it, it checks for LOCAL:user-email-here… which isn’t even close to accurate.
There is also no check beyond this other than the e-mail. There are 4 references to account.Password in the entire codebase:
The declerations at the beginning:
The LoadAccounts() function:
and the MD5 response function sent earlier in this post: `
Notice how there’s none for TWN? Or really any implementation of Passport SSI 1.4/Tweener at all?
This is a authentication bypass vulnerability. Anyone can take over any MSNP8-accessible account just by feeding the server USR <TrID> TWN S LOCAL:foobar@example.com, which will blindly reply USR <TrID> OK foobar@example.com without doing any checks beyond literally just the e-mail. You don’t even need to do a protocol version negotiation via VER, you can send these commands out of order or without ever sending VER and it works fine.
I don’t even… know how this happens, other than using a really crappy free LLM to generate this.
It’s super irresponsible to not only blindly vibe code and release a server that has not recieved extensive testing, is missing most major features, and has multiple glaring security issues, but to open an instance to the general public and putting their own data and credentials at high risk.
2 Likes
1)I have no idea whether if this is actually manually or vibe coded, gotta ask the dev myself since I am not the one behind this, I didn’t expected anyone to revive MSN Messenger for us anyway, it was just a mere pleasant surprise
2)I will tell the dev to consider this though if that will calm you down because judging by your tone I can sense some rage here (I could be wrong so don’t judge me, I am not trying to be toxic or rude here), well, let’s hope that this would be fixed soon
3)well, there are other projects coming soon so I hope that when they will be released, I would see a little bit more happiness and satisfaction from your side but that’s up to you of course.
When the issues are plaintext password storage and an authentication bypass straight out of the 90s that anyone and their dog could find with 5 minutes of reverse engineering (or even just simple Wireshark traffic sniffing), I believe she has a right to be angry about this, as does anyone using your services. I’ve been out of the game for a while, but this is genuinely on Phoenix-level territories of bad, if not worse.
These kinds of security practices speak directly to your knowledge and expertise as a team. This is not how one should respond to a report detailing critical security issues in your software, and you have a duty to your users to secure your systems and the users who have entrusted you with their data.
EDIT: Just for fun, I ran hot-garbage free model OpenCode Big Pickle on it with a hot-garbage prompt. It found the vulnerability in a record 15 seconds
2 Likes
I mean this can be fixed somehow but we will make sure that we won’t screw up THAT MUCH (we don’t want any issues, at this point I will have enough courage to also take some responsibility here as well), after reading @HIDEN’s post, I am now fully convinced that other services offered by us is far more secure compared to… this 
Best bet right now is just to announce such exploit existed in your Discord and fix it up ASAP. I seen that 3 members in your discord have signed up for such service(so if someone bad was to use this exploit they would have access to those 3 peoples accounts).
I will just tell them to shut down the service, delete the accounts and make sure that the service won’t be resumed until everything will be fixed, that should also do the trick, and if people will complain about it, I will just explain everything, easy and simple.
Well, made an announcement, Discord bot which allowed users to create accounts is offline along with the accounts as well. Again, I have no idea if the code was created manually or via AI since I have basically no access to the actual source code. Well, let’s hope that when it will be online again, it will be actually far more secure just like other services, If I knew that valuable info, then we would delay the release date until it would be actually secure.
Need I remind you that the dev behind this is the same person who previously made another security nightmare IM server where to use it you had to VPN DIRECTLY INTO HIS HOME NETWORK!?
From what I read of this thread aswell, the dude clearly doesn’t know what the hell he’s doing, and he’s clearly not learned from the last time, so he shouldn’t be fucking with this stuff!
I have a BBS fully set up and ready to launch, and while I feel i’ve set it all up right, one of the biggest reasons I haven’t launched it (apart from the fact I haven’t found a place to host it lol) is the fact that I’m still super worried that i’ve left a backdoor somewhere.
But this dude? Launching shit asap with major security fuck-ups?
Frankly, I have no sympathy for anyone who signs up to this when they get their credentials stolen. It’s on you.
1 Like
Again, before the public release I wasn’t even aware of his work, I have no access to the source code, i have already announced about the temporary shutdown. I will consider any useful advices, I have even marked HIDEN’s response as helpful because it was a hint that apparently running the service now is risky.
Now it looks like there is a small chance that some people would start throwing slurs and insults at me, I kinda got used to it even though it’s an actual kick in the balls in reality, well, apparently it’s true that everyone has haters, but I don’t have time to start yapping or whining about it anyway 
To really add insult to injury here, I have managed to actually implement this exploit and sign as another user without their password. It’s hard to show whats really going in a video but the password for test2 on this instance is test123 and what i entered was test4444. by injecting the PoC DLL, I am able to completely bypass the TWN ticket and spoof my way into the client as test2.
This PoC was entirely vibecoded using the Nemotron 3 Ultra model on opencode and the code is flimsy and requires occasional client restarts to login correctly.
gg tho: laura/slopconnected: "SecuroServ" TWN auth impersonation exploit PoC - SnowGit
EDIT: as a free bonus, the server for some reason sends you the entire list of every signed up via the LST command, including people you never added as a friend.
2 Likes
Well now some people are talking as if I was the one who made it and hosted it publicly, as expected 
I am already starting to regret taking the responsibility for someone else’s mess, never heard of that AI model though, now that because you leaked the entire source code without @BasicallyMachine’s consent, we might have to start doing the whole thing from scratch and obfuscate it this entire topic suddenly became bloated with plot twists, that’s weird indeed…
You didn’t even check what i uploaded, which is just the code for the PoC itself. I did not leak anyone else’s code, all of this is my own, which you would know because the repo contains C++, not C#. nice try though
2 Likes
Oh? I just saw a whole bunch of files and thought that it was the source code since I had never seen the actual source code myself.
I don’t think anyone ever said that. In fact, Woodland actually pointed back to one of BasicallyMachine’s prior attempts at an MSNP server.
Regardless of that repo just being the PoC and not the source code… It’s .NET. Reversing a .NET application is incredibly easy. It takes 15 seconds of work in ILSpy. (Also obfuscation/security through obscurity/just not publishing the binary wouldn’t have saved this anyways - this is a vulnerability that would’ve been easily recognized in a traffic capture through solely black-box analysis)
3 Likes
everlong is crazy
1 Like
No one said that directly for sure, I just felt so uncomfortable that I felt as if people implied that it was 100% my fault and no one else’s​
(yep, sometimes feelings can obviously do some weird crap to you )