MSN Messenger 7 Beta News - no winks, no sign-in




Following on from our security alert this week MSN have not only delayed the release of an external beta but they're planning to remove crucial new features temporarily. According to sources close to MSN, MSN Messenger 7 beta will ship without 'winks' and deluxe display pictures. Currently it's easy for hackers to exploit the code of winks to display any flash movies on a users computer for any amount of time.

MSN took the decision following the public announcements of the exploits. We're unsure whether 'winks' are going to be axed from MSN Messenger 7 or whether MSN are merely revamping them to be included in later betas.

In other news, The Messenger team will be implementing a CVR update that will force all existing MSN Messenger V7.0 users to downgrade to V6.2. This CVR is scheduled to start on 6 Oct 2004. Anyone running MSN Messenger V7.0 build 0205 will need to downgrade. If you do not downgrade, you will be unable to sign into the Messenger service. We're unsure whether this will effect other builds.

neowin report about MSN Messenger 7 Beta's exploit before:

As MSN Messenger 7 goes into private beta, Neowin has learned of several exploits resulting in the "winks" feature of MSN Messenger 7. A Neowin member wishing to remain anonymous has alerted us that users can generate their own flash movies and send them across MSN Messenger. As flash movies can open other things on the system such as Internet Explorer, this could be fatal. As MSN Messenger 7 is only beta and isn't available publically this isn't a major exploit but it does show that added features to a product like this makes it less secure and more open to attack/exploit.

MSN Messenger 7 is beta and is available in copies floating around the internet. We strongly advise members not to use the current beta until this flaw has been resolved. MSN Messenger 7 effectively opens your system up to allow a hacker to run numerous tasks on your machine