YMSG
Encyclopedia
The Yahoo! Messenger Protocol is the underlying network protocol used by the Yahoo! Messenger
instant messaging
client, for Yahoo!
. Yahoo! Instant Messager supports many features beyond just messaging, including off-line messaging, file transfer, chat, conferencing, voice chat, webcam
s and avatar
s.
. Unlike HTTP, however, YMSG is a proprietary standard, aligned only with a single messaging service provider (namely, Yahoo!). Rival messaging services have their own protocols, some based on open standards, others proprietary, each effectively fulfilling the same role with different mechanics.
One of the fundamental tenets of instant messaging is the notion that users can see when someone is connected to the network — known in the jargon as 'presence'. Yahoo!'s protocol uses the mechanics of a standard internet connection to achieve presence, the same connection it uses to send and receive data. In order for each user to remain 'visible' to other users on the service, signaling their availability, their Yahoo! IM client software must maintain a functional, open, network connection linking the client to Yahoo!'s IM servers.
As some organizations block communication on the port
used by Yahoo! IM, either because they choose to whitelist certain types of internet usage (only web surfing and email, for example) or because they seek to blacklist
instant messaging services, Yahoo! provides an alternative route for connecting to their service which mimics the HTTP protocol used by the World Wide Web. Unfortunately, as HTTP has no inherent sense of a persistent connection, Yahoo! instead relies on the client frequently contacting the server in order to approximate the sense of a connection required to give each user presence on the IM network.
Originally the YMSG login procedure suffered from a security flaw known as a replay attack
, in which a given password (or other authentication information) is always identically scrambled when sent across the network. This allows any attacker who witnesses the transmission to merely reproduce the message verbatim in order to successfully log in, without actually needing to know the original password (or other details) which generated it. But some time around 2000 or 2001 Yahoo! upgraded its service to introduce a random element to each login attempt, defeating any further potential for replay attacks.
With the exception of the login authentication details, data sent over a YMSG connection is not encrypted. YMSG uses a binary format in which the text portions of the data are transmitted in plain view. Therefore, while it is difficult for an attacker to seize control of a Yahoo! IM account, it is quite easy for them to read all messages sent to and from the account holder, along with other details such as the list of friends, if the attacker has control of one of the computers through which the data is routed.
The client remains logged in for as long as the TCP/IP connection is kept open. Or, in the case of a client connected via HTTP, until the client fails to send a request for some time ('ping
' messages are sent every thirty seconds or so).
Messages consist of a twenty byte header, followed by a variable length table of key/value pairs, where the key is an ASCII
representation of a numeric code representing the field type, and the value is its associated data. A two byte separator, the hexadecimal
values c0 80, are used to delimit each entry in this table.
Some parts of YMSG rely on other protocols. For example, file transfer is initially negotiated using YMSG, but the actual transfer of the file is done via HTTP. Webcam
s too use YMSG to discover and request permission to view a webcam
, but HTTP to actually feed JPEG 2000
images from one client to another. Chatroom categories, rooms and lobbies are retrieved using HTTP as XML
documents. Regular webcam
connections use H.323
. Yahoo! with voice uses SIP
. For calls, VoIP is handled indirectly by Yahoo! servers so the chat client doesn't have direct access to it.
The chatroom categories can be retrieved from here.
, along with the account's password
, to produce two response values looking like variable assignments which are sent to the server. If these values match the server's expectations, the client is admitted and sent data associated with that account (such as buddy/friends lists).
Although the seed value looks like an equation, it is in reality little more than a series of instructions in which the operand
s control lookups into a series of in-built tables, and the operators
determine which logic operation to perform. SHA1 is also used to create two message digest data arrays, which are then encoded using a table to resemble software variable assignment
s.
Yahoo! Messenger
Yahoo! Messenger is an advertisement-supported instant messaging client and associated protocol provided by Yahoo!...
instant messaging
Instant messaging
Instant Messaging is a form of real-time direct text-based chatting communication in push mode between two or more people using personal computers or other devices, along with shared clients. The user's text is conveyed over a network, such as the Internet...
client, for Yahoo!
Yahoo!
Yahoo! Inc. is an American multinational internet corporation headquartered in Sunnyvale, California, United States. The company is perhaps best known for its web portal, search engine , Yahoo! Directory, Yahoo! Mail, Yahoo! News, Yahoo! Groups, Yahoo! Answers, advertising, online mapping ,...
. Yahoo! Instant Messager supports many features beyond just messaging, including off-line messaging, file transfer, chat, conferencing, voice chat, webcam
Webcam
A webcam is a video camera that feeds its images in real time to a computer or computer network, often via USB, ethernet, or Wi-Fi.Their most popular use is the establishment of video links, permitting computers to act as videophones or videoconference stations. This common use as a video camera...
s and avatar
Avatar (computing)
In computing, an avatar is the graphical representation of the user or the user's alter ego or character. It may take either a three-dimensional form, as in games or virtual worlds, or a two-dimensional form as an icon in Internet forums and other online communities. It can also refer to a text...
s.
Overview
The purpose of the YMSG protocol is to provide a language and series of conventions for software communicating with Yahoo!'s Instant Messaging service. In essence YMSG performs the same role for IM as HTTP does for the World Wide WebWorld Wide Web
The World Wide Web is a system of interlinked hypertext documents accessed via the Internet...
. Unlike HTTP, however, YMSG is a proprietary standard, aligned only with a single messaging service provider (namely, Yahoo!). Rival messaging services have their own protocols, some based on open standards, others proprietary, each effectively fulfilling the same role with different mechanics.
One of the fundamental tenets of instant messaging is the notion that users can see when someone is connected to the network — known in the jargon as 'presence'. Yahoo!'s protocol uses the mechanics of a standard internet connection to achieve presence, the same connection it uses to send and receive data. In order for each user to remain 'visible' to other users on the service, signaling their availability, their Yahoo! IM client software must maintain a functional, open, network connection linking the client to Yahoo!'s IM servers.
As some organizations block communication on the port
Computer port (software)
In computer programming, port has a wide range of meanings.A software port is a virtual/logical data connection that can be used by programs to exchange data directly, instead of going through a file or other temporary storage location...
used by Yahoo! IM, either because they choose to whitelist certain types of internet usage (only web surfing and email, for example) or because they seek to blacklist
Blacklist
A blacklist is a list or register of entities who, for one reason or another, are being denied a particular privilege, service, mobility, access or recognition. As a verb, to blacklist can mean to deny someone work in a particular field, or to ostracize a person from a certain social circle...
instant messaging services, Yahoo! provides an alternative route for connecting to their service which mimics the HTTP protocol used by the World Wide Web. Unfortunately, as HTTP has no inherent sense of a persistent connection, Yahoo! instead relies on the client frequently contacting the server in order to approximate the sense of a connection required to give each user presence on the IM network.
Originally the YMSG login procedure suffered from a security flaw known as a replay attack
Replay attack
A replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet...
, in which a given password (or other authentication information) is always identically scrambled when sent across the network. This allows any attacker who witnesses the transmission to merely reproduce the message verbatim in order to successfully log in, without actually needing to know the original password (or other details) which generated it. But some time around 2000 or 2001 Yahoo! upgraded its service to introduce a random element to each login attempt, defeating any further potential for replay attacks.
With the exception of the login authentication details, data sent over a YMSG connection is not encrypted. YMSG uses a binary format in which the text portions of the data are transmitted in plain view. Therefore, while it is difficult for an attacker to seize control of a Yahoo! IM account, it is quite easy for them to read all messages sent to and from the account holder, along with other details such as the list of friends, if the attacker has control of one of the computers through which the data is routed.
Technical overview
The YMSG protocol communicates between the client application, and a server, using a TCP/IP connection on port 5050 by default. Other ports may be used if this port is blocked. Alternatively, an HTTP route is also available for clients behind a well secured firewall, with HTTP requests being used to upload messages from the client, while downloading all messages which have accumulated on the server since the last request.The client remains logged in for as long as the TCP/IP connection is kept open. Or, in the case of a client connected via HTTP, until the client fails to send a request for some time ('ping
Ping
Ping is a computer network administration utility used to test the reachability of a host on an Internet Protocol network and to measure the round-trip time for messages sent from the originating host to a destination computer...
' messages are sent every thirty seconds or so).
Messages consist of a twenty byte header, followed by a variable length table of key/value pairs, where the key is an ASCII
ASCII
The American Standard Code for Information Interchange is a character-encoding scheme based on the ordering of the English alphabet. ASCII codes represent text in computers, communications equipment, and other devices that use text...
representation of a numeric code representing the field type, and the value is its associated data. A two byte separator, the hexadecimal
Hexadecimal
In mathematics and computer science, hexadecimal is a positional numeral system with a radix, or base, of 16. It uses sixteen distinct symbols, most often the symbols 0–9 to represent values zero to nine, and A, B, C, D, E, F to represent values ten to fifteen...
values c0 80, are used to delimit each entry in this table.
Some parts of YMSG rely on other protocols. For example, file transfer is initially negotiated using YMSG, but the actual transfer of the file is done via HTTP. Webcam
Webcam
A webcam is a video camera that feeds its images in real time to a computer or computer network, often via USB, ethernet, or Wi-Fi.Their most popular use is the establishment of video links, permitting computers to act as videophones or videoconference stations. This common use as a video camera...
s too use YMSG to discover and request permission to view a webcam
Webcam
A webcam is a video camera that feeds its images in real time to a computer or computer network, often via USB, ethernet, or Wi-Fi.Their most popular use is the establishment of video links, permitting computers to act as videophones or videoconference stations. This common use as a video camera...
, but HTTP to actually feed JPEG 2000
JPEG 2000
JPEG 2000 is an image compression standard and coding system. It was created by the Joint Photographic Experts Group committee in 2000 with the intention of superseding their original discrete cosine transform-based JPEG standard with a newly designed, wavelet-based method...
images from one client to another. Chatroom categories, rooms and lobbies are retrieved using HTTP as XML
XML
Extensible Markup Language is a set of rules for encoding documents in machine-readable form. It is defined in the XML 1.0 Specification produced by the W3C, and several other related specifications, all gratis open standards....
documents. Regular webcam
Webcam
A webcam is a video camera that feeds its images in real time to a computer or computer network, often via USB, ethernet, or Wi-Fi.Their most popular use is the establishment of video links, permitting computers to act as videophones or videoconference stations. This common use as a video camera...
connections use H.323
H.323
H.323 is a recommendation from the ITU Telecommunication Standardization Sector that defines the protocols to provide audio-visual communication sessions on any packet network...
. Yahoo! with voice uses SIP
Session Initiation Protocol
The Session Initiation Protocol is an IETF-defined signaling protocol widely used for controlling communication sessions such as voice and video calls over Internet Protocol . The protocol can be used for creating, modifying and terminating two-party or multiparty sessions...
. For calls, VoIP is handled indirectly by Yahoo! servers so the chat client doesn't have direct access to it.
The chatroom categories can be retrieved from here.
Login
The login process for YMSG is quite complex. First the client introduces itself with a message containing its username. The server responds with a rather long seed value. resembling superficially the form of a mathematical equation (perhaps as a means to mask its true usage). The client feeds this into a rather involved algorithmAlgorithm
In mathematics and computer science, an algorithm is an effective method expressed as a finite list of well-defined instructions for calculating a function. Algorithms are used for calculation, data processing, and automated reasoning...
, along with the account's password
Password
A password is a secret word or string of characters that is used for authentication, to prove identity or gain access to a resource . The password should be kept secret from those not allowed access....
, to produce two response values looking like variable assignments which are sent to the server. If these values match the server's expectations, the client is admitted and sent data associated with that account (such as buddy/friends lists).
Although the seed value looks like an equation, it is in reality little more than a series of instructions in which the operand
Operand
In mathematics, an operand is the object of a mathematical operation, a quantity on which an operation is performed.-Example :The following arithmetic expression shows an example of operators and operands:3 + 6 = 9\;...
s control lookups into a series of in-built tables, and the operators
Operator (programming)
Programming languages typically support a set of operators: operations which differ from the language's functions in calling syntax and/or argument passing mode. Common examples that differ by syntax are mathematical arithmetic operations, e.g...
determine which logic operation to perform. SHA1 is also used to create two message digest data arrays, which are then encoded using a table to resemble software variable assignment
Assignment (computer science)
In computer programming, an assignment statement sets or re-sets the value stored in the storage location denoted by a variable name. In most imperative computer programming languages, assignment statements are one of the basic statements...
s.
See also
- Comparison of instant messaging clientsComparison of instant messaging clientsThe following tables compare general and technical information for a number of instant messaging clients. Please see the individual products' articles for further information. This article is not all-inclusive or necessarily up-to-date...
- Comparison of instant messaging protocols
External links
- OpenYMSG Java API - Yahoo! Instant Messenger Support for Java (rewrite of a YMSG project)
- YMSG Java API - Yahoo! Instant Messenger Support for Java
- Hamsam - Multi-protocol instant messaging API for Java
- libyahoo2 - A C library for Yahoo! Messenger
- Net::YMSG - Perl Interface to the Yahoo! Messenger IM protocol
- Yahoo Messenger Protocol
- Yahoo! Coders Cookbook
- GenY - A Chat Client for Yahoo!
- Official Yahoo Messenger SDK for PHP
- Official Yahoo Messenger SDK for Java ME. A Java SE fork is available. However both variants do not work with latest Yahoo Messenger API.
- YMSG Implemented on Flex/AS3