ScatterChat was discontinued long ago. Nobody maintains it, and it is not safe to rely on today. It was a 2006 chat client from the Hacktivismo group that tried to combine encrypted instant messaging with Tor routing to hide who was talking to whom. If you need that kind of protection in November 2026, use maintained tools that have been audited by outside firms: Signal for encrypted messaging, Tor Browser (version 16.0, released October 29, 2026) for anonymous browsing, or SimpleX Chat if you want a messenger that does not ask for a phone number.
The original advisory (September 2, 2006)
ScatterChat Advisory 2006-02: Win32 Tor Client Routing and Denial of Service Vulnerabilities
Non-technical report
Dated September 2, 2006
This advisory reported two minor security flaws in Tor, the program that powered ScatterChat’s optional anonymity feature. They were low-impact issues, and the advisory said they affected only the Windows version of ScatterChat.
What the vulnerabilities did
The flaws let a malicious Tor server misuse a ScatterChat user’s connection. They could not reveal message contents. When the anonymity feature was turned on, two things could go wrong under rare conditions:
- ScatterChat could stop working. An attacker could make the Tor component crash, which cut off the anonymity feature.
- Your Internet connection could slow down. An attacker could push unwanted traffic through your computer, using up bandwidth for as long as ScatterChat was running.
Where the flaws came from
The flaws were in Tor itself, not in ScatterChat’s own code. In late August 2006, Tor co-founder Roger Dingledine published a Tor Project advisory titled “clients will route traffic.” It explained that a malicious entry node (the first Tor server in a user’s path) could route traffic through a Tor client as if that client were a relay. That traffic could only go on to other Tor servers, not out to the open Internet.
The flaw was assigned CVE-2006-4508. The CVE entry covers both products:
| Affected product | Vulnerable versions | Fixed in |
|---|---|---|
| Tor 0.1.0.x series | Before 0.1.0.18 | 0.1.0.18 |
| Tor 0.1.1.x series | Before 0.1.1.23 | 0.1.1.23 |
| Tor experimental snapshot | 0.1.2.1-alpha-cvs | Later 0.1.2 builds |
| ScatterChat (Windows) | Before 1.0.2 | 1.0.2 |
At the time, the advisory service Secunia rated the ScatterChat issue “less critical.” The Tor Project’s notice was not limited to Windows. It applied to every Tor client in the affected version ranges, on any operating system.
The fix at the time
In 2006, the developers advised every Windows user of ScatterChat’s anonymity feature to upgrade to ScatterChat 1.0.2. That version included the patched Tor code.
That advice is history now. Version 1.0.2 and every other ScatterChat release still run Tor code from 2006, which is close to two decades out of date. Do not install any old ScatterChat build, even from an archive site. Today’s Tor network expects current clients: the 0.4.9 series has been Tor’s stable line since February 2026.
Announcements and the technical report
The project used to post new versions and security advisories to an announcement mailing list. That list belonged to the original project and is long inactive:
<http://www.scatterchat.com/mailinglists.html>
The developers also published a more technical version of this report:
<http://www.scatterchat.com/advisories/2006-02_tech.html>
What ScatterChat was
ScatterChat was a “friendly fork” of Gaim, the chat client renamed Pidgin in 2007. Developer J. Salvatore Testa II wrote it for Hacktivismo, an international group of hackers, human rights workers, lawyers and security researchers. It was released at the HOPE Number Six conference in New York City on July 22, 2006. It added encrypted chat, key management, encrypted file transfer, forward secrecy, and optional Tor routing to resist traffic analysis. The code was published under the Hacktivismo Enhanced-Source Software License Agreement (HESSLA).
People criticised it from the start. On LWN, Nmap author Fyodor pointed out that Off-the-Record Messaging (OTR) already worked as a Gaim plugin without forking the codebase, and that OTR’s cryptography had been checked far more carefully than the brand-new ScatterChat. Others noted that Gaim could already be sent through Tor as a proxy.
What to use today for the same need
ScatterChat tried to do two jobs: keep messages private, and hide who is talking to whom. Today, separate maintained tools handle each job better than any 2006 client could.
| Tool | What it protects | Phone number needed | Independent review | Cost |
|---|---|---|---|---|
| Signal | End-to-end encrypted messages and calls | Yes, to register | Signal Protocol widely studied by academic cryptographers | Free |
| SimpleX Chat | End-to-end encrypted messages, no user IDs | No | Trail of Bits audit (October 2022) and protocol design review (October 2024) | Free |
| Tor Browser | Hides your IP address from sites you visit | No | Cure53 audit (2022 to 2023) and Radically Open Security audit (2023) | Free |
Signal
For most people, Signal is the default choice for private conversations. Messages and calls are end-to-end encrypted by default. The EFF’s Surveillance Self-Defense project has step-by-step guides for using Signal and managing Signal groups.
Tor and Tor Browser
Tor Browser 16.0 runs on Firefox ESR 153 and adds a redesigned settings screen on desktop. In Cure53’s 2023 audit of Tor Browser, the testers found two high-severity issues and one moderate issue, and all three were fixed. The Radically Open Security audit, which ran from April to August 2023, reported 17 issues across Tor’s apps and infrastructure.
Limits to keep in mind
No tool makes you fully anonymous. Tor hides your IP address from the sites you visit, but it cannot protect you if you log in with your real name or if your device is already compromised. Signal encrypts what you say. Your phone number and your contact list still matter, and anyone who unlocks your phone can read your chats.
FAQ
Is ScatterChat still safe to use?
No. ScatterChat stopped being developed in the 2000s, and its last releases include Tor code from 2006. Old versions get no security fixes and may not work with today’s Tor network. Use Signal, SimpleX Chat or Tor Browser instead.
Did CVE-2006-4508 expose message contents?
No. The flaw let a malicious Tor entry node route traffic through a user’s client or flood it, which could slow the connection or crash Tor. Neither the Tor Project nor ScatterChat described it as a way to read encrypted messages. Both rated it low to moderate impact.
Why did the advisory affect only Windows users?
The advisory was about the Tor client used by the Windows version of ScatterChat, which is why “Win32” is in the title. The underlying Tor flaw was not specific to Windows. Any Tor client in the affected ranges on any system needed upgrading to 0.1.0.18 or 0.1.1.23.
Who made ScatterChat?
J. Salvatore Testa II wrote it for Hacktivismo, a group linked to the Cult of the Dead Cow hacker collective. It launched at HOPE Number Six in New York City in July 2006. The same group also released Torpark, a portable Firefox build with Tor built in.
What replaced encrypted chat clients like ScatterChat?
Pidgin, the renamed Gaim, used the OTR plugin for years. Most people now use Signal, which encrypts messages and calls end to end by default. If you don’t want to give out a phone number, SimpleX Chat is a maintained, audited option. For network-level anonymity, use Tor Browser.
Does using Tor make a chat app anonymous?
Not on its own. Tor hides your IP address from the service, but it does nothing about the account details, contacts or writing habits that can identify you. Think of Tor as one layer among several, not a guarantee.
Sources
- Tor security advisory: clients will route traffic (Tor Project, August 2006)
- Tor 0.1.1.23 is released (Tor Project)
- CVE-2006-4508 (NIST National Vulnerability Database)
- ScatterChat Advisory 2006-02 (Full Disclosure archive)
- Hacktivismo (Wikipedia)
- ScatterChat discussion (LWN.net)
- New Release: Tor Browser 16.0 (Tor Project blog)
- Code audit completed by Radically Open Security (Tor Project forum)
- Tor Browser passes security audit by Cure53 (AlternativeTo)
- Surveillance Self-Defense tool guides (EFF)