Feeds

Script wreaks havoc on MySpace

Rains down spam, opens door to users' accounts

The Power of One eBook: Top reasons to choose HP BladeSystem

A handful of enterprising people - at least one of them a teen - has devised a Javascript that allows its owner to temporarily access the browser's MySpace account, according to a security professional who was among the first to publicly write about the service.

These people also may have managed to spam about 1.5 million MySpace accounts, according to a Google Search. They pulled off the latter feat in less than three weeks by collecting thousands of passwords, according to one of the operators, in a venture that would appear to violate numerous terms governing the use of the social network.

Spam on MySpace appears to be reaching epidemic levels. Another barrage of junk messages appears to have affected 145,000 MySpace accounts, according to a separate Google search. ("I need you to do this for me, i want to get a free iPhone so i have to get 50 of my friends to go to the thing below and have them put their zipcode in," it reads. "If you could do that it'd be sooo awesome. THANks!!")

Stalkertrack.com advertises a free and upcoming service that tracks the people who visit a client's MySpace profile. Users are required to divulge their MySpace login credentials, and until we interviewed one of the site owners, terms of service permitted Stalkertrack to log in to MySpace users' account and send each friend spam messages promoting the site, according to this Google cache. (Those terms were removed in the last 24 hours.)

MyScare

An analysis on Monday of the Javascript used in this demo showed the kind of data Stalkertrack is able to collect, according to Eric Sites, VP of research at Sunbelt Software. It included the IP address, user name, profile picture, browser type, screen resolution, and in many cases email address of every MySpace user who visited a client's profile.

MySpace has been under fire for an onslaught of worms, pedophile come-ons and phishing attacks over the past few months. While its 90 million-strong user base makes it a favorite target for many miscreants, a host of decisions about the site's technical underpinnings make their job easier.

For instance, MySpace cookies, which Stalkertrack uses to extract visitor information, stores a wealth of data in the clear, including email addresses and other MySpace accounts accessed on the same PC. Add to that the ease of embedding powerful Javascript into pages, and you have a recipe for potential privacy breaches.

What's more, MySpace hosts authentication cookies and user-maintained pages on the same domain, making it harder to prevent cross-site-scripts like the one used by Stalkertrack, says Randolf Jorberg, the quick-spotting security professional.

Josh Holly, who helped devise the Javascript, was able to gain temporarily access to the section of Jorberg's MySpace account that edits his profile, he said. The script pulled out the verification code stored in a cookie sitting on Jorberg's hard drive. Armed with the session ID a person can make changes to the account - except for changing the email address or password - for up to six hours.

We repeatedly called and emailed MySpace representatives to ask if they were aware of Stalkertrack. We got no response. [Social? Networking? Hardly - Ed.]

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.