Feeds

Script wreaks havoc on MySpace

Rains down spam, opens door to users' accounts

5 things you didn’t know about cloud backup

A handful of enterprising people - at least one of them a teen - has devised a Javascript that allows its owner to temporarily access the browser's MySpace account, according to a security professional who was among the first to publicly write about the service.

These people also may have managed to spam about 1.5 million MySpace accounts, according to a Google Search. They pulled off the latter feat in less than three weeks by collecting thousands of passwords, according to one of the operators, in a venture that would appear to violate numerous terms governing the use of the social network.

Spam on MySpace appears to be reaching epidemic levels. Another barrage of junk messages appears to have affected 145,000 MySpace accounts, according to a separate Google search. ("I need you to do this for me, i want to get a free iPhone so i have to get 50 of my friends to go to the thing below and have them put their zipcode in," it reads. "If you could do that it'd be sooo awesome. THANks!!")

Stalkertrack.com advertises a free and upcoming service that tracks the people who visit a client's MySpace profile. Users are required to divulge their MySpace login credentials, and until we interviewed one of the site owners, terms of service permitted Stalkertrack to log in to MySpace users' account and send each friend spam messages promoting the site, according to this Google cache. (Those terms were removed in the last 24 hours.)

MyScare

An analysis on Monday of the Javascript used in this demo showed the kind of data Stalkertrack is able to collect, according to Eric Sites, VP of research at Sunbelt Software. It included the IP address, user name, profile picture, browser type, screen resolution, and in many cases email address of every MySpace user who visited a client's profile.

MySpace has been under fire for an onslaught of worms, pedophile come-ons and phishing attacks over the past few months. While its 90 million-strong user base makes it a favorite target for many miscreants, a host of decisions about the site's technical underpinnings make their job easier.

For instance, MySpace cookies, which Stalkertrack uses to extract visitor information, stores a wealth of data in the clear, including email addresses and other MySpace accounts accessed on the same PC. Add to that the ease of embedding powerful Javascript into pages, and you have a recipe for potential privacy breaches.

What's more, MySpace hosts authentication cookies and user-maintained pages on the same domain, making it harder to prevent cross-site-scripts like the one used by Stalkertrack, says Randolf Jorberg, the quick-spotting security professional.

Josh Holly, who helped devise the Javascript, was able to gain temporarily access to the section of Jorberg's MySpace account that edits his profile, he said. The script pulled out the verification code stored in a cookie sitting on Jorberg's hard drive. Armed with the session ID a person can make changes to the account - except for changing the email address or password - for up to six hours.

We repeatedly called and emailed MySpace representatives to ask if they were aware of Stalkertrack. We got no response. [Social? Networking? Hardly - Ed.]

Secure remote control for conventional and virtual desktops

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.