Feeds

Script wreaks havoc on MySpace

Rains down spam, opens door to users' accounts

Using blade systems to cut costs and sharpen efficiencies

The Stalkertrack service has yet to launch and likely will not reveal email addresses and other sensitive information once it does, said Holly, who is listed as the owner of a site related to Stalkertrack. For now, the site is using the client sign ups to virally get the word out to MySpace friends. It will begin offering the tracking service within the next few months, said Holly, who added he was 17 years old. The Stalkertrack domain name was created on Jan. 1.

The site has convinced about 10,000 MySpace users to turn over their login details, according to a second person affiliated with the business, who wouldn't give his name. (Holly said the number was 100,000 to 300,000, a figure that struck us as unrealistically high.) A bot uses the information to access the account and sends a spam to each user friend. This second person said the site quickly dumps the account password and doesn't sell the email addresses or use them for spamming purposes.

Stalkertrack is by no means the only outfit offering the tracking of visitors to MySpace user pages. Indeed, eBay auctions purport to sell similar scripts. And a host of sites offered similar services as long ago as last May, according to Security Fix.

The sheer number of MySpace accounts displaying Stalkertrack's service demonstrates the power of viral marketing. It also is a wake-up call about the potential dangers that lurk underneath.

While there's no evidence suggesting Stalkertrack has done anything other than send millions of messages advertising the future service, Jorberg points out recommendations from trusted friends could easily convince users to download and install malicious payloads.

MySpace has not weighed in on whether it believes the service, and the thousands of users who surrendered their passwords, have violated MySpace terms of service. By our reading, however, Stalkertrack has run amok of several conditions, including the sending of junk email, the soliciting of passwords for commercial use and using the account, user name or password of another member. Those users who signed up for the service may also have violated terms barring the disclosure of passwords to third parties.

The second person operating Stalkertrack said he got an email inquiry from MySpace officials but no action was taken against the service. He also said he doesn't believe MySpace terms ban his solicitation of passwords, noting that Google Video does the same thing when MySpace users want to embed content on their profile.

MySpace is perhaps the site that best exemplifies the power of Web 2.0. At its current course, it may soon be the poster child for Spam 2.0. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.