Feeds

Script wreaks havoc on MySpace

Rains down spam, opens door to users' accounts

Secure remote control for conventional and virtual desktops

The Stalkertrack service has yet to launch and likely will not reveal email addresses and other sensitive information once it does, said Holly, who is listed as the owner of a site related to Stalkertrack. For now, the site is using the client sign ups to virally get the word out to MySpace friends. It will begin offering the tracking service within the next few months, said Holly, who added he was 17 years old. The Stalkertrack domain name was created on Jan. 1.

The site has convinced about 10,000 MySpace users to turn over their login details, according to a second person affiliated with the business, who wouldn't give his name. (Holly said the number was 100,000 to 300,000, a figure that struck us as unrealistically high.) A bot uses the information to access the account and sends a spam to each user friend. This second person said the site quickly dumps the account password and doesn't sell the email addresses or use them for spamming purposes.

Stalkertrack is by no means the only outfit offering the tracking of visitors to MySpace user pages. Indeed, eBay auctions purport to sell similar scripts. And a host of sites offered similar services as long ago as last May, according to Security Fix.

The sheer number of MySpace accounts displaying Stalkertrack's service demonstrates the power of viral marketing. It also is a wake-up call about the potential dangers that lurk underneath.

While there's no evidence suggesting Stalkertrack has done anything other than send millions of messages advertising the future service, Jorberg points out recommendations from trusted friends could easily convince users to download and install malicious payloads.

MySpace has not weighed in on whether it believes the service, and the thousands of users who surrendered their passwords, have violated MySpace terms of service. By our reading, however, Stalkertrack has run amok of several conditions, including the sending of junk email, the soliciting of passwords for commercial use and using the account, user name or password of another member. Those users who signed up for the service may also have violated terms barring the disclosure of passwords to third parties.

The second person operating Stalkertrack said he got an email inquiry from MySpace officials but no action was taken against the service. He also said he doesn't believe MySpace terms ban his solicitation of passwords, noting that Google Video does the same thing when MySpace users want to embed content on their profile.

MySpace is perhaps the site that best exemplifies the power of Web 2.0. At its current course, it may soon be the poster child for Spam 2.0. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
How to simplify SSL certificate management
Simple steps to take control of SSL certificates across the enterprise, and recommendations centralizing certificate management throughout their lifecycle.