Slashdot Mirror
MySpace Accounts Compromised By Phishers
An anonymous reader writes, "Netcraft has discovered that the social networking site MySpace appears to have been compromised by phishers who have presented a spoof login form on the main site. This modified login form submits the victim's username and password to a remote server hosted in France." From the article: "The hackers have engineered a fake login form on MySpace's own web site. Netcraft has notified MySpace of the issue, although it currently remains live. Because the fraudulent login page is hosted on MySpace's own servers and does not exhibit any signs of external content, such as cross-site scripting or open redirects, it is convincing and even security-conscious users are at risk of becoming victims. The attack is launched from a profile page, where the username is login_home_index_html, and uses specially-crafted HTML in order to hide the genuine MySpace content from the page and instead display its own login form." This Washington Post story from a few months back explains what's in it for the phishers.
No shit I just slapped myself after doing just that ... MOD ME DOWN and burn me at the stake!
-- Brought to you by Carl's JR
"Despite public perception, most MySpace users are over 35, according to a release today [05 Oct 2006] by ComScore. The stat-tracking company says that as MySpace continues to grow, its user base is skewing older - teens accounted for around 25% of users in August 2005, but now only represent 12% of the audience. Almost 41% of MySpacers are aged 35 to 54 - a big increase since last year."
0 19
http://www.comscore.com/press/release.asp?press=1
FTA:
The attack is launched from a profile page, where the username is login_home_index_html, and uses specially-crafted HTML in order to hide the genuine MySpace content from the page and instead display its own login form.
Netcraft says this is still live on Myspace's main page. I've looked at the HTML source for both the main page, and that special login page you get when you try to access a portion of the site that requires you to log in. On both pages, I located the form element which controls the login. The method is POST, and the action redirects to a script under the "login.myspace.com" domain.
So the summary and the article itself is slightly misleading (at first) by implying (perhaps unintentionally) that the phishing attempt is coming directly from Myspace's main page.
This slashdot-related signature is a stub. You can help kihjin by expanding it.