Slashdot Mirror
Hackers Target MySpace and Facebook
Stony Stevenson writes "The security firm Fortify Software has warned against a series of attacks against Facebook and MySpace. Buffer overflows that enabled hackers to exploit the Aurigma ActiveX image uploading software used by social networking sites were at the heart of the assault. 'Criminal hackers now view social networking sites as their best target for attacks ... [partially because] such sites are designed to be usable by "unsophisticated" consumers, meaning that the barrier to entry for attacks is potentially lower as users are more likely to click on a link that leads to malware.'"
to see tons of goatse images from stupid hackers thinking they are funny and cool.
I assume this is an internet explorer based exploit? http://www.kb.cert.org/vuls/id/776931
(received as a comment on my page this morning)
We figured out a long time ago that it's easier to elect seven judges than to elect 132 legislators.
Cable, telco and banks and apparel vendors all have young people in their sites. Predatory lending credit cards, special internet "deals" with students and massive advertising budgets that should make the companies involved blush, are aimed at people ages 14 to 25.
Why? because that's where the money is.
Why do the theives use ActiveX exploits? Because they can.
Sheep, meet Mr. Slaughter. Mr. Slaughter .... gross!
Oh man, a slashbot troll's dream -- do I start ranting about myspace and their userbase or do I start ranting about activex?
And with the way that people spew out personal information on Facebook and MySpace, they probably figure that if they get it just right, there's the potential to hit the motherload of information for identity theft.
Seriously though, who here actually granted MySpace or Facebook access to your email account in order to find your "friends"? Anything else (the social website has access to) is butter in the frosting
It really amazes me just how much personal information people are willing to put on the internet these days. Even if said information is not explicitly granted to a particular website, a great deal can be inferred by people's, for lack of a better term, "blogging" habits.
I, for one, am looking forward to the inevitable
Hackers? I remember hacky sacks from when I was a kid! Are these the same thing? *clicks link to find out*
... dumb people shouldn't have the internets?
If you mod me down, I will become more powerful than you can imagine....
Do your friends and family a favor: educate them on the inherent risks present in the software applications they use on a daily basis. Computer security starts with the user acting in a responsible manner to secure his/her system. If securing the system proves too difficult or time-consuming, maybe it's time to try a different system.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
Does this guy really think people aren't smart enough to hover over links before clicking them...here on /.?
we're not exactly talking about the most sophisticated users on these sites. Why wouldn't they prey on the obviously easy targets.
When people ask if I'm an optimist, I say "I hope so". --Bill Bailey
... Facebook et al has unsophisticated users?
... ActiveX is an insecure technology?
I'm shocked I tell you!!!
Seriously though, doesn't this happen every day? Why is this more newsworthy than the the usual background level of social network hacking attempts and ActiveX suckiness?
Water is wet and the sky is blue.
Honestly, who is this "news" to/for?
the 90's are the equivalent of most facebook etc users today. Unsophisticated is being kind, it's a gullibility farm.
one is responsible for ones choices/actions, and if you've tried to help them but they choose to be ignorant or dismiss these problems it is THEIR OWN FAULT. Eventually they will either learn from the lessons of being pwned or they will suffer.
See my art -> http://herbevore.deviantart.com
Facebook reacted quickly when the news broke. I'm not sure why this is a story now.
http://secwatch.org/advisories/1020254/
steveha
lf(1): it's like ls(1) but sorts filenames by extension, tersely
This was just up like 3 days ago.
-ellie
May I mention that hacking Facebook takes no real effort? Simply manipulating a browser's client side input forms (using Firebug, maybe) allows one to post to any Superwall (Faceboo application) whether you are the person's friend or not. Anonymous attakers could put links posing as coming from people's friends on the people's Superwalls. Reasoning: If it comes from my friend, it must be good and safe. The click-rate becomes much higher, and an attacker has just used a form of social engineering to lead people to a malware site. Most applications are not built with security in mind. They just (fatally) assume that the end user would never do such a thing. Dream on, app developers!
The fact that they are social networking sites just means
that the sites are stupid, and they have stupid users that
use an insecure platform that provides the vector.
You are being MICROattacked, from various angles, in a SOFT manner.
One of them was thrown in jail for 3 years. http://blogs.zdnet.com/threatchaos/?p=545/
Oh, wait...nevermind.
Res publica non dominetur
Reduce, reuse, cycle
This looks like a good opportunity to rant a little about the abysmal uploading support built into browsers.
With all the effort going into interactive sites, AJAX, user communities, media distribution and so on, the actual process of uploading files to a site is just as crap as it was in 1995.
In both IE and Firefox, the sum total of the upload user interface is a text box with a browse button, followed by an almost unnoticeable progress indication in the status bar. If anything goes wrong, the upload is aborted, in some unknown state, and can't be restarted. There is no way to upload more than one file except by the web page author manually coding in duplicate entry fields.
Why is this acceptable as the basic way for users to contribute images, videos, documents, etc to the amazing new web2.0 universe?
I do realise that security is a concern here, but a bit more effort from browser vendors would help users a lot.
For every expert, there is an equal and opposite expert. - Arthur C. Clarke
Insert witty comment here
Generic Social Networking sites are the online extension of the high school popularity game. If you want to join a social neworking site, pick one that you have in common with. Otherwise it's just muscles and boobs.... I, for one, applaud their use of activex. The more people who have problems, the quicker these sites will lose popularity..... Send an email to MySpace and Facebook telling them you love their use of ActiveX, how much it makes everything easier and that you would like them to use it more!!
...and other headlines, dog bites man, police arrest thief. Is this news?
"I hope you like Guinness, Sir. I find it a refreshing substitute for, er... food." Col. Jack O'Neil, SG-1