Hackers Target MySpace and Facebook

Stony Stevenson writes "The security firm Fortify Software has warned against a series of attacks against Facebook and MySpace. Buffer overflows that enabled hackers to exploit the Aurigma ActiveX image uploading software used by social networking sites were at the heart of the assault. 'Criminal hackers now view social networking sites as their best target for attacks ... [partially because] such sites are designed to be usable by "unsophisticated" consumers, meaning that the barrier to entry for attacks is potentially lower as users are more likely to click on a link that leads to malware.'"

Comments

Re:Internet Explorer based exploit

[palegray.net]

Well, according to this page it allows execution of arbitrary code on the victim's machine. Whatever the user's account permits them to do, the code could do, up to and including actions permissible by other unpatched vulnerabilities on the client machine.

Re:HEY!

[Corpuscavernosa]

Noticing my offtopic mod, perhaps I didn't tailor my comment quite properly. There is rampant hacking of accounts for phishing and advertising purposes. One account will get hacked, then using that account, the hacker then sends out bulletins (mass emails to all friends) or comments saying to "click here" for numerous purposes including hacking future sites to send out more ads. When clicking on these sent out comments or bulletins, there will often be a phishing page where it looks like the user has logged out and needs to re-enter login and password info. Additionally, the unwitting 14 year old gives out his/her cell phone number and unknowingly signs up for a ringtone plan that is charged to their cell phone bill usually to the tune of $30/month.

The hacks are pretty interesting as they are socially viral and not necessarily driven by sofware or the transmission of a virus.

Maybe I need to RTFA, but this type of hacking has got to be the most prevalent type on Myspace.

Re:Just what kids on Myspace and Facebook need...

[palegray.net]

Not really much threat of goatse images, but a signficant threat of arbitrary remote code execution for Windows users.

Re:In other words..

[palegray.net]

In other words, social networking website users are more prone to social engineering attacks. While your comment may be a nifty play on words, if you're going to use the term "social engineering," you really ought to use it in the right context. This is a system vulnerability attack, not to be confused with social engineering attacks. Somewhere Kevin Mitnick is frowning.

Facebook rolled out a fix quickly

[steveha]

Facebook reacted quickly when the news broke. I'm not sure why this is a story now.

http://secwatch.org/advisories/1020254/

steveha

Re:Just what kids on Myspace and Facebook need...

[Anonymous Coward]

Then obviously you need a bigger dog.