Slashdot Mirror
Hackers Target MySpace and Facebook
Stony Stevenson writes "The security firm Fortify Software has warned against a series of attacks against Facebook and MySpace. Buffer overflows that enabled hackers to exploit the Aurigma ActiveX image uploading software used by social networking sites were at the heart of the assault. 'Criminal hackers now view social networking sites as their best target for attacks ... [partially because] such sites are designed to be usable by "unsophisticated" consumers, meaning that the barrier to entry for attacks is potentially lower as users are more likely to click on a link that leads to malware.'"
to see tons of goatse images from stupid hackers thinking they are funny and cool.
I assume this is an internet explorer based exploit? http://www.kb.cert.org/vuls/id/776931
(received as a comment on my page this morning)
We figured out a long time ago that it's easier to elect seven judges than to elect 132 legislators.
Cable, telco and banks and apparel vendors all have young people in their sites. Predatory lending credit cards, special internet "deals" with students and massive advertising budgets that should make the companies involved blush, are aimed at people ages 14 to 25.
Why? because that's where the money is.
Why do the theives use ActiveX exploits? Because they can.
Sheep, meet Mr. Slaughter. Mr. Slaughter .... gross!
Oh man, a slashbot troll's dream -- do I start ranting about myspace and their userbase or do I start ranting about activex?
And with the way that people spew out personal information on Facebook and MySpace, they probably figure that if they get it just right, there's the potential to hit the motherload of information for identity theft.
Seriously though, who here actually granted MySpace or Facebook access to your email account in order to find your "friends"? Anything else (the social website has access to) is butter in the frosting
It really amazes me just how much personal information people are willing to put on the internet these days. Even if said information is not explicitly granted to a particular website, a great deal can be inferred by people's, for lack of a better term, "blogging" habits.
I, for one, am looking forward to the inevitable
Lulz[myspace.com] has written a pretty good MySpace blog entry
... I have stripped out the first "
.testnav { position:absolute; top: 136px; left:50%; _top: 146px
... FOR NOW!
.mov files.
[myspace.com] about this, along with some protection and removal instructions if needed(in the
comments and in my post also). One of this guy's hobbies is exposing
MySpace scammers. He actually predicted about a week ago that an
exploit like this would happen. Friend him if you have a MySpace. I
can't tell who came up with this information first, Lolo or these guys
but Lolo may have gotten there first. Either way you need to read his
blog posts if you use MySpace...
Please note that you can be infected by this virus by simply viewing an infected profile. It doesn't matter what browser you use, I was using Firefox 2.0 with AdBlockPlus and a decent filterset updater and was infected. I DO NOT believe it steals your password without going to the fake login page. So if your profile gets infected you are probably fine simply removing it
Here's how to prevent it:
Use the FIND command or CTRL F to find the word LOGIN.
It starts with this line of code
style type="text/css"
div table td font { display: none }
div div table tr td a.navbar, div div table tr td font { display: none }
The code was at the very end/bottom of my ABOUT ME section.
It then continues with an obvious line of code for the menu choices. I stripped out the code and the page is fine
To truly protect yourself you need to adblock the offending Quicktime object - or better yet all
Hackers? I remember hacky sacks from when I was a kid! Are these the same thing? *clicks link to find out*
The exploit in question also targets IE/win, so that's another pool of potential and likely noobs (or already zombies, easier).
That's not a computer problem, that's pebcak entirely. Some people will always be vulnerable no matter which browser they use.
When you get down to it, I don't mind them targeting these sites at all... because I would never go there. Ever.
... dumb people shouldn't have the internets?
If you mod me down, I will become more powerful than you can imagine....
Do your friends and family a favor: educate them on the inherent risks present in the software applications they use on a daily basis. Computer security starts with the user acting in a responsible manner to secure his/her system. If securing the system proves too difficult or time-consuming, maybe it's time to try a different system.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
we're not exactly talking about the most sophisticated users on these sites. Why wouldn't they prey on the obviously easy targets.
When people ask if I'm an optimist, I say "I hope so". --Bill Bailey
... Facebook et al has unsophisticated users?
... ActiveX is an insecure technology?
I'm shocked I tell you!!!
Seriously though, doesn't this happen every day? Why is this more newsworthy than the the usual background level of social network hacking attempts and ActiveX suckiness?
Water is wet and the sky is blue.
Honestly, who is this "news" to/for?
the 90's are the equivalent of most facebook etc users today. Unsophisticated is being kind, it's a gullibility farm.
one is responsible for ones choices/actions, and if you've tried to help them but they choose to be ignorant or dismiss these problems it is THEIR OWN FAULT. Eventually they will either learn from the lessons of being pwned or they will suffer.
See my art -> http://herbevore.deviantart.com
Facebook reacted quickly when the news broke. I'm not sure why this is a story now.
http://secwatch.org/advisories/1020254/
steveha
lf(1): it's like ls(1) but sorts filenames by extension, tersely
Criminals Attacking Myspace, Facebook IE Plugins
This was just up like 3 days ago.
-ellie
Windows should be illegal to use, no matter the version. Piece of shit software made by a convicted monopoly.
May I mention that hacking Facebook takes no real effort? Simply manipulating a browser's client side input forms (using Firebug, maybe) allows one to post to any Superwall (Faceboo application) whether you are the person's friend or not. Anonymous attakers could put links posing as coming from people's friends on the people's Superwalls. Reasoning: If it comes from my friend, it must be good and safe. The click-rate becomes much higher, and an attacker has just used a form of social engineering to lead people to a malware site. Most applications are not built with security in mind. They just (fatally) assume that the end user would never do such a thing. Dream on, app developers!
The fact that they are social networking sites just means
that the sites are stupid, and they have stupid users that
use an insecure platform that provides the vector.
You are being MICROattacked, from various angles, in a SOFT manner.
One of them was thrown in jail for 3 years. http://blogs.zdnet.com/threatchaos/?p=545/
Oh, wait...nevermind.
Res publica non dominetur
Reduce, reuse, cycle
This looks like a good opportunity to rant a little about the abysmal uploading support built into browsers.
With all the effort going into interactive sites, AJAX, user communities, media distribution and so on, the actual process of uploading files to a site is just as crap as it was in 1995.
In both IE and Firefox, the sum total of the upload user interface is a text box with a browse button, followed by an almost unnoticeable progress indication in the status bar. If anything goes wrong, the upload is aborted, in some unknown state, and can't be restarted. There is no way to upload more than one file except by the web page author manually coding in duplicate entry fields.
Why is this acceptable as the basic way for users to contribute images, videos, documents, etc to the amazing new web2.0 universe?
I do realise that security is a concern here, but a bit more effort from browser vendors would help users a lot.
For every expert, there is an equal and opposite expert. - Arthur C. Clarke
No one deserves it more..
Insert witty comment here
Generic Social Networking sites are the online extension of the high school popularity game. If you want to join a social neworking site, pick one that you have in common with. Otherwise it's just muscles and boobs.... I, for one, applaud their use of activex. The more people who have problems, the quicker these sites will lose popularity..... Send an email to MySpace and Facebook telling them you love their use of ActiveX, how much it makes everything easier and that you would like them to use it more!!
...and other headlines, dog bites man, police arrest thief. Is this news?
"I hope you like Guinness, Sir. I find it a refreshing substitute for, er... food." Col. Jack O'Neil, SG-1