Slashdot Mirror
Hackers Target MySpace and Facebook
Stony Stevenson writes "The security firm Fortify Software has warned against a series of attacks against Facebook and MySpace. Buffer overflows that enabled hackers to exploit the Aurigma ActiveX image uploading software used by social networking sites were at the heart of the assault. 'Criminal hackers now view social networking sites as their best target for attacks ... [partially because] such sites are designed to be usable by "unsophisticated" consumers, meaning that the barrier to entry for attacks is potentially lower as users are more likely to click on a link that leads to malware.'"
I assume this is an internet explorer based exploit? http://www.kb.cert.org/vuls/id/776931
(received as a comment on my page this morning)
We figured out a long time ago that it's easier to elect seven judges than to elect 132 legislators.
Cable, telco and banks and apparel vendors all have young people in their sites. Predatory lending credit cards, special internet "deals" with students and massive advertising budgets that should make the companies involved blush, are aimed at people ages 14 to 25.
Why? because that's where the money is.
Why do the theives use ActiveX exploits? Because they can.
Sheep, meet Mr. Slaughter. Mr. Slaughter .... gross!
Oh man, a slashbot troll's dream -- do I start ranting about myspace and their userbase or do I start ranting about activex?
Unlike some sites I visit regularly, I've never been goatse-ed on Myspace... :)
We figured out a long time ago that it's easier to elect seven judges than to elect 132 legislators.
And with the way that people spew out personal information on Facebook and MySpace, they probably figure that if they get it just right, there's the potential to hit the motherload of information for identity theft.
Hackers? I remember hacky sacks from when I was a kid! Are these the same thing? *clicks link to find out*
Is a goatse different than puckering, making a faux 'thoughtful' face with hand on chin, and making a gang-style hand sign that means nothing a dozen times into the webcam with poor lighting in the photo gallery?
I can't really tell the difference.
Laughter is the Spackle of the Soul.
... dumb people shouldn't have the internets?
If you mod me down, I will become more powerful than you can imagine....
Do your friends and family a favor: educate them on the inherent risks present in the software applications they use on a daily basis. Computer security starts with the user acting in a responsible manner to secure his/her system. If securing the system proves too difficult or time-consuming, maybe it's time to try a different system.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
we're not exactly talking about the most sophisticated users on these sites. Why wouldn't they prey on the obviously easy targets.
When people ask if I'm an optimist, I say "I hope so". --Bill Bailey
Not really much threat of goatse images, but a signficant threat of arbitrary remote code execution for Windows users.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
I've had seven different passwords and they've got them all so far.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
Facebook reacted quickly when the news broke. I'm not sure why this is a story now.
http://secwatch.org/advisories/1020254/
steveha
lf(1): it's like ls(1) but sorts filenames by extension, tersely
Then obviously you need a bigger dog.
That is the way that a majority of people on this planet are. They don't learn from their own choices/actions and keep making the same choices/actions over and over again, and people like me have to clean up after them. That is the way my jobs have been for the past thirty years, each computer job I had to clean up after someone else's mess. I had to debug code that makes no sense much less won't compile without errors, into something that actually works and doesn't crash systems within a week or two. No flowcharts, no documentation, hardly any help from anyone, no support from management. Either do it or get fired. Management usually had no idea how programs work, and mostly hire the people they like instead of those qualified for the job. Then the other programmers take smoke breaks to light up a joint, write sloppy code as a result, and then the managers hand it over to me to fix it and make it work. But the stoners get the pay raises and promotions and work with new projects while I get stuck on the "legacy" work. When I worked as a technician, before I was a programmer, people would mess up their own computers mostly by not shutting them down before powering them off, or installing some software neither the company nor employee owns but it damages the system in some way.
I ran two computer companies, and you'd think that people always having problems by using their computers improperly would make more money than a Ghostbusters business in getting rid of ghosts would. But people tend not to pay their bills after you fix their systems, and make the same bad choices/actions as they did before and get infected again. My fault for not having a credit card machine and being nice and offering credit and no terms and pay when you have the money, etc.
Life is like that, a majority of the people in the USA make bad choices/actions. They don't save money for retirement, have unprotected sex with multiple partners and get STDs and AIDS as a result, eat fast food like there is no tomorrow and wonder why they are overweight, do more drugs than Cheech and Chong and wonder why they are so sick as a result, ignore their children and don't raise them right and wonder why they grow up to be sociopaths and do school shootings or end up in a gang, but someone has to fix all of that. The rest of the world is no different. People just don't take responsibility for their choices and actions anymore, and just blame someone else. They act as if George W. Bush ruined their career, made them sick, etc but ignore that it was their own choices/actions that made them the way they are and George W. Bush had nothing to do with 20, 30, 40, years of their own stupidity. In fact we elected a scape-goat instead of a President every four years anyway. Someone to blame for when things go wrong.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
May I mention that hacking Facebook takes no real effort? Simply manipulating a browser's client side input forms (using Firebug, maybe) allows one to post to any Superwall (Faceboo application) whether you are the person's friend or not. Anonymous attakers could put links posing as coming from people's friends on the people's Superwalls. Reasoning: If it comes from my friend, it must be good and safe. The click-rate becomes much higher, and an attacker has just used a form of social engineering to lead people to a malware site. Most applications are not built with security in mind. They just (fatally) assume that the end user would never do such a thing. Dream on, app developers!