Hackers Target MySpace and Facebook

Stony Stevenson writes "The security firm Fortify Software has warned against a series of attacks against Facebook and MySpace. Buffer overflows that enabled hackers to exploit the Aurigma ActiveX image uploading software used by social networking sites were at the heart of the assault. 'Criminal hackers now view social networking sites as their best target for attacks ... [partially because] such sites are designed to be usable by "unsophisticated" consumers, meaning that the barrier to entry for attacks is potentially lower as users are more likely to click on a link that leads to malware.'"

Comments

Internet Explorer based exploit

[prajjwal]

I assume this is an internet explorer based exploit? http://www.kb.cert.org/vuls/id/776931

Re:Internet Explorer based exploit

[palegray.net]

Well, according to this page it allows execution of arbitrary code on the victim's machine. Whatever the user's account permits them to do, the code could do, up to and including actions permissible by other unpatched vulnerabilities on the client machine.

Re:Internet Explorer based exploit

[palegray.net]

Origami plugin? Does it fold your keyboard into a three dimensional swan? Surely you meant the Aurigma ImageUploader plugin.

Re:Internet Explorer based exploit

[palegray.net]

The ActiveX control doesn't come with IE; it's hosted on the servers that provide the social networking service and loaded into your browser when you elect to upload an image to your profile. What I find really interesting is the date this vulnerability was first published: 02/04/2008 11:26:53 AM

HEY!

[Corpuscavernosa]

Check out this AWESOME site! They're giving away all these FREE ringtones!!! I don't even know how they do it!!!

(received as a comment on my page this morning)

Re:HEY!

[Corpuscavernosa]

Noticing my offtopic mod, perhaps I didn't tailor my comment quite properly. There is rampant hacking of accounts for phishing and advertising purposes. One account will get hacked, then using that account, the hacker then sends out bulletins (mass emails to all friends) or comments saying to "click here" for numerous purposes including hacking future sites to send out more ads. When clicking on these sent out comments or bulletins, there will often be a phishing page where it looks like the user has logged out and needs to re-enter login and password info. Additionally, the unwitting 14 year old gives out his/her cell phone number and unknowingly signs up for a ringtone plan that is charged to their cell phone bill usually to the tune of $30/month.

The hacks are pretty interesting as they are socially viral and not necessarily driven by sofware or the transmission of a virus.

Maybe I need to RTFA, but this type of hacking has got to be the most prevalent type on Myspace.

"Legitimate" businesses target young people too.

[gnutoo]

Cable, telco and banks and apparel vendors all have young people in their sites. Predatory lending credit cards, special internet "deals" with students and massive advertising budgets that should make the companies involved blush, are aimed at people ages 14 to 25.

Why? because that's where the money is.

Why do the theives use ActiveX exploits? Because they can.

Sheep, meet Mr. Slaughter. Mr. Slaughter .... gross!

A Troll's Dream

[Anonymous Coward]

Oh man, a slashbot troll's dream -- do I start ranting about myspace and their userbase or do I start ranting about activex?

Re:A Troll's Dream

[badboy_tw2002]

Tie them into a rant about hacker != cracker and you've got a troll triple word score!

Re:Just what kids on Myspace and Facebook need...

[Corpuscavernosa]

Unlike some sites I visit regularly, I've never been goatse-ed on Myspace... :)

That...

[MikeRT]

And with the way that people spew out personal information on Facebook and MySpace, they probably figure that if they get it just right, there's the potential to hit the motherload of information for identity theft.

Re:That...

[palegray.net]

Given the fact that it's a client-side issue, it's far more likely the attackers are looking to achieve two goals with this sort of exploit:

1. Turn the client computer into a zombie, which participates in the attacker's efforts to spew out spam and scan networks for machines vulnerable to other exploits.
   
   
2. Scan the user's local machine and any network shares for "interesting" data that might be used to compromise financial institution accounts.
   
   
3. Capture login information on the local machine and relay it to the attacker.

The contents of the user's MySpace or Facebook profile information probably ranks rather low on the list of useful information.

Re:That...

[Orion Blastar]

Read the article, it was the image uploading ActiveX control that got exploited. Chances are that people who uploaded images recently and ran Internet Explorer that used the ActiveX control might have gotten their password and personal information stolen. Those Windows users who use Firefox should know that Firefox does not support ActiveX controls unless the user installed an ActiveX Plugin that allows limited ActiveX controls to be used. If the user did not install the ActiveX Plugin, I seriously doubt they got hit with this exploit if they used Firefox.

Linux, Macintosh, BSD Unix, and Non-Windows systems do not support ActiveX controls anyway so it is mostly Windows systems that are effected by the exploit, and only Windows users who use Internet Explorer and not those who use Firefox.

I am guessing that a lot of 12 to 24 year olds that have their own credit card or their parent's credit card or bank account or somehow work an have their own bank account are the ones targeted by this, as people aged 12 to 24 are most likely to use Windows with Internet Explorer and not know about the exploits out there, and just surf and click on anything they want.

A lot of family members and friends have children aged within that range who use their family's computer and after it gets so infected with malware that they cannot use it, they call me to come over and fix it for them. Nope, Linux, BSD Unix, or switching to a Mac is not an option for them, in some cases I switched them to Linux only to have them make me switch them back to Windows because certain web sites only work with Internet Explorer, or certain games they bought won't run under WINE or they have no idea how to configure WINE to run them for them. Dual-Booting just confuses them more, as does running Windows in a virtual machine. If they bought a Mac, a few weeks later they'd tell me to remove OSX off it and put Windows on it. So basically, they stick to Windows and Internet Explorer, even if I install Firefox for them. Also I install the Google Pack with StarOffice, but of course they want MS-Office instead because their friends and co-workers don't know how to open up ODT open text format documents, and they keep forgetting to "Save As" into MS-Word 97-2002 Format so their coworkers and friends can read their documents.

Hackers?

[InvisblePinkUnicorn]

Hackers? I remember hacky sacks from when I was a kid! Are these the same thing? *clicks link to find out*

Re:Just what kids on Myspace and Facebook need...

[themushroom]

Is a goatse different than puckering, making a faux 'thoughtful' face with hand on chin, and making a gang-style hand sign that means nothing a dozen times into the webcam with poor lighting in the photo gallery?

I can't really tell the difference.

Re:Just what kids on Myspace and Facebook need...

[palegray.net]

Not really much threat of goatse images, but a signficant threat of arbitrary remote code execution for Windows users.

Re:Just what kids on Myspace and Facebook need...

[Brian Gordon]

I've had seven different passwords and they've got them all so far.

Re:In other words..

[palegray.net]

In other words, social networking website users are more prone to social engineering attacks. While your comment may be a nifty play on words, if you're going to use the term "social engineering," you really ought to use it in the right context. This is a system vulnerability attack, not to be confused with social engineering attacks. Somewhere Kevin Mitnick is frowning.

Not just client-side ActiveX issues on Facebook

[StuffedFrogYK]

May I mention that hacking Facebook takes no real effort? Simply manipulating a browser's client side input forms (using Firebug, maybe) allows one to post to any Superwall (Faceboo application) whether you are the person's friend or not. Anonymous attakers could put links posing as coming from people's friends on the people's Superwalls. Reasoning: If it comes from my friend, it must be good and safe. The click-rate becomes much higher, and an attacker has just used a form of social engineering to lead people to a malware site. Most applications are not built with security in mind. They just (fatally) assume that the end user would never do such a thing. Dream on, app developers!