Facebook and MySpace image uploaders vulnerable to attack
621411
Attackers could attack Windows, launch a denial of service attack, or execute malicious code.
387344
On 20 November 2004, a major malicious-code attack emerged targeting European Web sites via banner ads. This two-step attack exploits two previously identified security vulnerabilities: the Bofra (or IFRAME
741026
Researchers at security gateway vendor Fortinet have uncovered an adware-distribution scheme being carried out on the Facebook social networking site considered to be the first attack propagated on the wildly popular online portal.Disguised as a legitimate "Secret Crush" request on the site designed to inform Facebook users about other members who find them attractive, the application instead attempts to secretly install an adware program made by Zango after it has been successfully downloaded.The Secret Crush program also tries to lure people who download the file to pass it along to other Facebook members they know, according to Fortinet's research.The security vendor also contends that as many as 3 percent of Facebook's almost 60 million registered users have already downloaded the adware-bearing program.And while it appears that the attack has been unearthed by Facebook users themselves as worthless -- as the program does not actually deliver the social networking function it originally promises and has been highlighted as such on the site by people who have already downloaded it -- Fortinet experts said that the threat should be viewed by users of the portal, and its operators, as a sign of more dangerous attacks that will come.Facebook officials did not immediately respond to calls seeking comment on the Secret Crush adware threat.Dubbed specifically as a "malicious widget" by the security researchers, the attack illustrates the growing capability of badware distributors to tap into the trusted relationships fostered among users of social networking sites to pass out their latest threats.MySpace, an even larger social networking site with an estimated 250 million users, has been subverted on multiple occasions by malware attackers during the last year."The main thing people haven't realized is that in the current threat landscape, where all the threats are monetized, traffic equals money in the eyes of the attackers, and you can find more traffic than ever at these social networking sites," said Guillaume Lovet, a regional manager of Fortinet's Threat Response Team.Lovet said that because Facebook and MySpace users tend to trust content coming from members they are already familiar with, the social networking sites, when compromised, represent an ideal opportunity for malware distributors seeking a new environment to carry out their scams."At its core, Facebook is an incredible online marketing tool, people are on there openly providing their names, birthdays and a wealth of other information about their religious and political views, or their favorite books and movies," Lovet said. "If attackers have access to all that data, they can use it to craft attacks and use popular demographics they discover to create additional threats that tap into any of those themes."For instance, if attackers are able to mine Facebook profile data to deduce that a large number of people within a certain age group have recently seen a particular movie, they might attempt to create a threat that poses as content related to the film and send it out to everyone who fits in that demographic, Lovet said.The inherent power of social networking sites and their ability to allow individuals to find each other and communicate directly will help attackers use people, rather than technology, to spread their latest work in the future, according to the researcher.People are also more likely to provide more information about themselves or their contacts to an unknown application once they have begun downloading it, simply to gain the initial functionality it has promised, he said.Fortinet refers to this trend as the "escalation of commitment" effect."In the case of Secret Crush, it's worth noting that this is a social worm, not something traditional being spread via some malicious code. It is manipulating humans to pass it along it on their own," Lovet said. "And once people have been pushed into installing an application, it's easier to ask for more information to get them to finish the install. Once people have already invested some of their time, and shared some of their information with a new program, they are far more likely to share even more data to get access to the capabilities it is offering."Security experts have tabbed the use of social networking sites including MySpace and Facebook for the delivery of malware as one of the most significant trends they expect to emerge during 2008.As such, many vendors are actively encouraging businesses to block or monitor use of the programs to protect their networks and computers from being infected by nefarious applications."Businesses need to adjust their security and usage policies to address the realities of the Web 2.0 world," said Paul Henry, vice president of technology evangelism at security gateway maker Secure Computing."Their Internet use policies need to include social networking sites, blogs, and music and video-sharing sites, and the permissions need to be spelled out specifically," Henry said. "Beyond that they need technical safeguards to help enforce those policies where necessary. The troubling part about this is that most companies are still having problems dealing with far more traditional threats."
136437
MySpace this week is testing a system that uses fingerprinting tech from Audible Magic to spot and prevent uploading of unauthorized video under copyright protection.
289568
Because Internet Explorer is one of the programs vulnerable to a newly discovered Windows image flaw, it is possible that someone could fall victim to a virus written to exploit it just by visiting a Web site that uses JPEG images.
121787
A toolkit designed to exploit a recently-disclosed Microsoft JPEG vulnerability has been released onto the net.
397083
Mozilla has confirmed a vulnerability in its Firefox browser that could be used by attackers to scout out a system before they undertake a more aggressive assault.
528680
(InfoWorld) - Phishers have been using compromised MySpace.com accounts to attack unsuspecting Web surfers, security experts said Thursday. The attack is thought to have infected several thousand PCs according to reports from ISPs, said Johannes Ullrich, chief research officer for the SANS Institute. Ullrich has documented the issue on the SANS Internet Storm Center blog. Lawrence Baldwin, chief forensics officer with security vendor MyNetWatchman, discovered the threat Tuesday, and The Washington Post reported on it late Wednesday. Criminals have managed to install fake navigation bars on the top of MySpace.com user profile pages that, when clicked, lead to malicious computers that attempt to infect the victim's computer. The attack uses several known Internet Explorer flaws that have been fixed, so users who have installed the latest Microsoft patches are not at risk, security experts said. The code was installed on "maybe a few dozen," MySpace.com pages, most of which have been removed by administrators at the social-networking site, Ullrich said. MySpace.com representatives did not respond to requests for comment on Thursday. Two components comprise the attack. It attempts to install malicious botnet software on victims' computers, and it uses these infected computers to try to steal MySpace credentials in a phishing attack. Computers that are compromised by the attack become infected with malicious botnet software known as "flux bot," which makes them unwitting participants in the phishing scam. After the malicious Web site attempts to install the flux bot code, it then presents victims with a fake MySpace.com login page, which tries to extract their MySpace.com user name and password. Baldwin allowed one of his test computers to be infected with flux bot and found that attackers were remarkably successful at stealing passwords. "I operated as a flux node for about 12 hours and did a full audit of all the traffic coming into my machine. I was probably getting close to 60 MySpace users an hour surfing to my flux node. And at least a quarter of those actually gave up their credentials." Baldwin estimates that the attackers were using another 200 compromised flux bot machines in their attack. Because MySpace.com allows users to install their own HTML code and isÂ visited by such a large number of technically unsophisticated users, it has becomeÂ an attractive target for these types of attacks. Last December, hackers created a worm that quickly spread across MySpace.com, stealing user names and passwords. That worm exploited a flaw in Apple's QuickTime media player.
150896
In yet another "security via randomly generated images" kind of article, DevShed has posted their latest - Security Images with PHP and ImageMagick.
259952
Just one day after hackers showed how to exploit a number of flaws in the ActiveX software used by Internet Explorer, Symantec has spotted online criminals using one of the attacks.The attack, which was first observed in the last few hours, is not widespread at present. Symantec Security Response Director Oliver Friedrichs said Tuesday that the company had identified just three Web sites that were hosting the attack code, all of which seem to be linked to the same criminals. But he believes that more attacks are inevitable as the bad guys work the code into their malicious toolkits of software. &quot;Given the fact that the proof of concept is available and works, it&#39;s not exactly rocket science for someone to plug this into [a toolkit],&quot; he said. &quot;That&#39;s likely to happen in short order.&quot;Security researchers Elazar Broad and Krystian Kloskowski have disclosed a slew of ActiveX bugs affecting MySpace and Facebook over the past few days, but the attack reported by Symantec takes advantage of a flaw in an ActiveX control used by Yahoo&#39;s Music Jukebox.After the attackers are able to install software on the victim&#39;s machine, they then begin installing a number of malicious files on the victim&#39;s computer, Symantec said.Broad and Kloskowski also discovered a second ActiveX bug in Yahoo Jukebox, but that flaw is not yet being exploited by attackers, according to Symantec. Another major source of problems is the Aurigma ImageUploader ActiveX control, which is used by Web sites such as Facebook and MySpace to upload pictures into Internet Explorer.Because of all the ActiveX bugs, Security experts are warning users to be cautious while Web browsing. On Tuesday, US-CERT (United States Computer Emergency Readiness Team) published a note encouraging users to disable ActiveX controls, which can be done by setting Internet Explorer&#39;s security level to &quot;high&quot; for the Internet zone.That may not be a realistic option for many consumers, who will find their Internet Explorer browsing experience hobbled without ActiveX, Friedrichs said. But tech-savvy users and corporate IT shops can take steps to disable the untrusted ActiveX controls. In fact, the SANS Internet Storm Center has published free software that disables the controls.Another option for enterprise users is to create a whitelist of approved ActiveX controls, Friedrichs said.Security problems with browser add-ons are very common. In the first half of 2007, Symantec identified 237 browser plugin security flaws. About 89 percent of centered on ActiveX.Yahoo did not immediately respond to an e-mail message requesting comment for this story.
712866
A security researcher has uncovered yet another set of security flaws in an image component, which could put Linux users at risk of system compromise if they view a maliciously crafted image.
180728
Kevin Poulsen of Wired News has followed several stories this month about MySpace security breaches.  (parent.thesis) blogger Amy Tiemann asks why these reports haven't gotten wider coverage.
297905
Images posted in news groups may install remote control software on vulnerable PCs.
105612
An analysis of 34,000 MySpace accounts stolen in a phishing attack reveals that the site's young users generally choose smarter passwords than corporate wage slaves. Commentary by Bruce Schneier.
132097
(InfoWorld) - A sophisticated computer worm spreading via AOL Instant Messenger (AIM) is setting up a botnet that may be difficult to combat, security researchers said. The worm, known as W32.pipeline, propagates when AIM users click on a Web link that appears to have been sent to them by someone on their buddy list. They receive a message along the lines of, "Hey, would it be okay if I upload this picture of you to my blog?" If the recipient clicks on the link, an executable file that looks like a JPEG will download into a Windows folder, according to researchers at security company FaceTime Communications Inc. The file can then execute a number of different attacks, said Chris Boyd, security research manager for FaceTime Security Labs and the researcher who discovered the worm. It can open up the email port on the PC and send out spam messages. It can also install a variant of the "hacker defender" rootkit, which is widely deployed and difficult to remove. One of the most dangerous aspects of the worm is that it can also connect to remote file upload sites, which Boyd believes the worm authors' use as sort of staging sites where they can continuously download new infections. Once a computer is infected, the program will propagate using the same instant messaging method. The worm is unique because the program seems to be able to contact a number of different sites around the globe randomly. FaceTime researchers had different results when running the same file. "Previously, where we've seen something similar to this attempted, if one file is pulled offline or removed by an ISP, the whole chain goes down," Boyd said. "But this one, if one file goes missing or gets pulled down, it will potentially make a call to another file. It has quite a random aspect to it."So far, he estimates that the botnet -- a group of similarly infected computers that are remotely controlled -- has 1,000 to 2,000 members. More computers may have been infected but not made part of the botnet. The best defense is for AIM users to be wary of clicking on links. If a user receives an unexpected link from a buddy, the user can always reply to ask if they have sent the link, to make sure it is legitimate. FaceTime has updated its virus protection software to prevent users from infection, and other antivirus vendors may do the same. AIM users that get infected can try to remove the worm but may have to wipe and reformat their drives to get rid of it.
515151
You could be vulnerable to attack if you click a link to a malicious video conversation invitation.
189807
Browser flaw may leave you vulnerable to phishing attacks.