[ISN] Script wreaks havoc on MySpace

From: InfoSec News (alerts@private)
Date: Tue Jan 30 2007 - 23:09:59 PST


By Dan Goodin
San Francisco
31st January 2007 

A handful of enterprising people - at least one of them a teen - has 
devised a Javascript that allows its owner to temporarily access the 
browser's MySpace account, according to a security professional who was 
among the first to publicly write about the service.

These people also may have managed to spam about 1.5 million MySpace 
accounts, according to a Google Search. They pulled off the latter feat 
in less than three weeks by collecting thousands of passwords, according 
to one of the operators, in a venture that would appear to violate 
numerous terms governing the use of the social network.

Spam on MySpace appears to be reaching epidemic levels. Another barrage 
of junk messages appears to have affected 145,000 MySpace accounts, 
according to a separate Google search. ("I need you to do this for me, i 
want to get a free iPhone so i have to get 50 of my friends to go to the 
thing below and have them put their zipcode in," it reads. "If you could 
do that it'd be sooo awesome. THANks!!")

Stalkertrack.com advertises a free and upcoming service that tracks the 
people who visit a client's MySpace profile. Users are required to 
divulge their MySpace login credentials, and until we interviewed one of 
the site owners, terms of service permitted Stalkertrack to log in to 
MySpace users' account and send each friend spam messages promoting the 
site, according to this Google cache. (Those terms were removed in the 
last 24 hours.)


An analysis on Monday of the Javascript used in this demo showed the 
kind of data Stalkertrack is able to collect, according to Eric Sites, 
VP of research at Sunbelt Software. It included the IP address, user 
name, profile picture, browser type, screen resolution, and in many 
cases email address of every MySpace user who visited a client's 

MySpace has been under fire for an onslaught of worms, pedophile 
come-ons and phishing attacks over the past few months. While its 90 
million-strong user base makes it a favorite target for many miscreants, 
a host of decisions about the site's technical underpinnings make their 
job easier.

For instance, MySpace cookies, which Stalkertrack uses to extract 
visitor information, stores a wealth of data in the clear, including 
email addresses and other MySpace accounts accessed on the same PC. Add 
to that the ease of embedding powerful Javascript into pages, and you 
have a recipe for potential privacy breaches.

What's more, MySpace hosts authentication cookies and user-maintained 
pages on the same domain, making it harder to prevent cross-site-scripts 
like the one used by Stalkertrack, says Randolf Jorberg, the 
quick-spotting security professional.

Josh Holly, who helped device the Javascript, was able to gain 
temporarily access to the section of Jorberg's MySpace account that 
edits his profile, he said. The script pulled out the verification code 
stored in a cookie sitting on Jorberg's hard drive. Armed with the 
session ID a person can make changes to the account - except for 
changing the email address or password - for up to six hours.

We repeatedly called and emailed MySpace representatives to ask if they 
were aware of Stalkertrack. We got no response. [Social? Networking? 
Hardly - Ed.]

The Stalkertrack service has yet to launch and likely will not reveal 
email addresses and other sensitive information once it does, said 
Holly, who is listed as the owner of a site related to Stalkertrack. For 
now, the site is using the client sign ups to virally get the word out 
to MySpace friends. It will begin offering the tracking service within 
the next few months, said Holly, who added he was 17 years old. The 
Stalkertrack domain name was created on Jan. 1.

The site has convinced about 10,000 MySpace users to turn over their 
login details, according to a second person affiliated with the 
business, who wouldn't give his name. (Holly said the number was 100,000 
to 300,000, a figure that struck us as unrealistically high.) A bot uses 
the information to access the account and sends a spam to each user 
friend. This second person said the site quickly dumps the account 
password and doesn't sell the email addresses or use them for spamming 

Stalkertrack is by no means the only outfit offering the tracking of 
visitors to MySpace user pages. Indeed, eBay auctions purport to sell 
similar scripts. And a host of sites offered similar services as long 
ago as last May, according to Security Fix.

The sheer number of MySpace accounts displaying Stalkertrack's service 
demonstrates the power of viral marketing. It also is a wake-up call 
about the potential dangers that lurk underneath.

While there's no evidence suggesting Stalkertrack has done anything 
other than send millions of messages advertising the future service, 
Jorberg points out recommendations from trusted friends could easily 
convince users to download and install malicious payloads.

MySpace has not weighed in on whether it believes the service, and the 
thousands of users who surrendered their passwords, have violated 
MySpace terms of service. By our reading, however, Stalkertrack has run 
amok of several conditions, including the sending of junk email, the 
soliciting of passwords for commercial use and using the account, user 
name or password of another member. Those users who signed up for the 
service may also have violated terms barring the disclosure of passwords 
to third parties.

The second person operating Stalkertrack said he got an email inquiry 
from MySpace officials but no action was taken against the service. He 
also said he doesn't believe MySpace terms ban his solicitation of 
passwords, noting that Google Video does the same thing when MySpace 
users want to embed content on their profile.

MySpace is perhaps the site that best exemplifies the power of Web 2.0. 
At its current course, it may soon be the poster child for Spam 2.0.

Subscribe to InfoSec News

This archive was generated by hypermail 2.1.3 : Tue Jan 30 2007 - 23:14:44 PST