Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security Social Networks The Internet

Hackers Target MySpace and Facebook 93

Posted by Zonk from the facebooker-beware dept.
Stony Stevenson writes "The security firm Fortify Software has warned against a series of attacks against Facebook and MySpace. Buffer overflows that enabled hackers to exploit the Aurigma ActiveX image uploading software used by social networking sites were at the heart of the assault. 'Criminal hackers now view social networking sites as their best target for attacks ... [partially because] such sites are designed to be usable by "unsophisticated" consumers, meaning that the barrier to entry for attacks is potentially lower as users are more likely to click on a link that leads to malware.'"
This discussion has been archived. No new comments can be posted.

Hackers Target MySpace and Facebook More

Hackers Target MySpace and Facebook

Comments Filter:

  • Internet Explorer based exploit (Score:5, Insightful)

    by prajjwal ( 965508 ) on Tuesday March 04, 2008 @08:14PM (#22644878)
    I assume this is an internet explorer based exploit? http://www.kb.cert.org/vuls/id/776931 [cert.org]

  • HEY! (Score:5, Funny)

    by Corpuscavernosa ( 996139 ) on Tuesday March 04, 2008 @08:16PM (#22644892)
    Check out this AWESOME site! They're giving away all these FREE ringtones!!! I don't even know how they do it!!!

    (received as a comment on my page this morning)

    • Re:HEY! (Score:5, Informative)

      by Corpuscavernosa ( 996139 ) on Tuesday March 04, 2008 @08:47PM (#22645170)
      Noticing my offtopic mod, perhaps I didn't tailor my comment quite properly. There is rampant hacking of accounts for phishing and advertising purposes. One account will get hacked, then using that account, the hacker then sends out bulletins (mass emails to all friends) or comments saying to "click here" for numerous purposes including hacking future sites to send out more ads. When clicking on these sent out comments or bulletins, there will often be a phishing page where it looks like the user has logged out and needs to re-enter login and password info. Additionally, the unwitting 14 year old gives out his/her cell phone number and unknowingly signs up for a ringtone plan that is charged to their cell phone bill usually to the tune of $30/month.

      The hacks are pretty interesting as they are socially viral and not necessarily driven by sofware or the transmission of a virus.

      Maybe I need to RTFA, but this type of hacking has got to be the most prevalent type on Myspace.

      • Re: (Score:1)

        by pxc ( 938367 )
        My sister's account has been sending out bunches of these lately, even when she herself is asleep. I changed her password and scanned her machine for viruses, as well as removing a bunch of Facebook "apps". Didn't do anything for it.

        Anyone know anything more about this?

        • Re: (Score:2)

          by dave562 ( 969951 )
          It might have modified the actual HTML code on her page. It hasn't happened to me yet, but I've heard of people who get to the point where they basically need to blank their page and reset it to the default one with no code on it what so ever. A lot of the code templates that people use to add backgrounds and what not to their pages are full of exploit code.

  • "Legitimate" businesses target young people too. (Score:5, Insightful)

    by gnutoo ( 1154137 ) on Tuesday March 04, 2008 @08:17PM (#22644902) Journal

    Cable, telco and banks and apparel vendors all have young people in their sites. Predatory lending credit cards, special internet "deals" with students and massive advertising budgets that should make the companies involved blush, are aimed at people ages 14 to 25.

    Why? because that's where the money is.

    Why do the theives use ActiveX exploits? Because they can.

    Sheep, meet Mr. Slaughter. Mr. Slaughter .... gross!

    • young people in their sites

      The word you were looking for is "sights" :). All improper usage aside, while I don't disagree with the sentiment of your post, it's important to note that the style of exploitation being discussed differs in that it's highly illegal and completely indiscriminate in nature. It's also more than likely that the sources of these attacks are individuals operating from jurisdictions outside the reach of U.S. law enforcement, which makes punishing the offenders sort of difficult.

      Do your friends and family a f

    • we're not exactly talking about the most sophisticated users on these sites. Why wouldn't they prey on the obviously easy targets.

  • A Troll's Dream (Score:5, Funny)

    by Anonymous Coward on Tuesday March 04, 2008 @08:18PM (#22644912)
    Oh man, a slashbot troll's dream -- do I start ranting about myspace and their userbase or do I start ranting about activex?

    • Re:A Troll's Dream (Score:5, Funny)

      by badboy_tw2002 ( 524611 ) on Tuesday March 04, 2008 @09:03PM (#22645274)
      Tie them into a rant about hacker != cracker and you've got a troll triple word score!

      • Re: (Score:3)

        by vux984 ( 928602 )
        Mod parent awesome.

        Not only did he invoke one of the slashdot holy wars to complete his trifecta, but managed to quietly work in an IP controversy by referencing scrabble/scrabulous which itself is just the result of the buzz surrounding an app on a social networking site like facebook/myspace thereby completing a circular reference and ending up exactly where we started.

        At the very least he should get 50 bonus points for using all his letters! :)

        (And if you look closely, so did I.)

        • Re: (Score:2)

          by rtb61 ( 674572 )
          Hmm, troll, from the way you keep using this word I do not think you know what it means. http://en.wikipedia.org/wiki/Forum_troll [wikipedia.org]. So by your and the parents and grandparents reference, these topics are in fact 'popular' and accepted topics of ill repute. So quick review of the definition, will basically define yourselves as trolls rather than those posters who are making sound criticisms of the social network forums and M$ active X controls and, perversely enough I could be accused of feeding the trolls. S

  • Comment removed (Score:5, Insightful)

    by account_deleted ( 4530225 ) on Tuesday March 04, 2008 @08:21PM (#22644958)
    Comment removed based on user account deletion

    • Re:That... (Score:5, Interesting)

      by palegray.net ( 1195047 ) <philip.paradis@p ... t ['ale' in gap]> on Tuesday March 04, 2008 @08:52PM (#22645202) Homepage Journal
      Given the fact that it's a client-side issue, it's far more likely the attackers are looking to achieve two goals with this sort of exploit:
      1. Turn the client computer into a zombie, which participates in the attacker's efforts to spew out spam and scan networks for machines vulnerable to other exploits.

      2. Scan the user's local machine and any network shares for "interesting" data that might be used to compromise financial institution accounts.

      3. Capture login information on the local machine and relay it to the attacker.
      The contents of the user's MySpace or Facebook profile information probably ranks rather low on the list of useful information.

    • Re:That... (Score:5, Insightful)

      by Orion Blastar ( 457579 ) <orionblastar@@@gmail...com> on Tuesday March 04, 2008 @09:00PM (#22645250) Homepage Journal
      Read the article, it was the image uploading ActiveX control that got exploited. Chances are that people who uploaded images recently and ran Internet Explorer that used the ActiveX control might have gotten their password and personal information stolen. Those Windows users who use Firefox should know that Firefox does not support ActiveX controls [mozilla.com] unless the user installed an ActiveX Plugin that allows limited ActiveX controls to be used. If the user did not install the ActiveX Plugin, I seriously doubt they got hit with this exploit if they used Firefox.

      Linux, Macintosh, BSD Unix, and Non-Windows systems do not support ActiveX controls anyway so it is mostly Windows systems that are effected by the exploit, and only Windows users who use Internet Explorer and not those who use Firefox.

      I am guessing that a lot of 12 to 24 year olds that have their own credit card or their parent's credit card or bank account or somehow work an have their own bank account are the ones targeted by this, as people aged 12 to 24 are most likely to use Windows with Internet Explorer and not know about the exploits out there, and just surf and click on anything they want.

      A lot of family members and friends have children aged within that range who use their family's computer and after it gets so infected with malware that they cannot use it, they call me to come over and fix it for them. Nope, Linux, BSD Unix, or switching to a Mac is not an option for them, in some cases I switched them to Linux only to have them make me switch them back to Windows because certain web sites only work with Internet Explorer, or certain games they bought won't run under WINE or they have no idea how to configure WINE to run them for them. Dual-Booting just confuses them more, as does running Windows in a virtual machine. If they bought a Mac, a few weeks later they'd tell me to remove OSX off it and put Windows on it. So basically, they stick to Windows and Internet Explorer, even if I install Firefox for them. Also I install the Google Pack with StarOffice, but of course they want MS-Office instead because their friends and co-workers don't know how to open up ODT open text format documents, and they keep forgetting to "Save As" into MS-Word 97-2002 Format so their coworkers and friends can read their documents.

      • Re: (Score:2, Insightful)

        by palegray.net ( 1195047 )

        Chances are that people who uploaded images recently and ran Internet Explorer that used the ActiveX control might have gotten their password and personal information stolen.

        For the love of Pete, it's a remote code execution [cert.org] vulnerability. We're talking about a lot more than a use's MySpace password getting lifted. Why couldn't the submitter be bothered to provide a link that actually describes the issue in detail, instead of just a sensationalist news article that gives virtually no technical information?

        • For the shock and awe value, to fool a majority of the people into thinking that their Myspace and Facebook accounts got hacked and they might be a possible target of identity theft.

          What they don't know is that it is a remote exploit that a hacker can use in an email or web page by giving an embedded link to Facebook or MySpace that contains URL data that will exploit the ActiveX control used for image uploading by those web sites so that it runs code on their Internet Explorer to steal information, install
      • one is responsible for ones choices/actions, and if you've tried to help them but they choose to be ignorant or dismiss these problems it is THEIR OWN FAULT. Eventually they will either learn from the lessons of being pwned or they will suffer.

        • Re: (Score:3, Insightful)

          by Orion Blastar ( 457579 )
          That is the way that a majority of people on this planet are. They don't learn from their own choices/actions and keep making the same choices/actions over and over again, and people like me have to clean up after them. That is the way my jobs have been for the past thirty years, each computer job I had to clean up after someone else's mess. I had to debug code that makes no sense much less won't compile without errors, into something that actually works and doesn't crash systems within a week or two. No fl

      • Re: (Score:1)

        by El Lobo ( 994537 )
        And if it's their choise to use Windows, you have not even the right to try to install Linuzzz or OZX on their computers. Let people use what they wat for pete's sake!
        • I suppose you are right. But I wanted to show them that there was an alternative to Windows out there, and they wanted to try it. So I did install Linux for them, but they made me put Linux back on their PC.

          Linux, BSD Unix, Mac OSX doesn't always work for most people, they need the ability to run native Windows programs and an emulator or virtual machine only slows them down or confuses them. Dual-Booting also confuses them as they try to run or install Windows programs under Linux, Mac OSX, etc. The only r

  • In other words.. (Score:1, Insightful)

    by glavenoid ( 636808 )
    In other words, social networking website users are more prone to social engineering attacks. But I state the obvious...

    Seriously though, who here actually granted MySpace or Facebook access to your email account in order to find your "friends"? Anything else (the social website has access to) is butter in the frosting

    It really amazes me just how much personal information people are willing to put on the internet these days. Even if said information is not explicitly granted to a particular website, a gre

  • Hackers? (Score:3, Funny)

    by InvisblePinkUnicorn ( 1126837 ) on Tuesday March 04, 2008 @08:30PM (#22645034)
    Hackers? I remember hacky sacks from when I was a kid! Are these the same thing? *clicks link to find out*

  • [partially because] such sites are designed to be usable by "unsophisticated" consumers
    you don't say

  • so what you are saying is.... (Score:3)

    by timmarhy ( 659436 ) on Tuesday March 04, 2008 @08:38PM (#22645112)
    ... dumb people shouldn't have the internets?

    • Re: (Score:3, Insightful)

      by webmaster404 ( 1148909 )
      No, dumb people shouldn't use an insecure browser such as IE. Really, just using Firefox takes your threats down by a good 75% even if you are using Windows.

    • Re: (Score:2)

      by dbIII ( 701233 )

      ... dumb people shouldn't have the internets?

      The problem is how do we spot them? They won't all be posting under their real name and using that horrible typo "internets".

      • They won't all be posting under their real name and using that horrible typo "internets".


        Easy, everyone that uses "your" instead of "you're" are the dumb ones. Find them, and things should calm down.

  • ... Facebook et al has unsophisticated users?

    ... ActiveX is an insecure technology?

    I'm shocked I tell you!!!

    Seriously though, doesn't this happen every day? Why is this more newsworthy than the the usual background level of social network hacking attempts and ActiveX suckiness?
    • It's not. But neither is news on (a) Vista (b) iPhone (c) XML etc. In addition to a meta-moderate a meta-edit would be good as well ;)
  • Water is wet and the sky is blue.

    Honestly, who is this "news" to/for?
    • ...for people who don't know that the internet can be "dangerous"?

      But seriously, half of me agrees with you since this should be completely obvious, but the other half knows that people like my mom still don't realize it's risky to open an eCard even if it comes from someone she knows. If these "news" stories keep getting out there, maybe the thick-headed people out there will finally get the picture... then again, if they haven't gotten it by now, this type of thing just makes them more scared instead o
  • the 90's are the equivalent of most facebook etc users today. Unsophisticated is being kind, it's a gullibility farm.

  • Facebook rolled out a fix quickly (Score:3, Informative)

    by steveha ( 103154 ) on Tuesday March 04, 2008 @09:30PM (#22645440) Homepage
    Facebook reacted quickly when the news broke. I'm not sure why this is a story now.

    http://secwatch.org/advisories/1020254/ [secwatch.org]

    steveha
  • This was just up like 3 days ago.

    -ellie

  • Not just client-side ActiveX issues on Facebook (Score:4, Insightful)

    by StuffedFrogYK ( 928064 ) on Wednesday March 05, 2008 @12:32AM (#22646444)
    May I mention that hacking Facebook takes no real effort? Simply manipulating a browser's client side input forms (using Firebug, maybe) allows one to post to any Superwall (Faceboo application) whether you are the person's friend or not. Anonymous attakers could put links posing as coming from people's friends on the people's Superwalls. Reasoning: If it comes from my friend, it must be good and safe. The click-rate becomes much higher, and an attacker has just used a form of social engineering to lead people to a malware site. Most applications are not built with security in mind. They just (fatally) assume that the end user would never do such a thing. Dream on, app developers!
  • One of them was thrown in jail for 3 years. http://blogs.zdnet.com/threatchaos/?p=545/ [zdnet.com]

    Oh, wait...nevermind.

  • "Had Facebook and MySpace required Aurigma to provide proof of a code audit before sourcing the plug-in this latest security issue could have been avoided," he said.
    If only I could find a company to sell me a "code audit". It sounds so much better than just testing my code properly.
  • This looks like a good opportunity to rant a little about the abysmal uploading support built into browsers.
    With all the effort going into interactive sites, AJAX, user communities, media distribution and so on, the actual process of uploading files to a site is just as crap as it was in 1995.

    In both IE and Firefox, the sum total of the upload user interface is a text box with a browse button, followed by an almost unnoticeable progress indication in the status bar. If anything goes wrong, the upload is abo
    • Not to disagree, but do have a look at YUI's file upload control [yahoo.com] which is (yes evil) flash based, but very nice and at least cross platform and not some evil activex control. It should be unnecessary for any site to be shoving activex controls down your throat to do decent file uploading.
      • Well, exactly. Good quality file upload should be built into browsers. It shouldn't require any sort of add-on. Whether Flash or ActiveX.
  • from the FTA: Buffer overflows that enabled hackers to exploit the Aurigma ActiveX image uploading software used by social networking sites were at the heart of the assault.

    <plumber>Well that's your problem right there!</plumber>
  • Generic Social Networking sites are the online extension of the high school popularity game. If you want to join a social neworking site, pick one that you have in common with. Otherwise it's just muscles and boobs.... I, for one, applaud their use of activex. The more people who have problems, the quicker these sites will lose popularity..... Send an email to MySpace and Facebook telling them you love their use of ActiveX, how much it makes everything easier and that you would like them to use it mor
  • ...and other headlines, dog bites man, police arrest thief. Is this news?

Slashdot Top Deals

Top Ten Things Overheard At The ANSI C Draft Committee Meetings: (10) Sorry, but that's too useful.

Close