MySpace XSS worm on the loose
“Sarah” wrote to ask me about numerous things being “messed up on my account at the moment”, referring to her MySpace account. Turns out it’s yet another XSS (cross-site scripting bug in MySpace’s code).
We know several things thus far:
- This specific attack starts with an embedded .swf Flash file.
- The flash file uses ActionScript to send a simple GET request to an UNSANITIZED (whew, embarrassing on MySpace’s part) variable by the name of TheName.
- the GET request in #2 loads a remote .js script.
- the remote .js script then uses XML http send commands to execute the malicious part of the worm — changing first, last, and display names with “g0dOfTheN00se” and injects the malicious .swf file into several parts of the profile, including television.
The malicious JavaScript is in a file named “SamyReloaded.js”.
The vulnerability itself is in the unsanitized variable “TheName”, which should end up embarrassing developers at MySpace, especially after that whole Samy fiasco. They shut down the MySpace site to fix unsanitized variable issues, and I guess passed right along on that one?
As for the usage of a malicious Flash file in the XSS worms propagation was actually a very interesting spreading idea. Since Flash, and other objects are embeddable and accepted on MySpace profiles — I guess the developers at MySpace did not think about ActionScript being used as an attack vector. (Xavier)
Funny, I was just talking about this a work last week — about the previous “Samy” ordeal. Kinda ironic that it should spring up again at about the same time.
Related Posts:
I have been reading some sites that say my worm was unsuccesful and if you had not noticed was just a retweaked version of the samy worm. The worm was not far by unsuccesful. It changed 38,000+ users names. The name change number is not proportional to those infected in fact I had been letting them worm spread for 2 days so that it would have time to seed and have more success while seeding it would just like samy add me as a friend. So I could keep track of how many infectants. When I changed the payload from friend adder to name changer. I had already amassed 460,000 friends. I then reuploaded the .js file to change the payload and it was now a name changer. The amount 460,000 does not represent those succesfully infected. I tested this on a mac and the macs browser safari hung and I had to force quit. In fact for some reason it only infected some. Regardless I am guessing well over 100,000 people were infected. Sure it is only a guess. But its more than likely accurate. I apologize for my bad spelling. I must go Christmas shopping soon ^^. Have a Merry Christmas.
this is a pathetic excuse for a worm and this guy was most likely one of those AOL/IRC script kiddies when younger.. Ill bet you were programming punters. get some skill