Best Damn Tech Show, Period.

By now you may have heard about the MySpace worm. This one uses a Quicktime flaw to compromise a user’s profile and ultimately direct users to a page with Zango (formerly 180 Solutions) content and spyware.

Here’s a little more detail. As far as I can tell (from reading an article at blog.spywareguide.com and stories linked to from here), The worm starts with an infected profile and does the following:

• Runs through the friends of the profile submitting a comment with a quicktime movie on the friends page.
• When the friend goes to their myspace page, the movie uses javascript to overlay a fake navigation bar over the users existing one (which looks pretty obvious if you don’t use the default look and feel).
• On this fake overlay is a login button. When you click here, it takes you to a spoof site where a user is prompted to log in. If the user falls for this and logs in to the spoof site, they wind up sending their MySpace login information to the bad guys.
• The bad guys use your profile to send a bunch of spam out to other victims and go through you friends as the cycle will repeat itself.

MySpace.com continues to allow QuickTime movies so the problem will likely persist. This then makes it also the responsibilty of the MySpace.com community. So as always, when on MySpace, always do the following:

• Pay attention to the url when you log in. (look for http://login.myspace.com in the address bar)
• If you see an IP address (em. 66.554.88.104) in the address on the myspace log in page, run and/or panic. Just DO NOT LOGIN THERE.
• Pay attention to the status bar on your browser when you hover over links (it’s the bar accross the botton of the browser by default). If the link isn’t to somewhere in the myspace domain, then be aware that it shouldn’t ask you for MySpace login information. (this doesn’t always help, but look anyway.)
• Get a different theme/skin for you myspace profile, this will help to make it obvious that your profile has been tampered with.
• Don’t be a sucker. No women, that you never met before, are sending you suggestive movies hoping you will contact them for a relationship. Even if you’re a very smart/good looking/likable/desirable person (easier said than done; for some harder than others).

If you are not familiar with Zango (or 180 Solutions) all you really need to know is that they are a bunch of douche bags and have done (and despite claiming otherwise) still do some unscrupulous things. These guys are one of the companies polluting the net with spyware, adware, and other baddies while waving the “Nobody said we couldn’t” banner. They are shit. Think of them as you would a herpes salesman.

This entry was posted on Wednesday, December 6th, 2006 at 3:09 pm and is filed under tech show, news, iris on the virus. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.