The folks at Websense have confirmed the existence of a worm that is spreading through MySpace.com. The worm is apparently exploiting the QuickTime player.
The vulnerabilities are being used to replace the legitimate links on the user’s MySpace profile with links to a phishing site.Once a user’s MySpace profile is infected (by viewing a malicious embedded QuickTime video), that profile is modified in two ways. The links in the user’s page are replaced with links to a phishing site, and a copy of the malicious QuickTime video is embedded into the user’s site. Any other users who visit this newly-infected profile may have their own profile infected as well.
An infected profile can be identified by the presence of an empty QuickTime video or modified links in the MySpace header section, or both.
For more on this and screen shots head over to Websense.
Tags: MySpace Worm, XSS, QuickTime Worm, Websense
