Worm spreading on MySpace network detected

Bangalore, Dec 2 (UNI) Websense(r) Security Labs has confirmed the existence of a worm spreading on the MySpace network.

This worm is exploiting the Javascript support within Apple's embedded QuickTime player. This is used in conjunction with a MySpace vulnerability that was announced two weeks ago.

The vulnerabilities are being used to replace the legitimate links on the user's MySpace profilewith links to a phishing site, accoridng to a Websense(r) security release.

It said once a user's MySpace profile was infected (by viewing a malicious embedded QuickTime video), that profile was modified in two ways. The links in the user's page were replaced with links to a phishing site, and a copy of the malicious QuickTime video was embedded into the user's site. Any other users who visit this newly-infected profile might have their own profile infected as well.

An infected profile could be identified by the presence of an empty QuickTime video or modified links in the MySpace header section, or both the release said.

Websense Security Labs discovers and investigates today's advanced internet threats and publishes its findings enabling organisations to best protect employee computing environments from increasingly sophisticated and dangerous internet threats.

UNI VK SKB1150