Worm exploits Quicktime to bait MySpace users

Stan Beer
Wednesday, 06 December 2006 04:56

Your IT - Home IT

MySpace, which has had its share of controversy this year, has suffered a serious worm attack which exploits the Javascript script code of the Apple QuickTime player to lure users into a phishing trap.

The worm causes users to click on faked links on a MySpace profile which directs them to a phishing site which attempts to get users to enter their MySpace login details.

If they fall into the trap, users download spyware and a malicious embedded Quicktime video.

Other MySpace users can then get infected simply by visiting an infected user's profile.

Javascript code and its variants such as AJAX, which execute applications on client computers, is an increasingly important part of the Web 2.0 services revolution, but has been criticised by many security experts as a target for attackers to worm their way into unsuspecting target computers.

MySpace has reportedly asked Apple to fix the Javascript vulnerability in QuickTime.