Date: Sat, 12 May 2007 11:04:32 -0400
From: "Vlad Hackula" <vladhackula@...il.com>
To: ShadowGamers <shadowgamers@...il.com>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Myspace hackers - Myspace lack of security

so it doesn't interest you that the hacker is performing admin functions
with code?  you are a lamer. that is what is interesting about this article.

On 5/12/07, ShadowGamers <shadowgamers@...il.com> wrote:
>
> WAAAAAAAAAAAAAAAAAAH, SOMEONE IS FLOODING MY FAVOURITE MYSPACE GROUP,
> WAAAAAAAAAAAAAAAH
>
>  On 12/05/07, Vlad Hackula < vladhackula@...il.com> wrote:
>
> >  oops, sorry for making it a response to gadi's posting.  i'm not awake
> > yet. duh
> >
> > http://myspaceinfosec.blogspot.com/
> >
> > Myspace fails to protect it's community from malicious hackers.
> >
> > As of May 12th, 2007, Myspace has 176,968,475 users in it's community
> > and it is growing fast. To put this number in perspective, the US Census
> > Bureau estimates there are currently 301,821,743 US citizens. The current
> > number of users is well over half of the population of the entire United
> > States. With this being said you would think that a company that has this
> > many user's in it's community would pay closer attention to security.
> >
> > Myspace provides a lot of services to it's user community and one of the
> > most popular is Myspace Groups. There are thousands of groups covering a
> > wide range of themes and let people collaborate on anything from beenie
> > babies to the arts. One group in particular, The World Artist Network (WAN)
> > http://groups.myspace.com/wan is the largest single group on Myspace and
> > has over 200,000 members worldwide. This group serves the Art community and
> > gives artists a place to go to collaborate with other artists. You can
> > almost classify this as a somewhat educational experience because people
> > will post their art there to get feedback from other artists and art
> > enthusiasts. This helps to build an artists skill set and helps them to
> > become a successful artist.
> >
> > However, since around February of this year, a hacker has been targeting
> > groups by exploiting Myspace's lack of security controls and causing DoS
> > (Denial of Service) attacks by flooding the groups with thousands of
> > postings making it nearly impossible to find the content posted by the
> > members. The World Artist Network is currently under attack by this
> > relentless hacker. After the attack started several days ago, the group has
> > been brought to it's knees. The way the topics are displayed has been
> > damaged by the attack and now the first 27 pages are blank. Several members
> > now cannot even post to the group, myself included. It appears the hacker
> > may be using code to perform various administrative functions which includes
> > banning members as well as pinning/unpinning topics (a flag that lets the
> > moderator anchor various topics to the top of the list). The hacker also
> > seems to be able to bypass banning functions. Even when he is banned he is
> > still able to post. He has created other accounts as well and after he is
> > finally banned he will simply use a new profile to begin the attack all over
> > again.
> >
> > Using a special technique I was able to get one of the first attacker's
> > IP addresses which shows the attacker was using an IP address from the
> > Internet Service Provider intrstar.net (InterStar Communications, Inc)
> > who is located in Clinton, NC. I sent a complaint to Inter Star and included
> > all the relevant information yet they never responded to the incident.
> > During this attack the hacker posted hundreds of pages of extremely
> > disgusting and vial SCAT porn images. SCAT is pornography that deals with
> > feces. Myspace was also alerted to this activity and there was no response.
> >
> > Although Myspace is 'free' to users I still think it is their obligation
> > to at least make a best effort attempt at protecting it's users. One of the
> > biggest things they can do is have a better response to security incidents.
> > Another would be to track down these people and prosecute them. And by
> > putting simple controls in place and preventing these types of attacks from
> > happening in the first place. One such method could be using software called
> > CAPTCHA which forces a human to enter text displayed in an image file. Say
> > after 10 posts within 5 minutes force the user to enter the text. This would
> > make it literally impossible for the attacker to flood an entire group and
> > thereby making it much less desirable for them to perform future attacks.
> > This is such a simple thing to do it is bizarre to me that they haven't done
> > it yet.
> >
> > I can tell you one thing I truly believe, Myspace's banner ads, where
> > their main revenue comes from, will always be working very smoothly. Just
> > don't forget, it is your Myspace community that are the ones that either
> > click or don't click on those ads. You need to protect those precious
> > resources.
> >
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
>
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists