Walaika K. Haskins, newsfactor.com 1 hour, 49 minutes ago
A banner advertisement posted on the MySpace Web site may have infected more than one million users with adware, according to security firm iDefense. The advertisement was included in user profiles on MySpace and could have been operating for about one week.
The deckoutyourdeck.com advertisement exploited a flaw in the way Microsoft's Internet Explorer (IE) browser handles Windows Metafile (WMF) image files. Users running unpatched versions of IE would never have realized that the banner ad had silently installed programs that generate pop-up ads on their system.
"This is a criminal act," said Hemanshu Nigam, chief security office at MySpace, in a statement to the Washington Post. "This ad is being delivered by ad networks who distribute these ads to over a thousand sites across the Internet in addition to ours. We are working to have these ad networks remove this ad so that they do not appear on our site."
Banner Patch
An iDefense spyware analyst, Michael La Pilla, told the Washington Post, that he discovered the attack on Sunday as he browsed throught the MySpace site. When he came across a page with the offending ad, he received a message from his browser asking him if he wanted to open a file named exp.wmf.
After a brief investigation, La Pilla found out that the spyware installation program contacted a Russian language Web server in Turkey that tracks how many PCs on which the program has been installed. The tally had climbed to 1.07 million machines, though La Pilla said the seven Internet addresses contacted by the downloader seem to be inactive now.
According to La Pilla, he also found the ad attempting to infect users of Webshots.com, a photo-sharing site. Though he cannot pinpoint the date the ads began sending out their spyware, but it is believed that it coincided with the occurrence on MySpace on July 12.
The WMF vulnerability was originally discovered last December after hackers exploited the flaw using a specially created WMF image distributed via e-mail, instant message links and Web sites. When users opened the image, the hacker could take control of the infected PC. Microsoft released a patch for the bug back in January, but many users did not install the patch.
Users with unpatched systems can become infected simply by visiting a Web page with the deckoutyourdeck.com ad. And unlike La Pilla's case , the exp.wmf Trojan horse program will upload automatically without the warning prompt.
Once installed, PCs running the Trojan horse will contact multiple Web sites and download a slew of unwanted programs such as PurityScan advertising software. PurityScan is an adware program that can cause pop-up windows containing unsolicited ads to appear. The application also keeps track of the user's online activity.
Two Wrongs
Rob Ayoub, a Frost & Sullivan analyst, said two facts stand out to him regarding the MySpace infections. First, that home users are clearly not as educated about the need to make sure they have up-to-date patches and other security fixes installed. Second, that MySpace needs to have a better security system to identify dangers hidden in the ads they serve.
If you are a legitimate business with a legitimate Web site hosting banner ads, there is responsibility on the business side to keep their service clean, Ayoub said. They control the banner ads, but apparently were not checking them. There is some sort of control that is lacking on their end if they will post a banner ad essentially containing spyware.
"MySpace has some problems and this is a real blunder on their part," Ayoub said. "I can't believe any business would not scan or take more caution with banner ads posted on their sites. Ad network or not, there is no excuse for them not having a checking system."
One million people is a very large number, Ayoub said. It demonstrates that the technology industry, and security firms and software makers in particular, may not have done enough to impress upon home users the importance of downloading patches. PCs that have not been updated exponentially increase problems with viruses, spyware and adware.
"MySpace should have been checking and users should have been patching," Ayoub said. "And because of that combination you have a million downloads."
Some PC users have said their reluctance to install patches and updates centers around the fear that changes the software makes will negatively impact their computers. However, Ayoub pointed out, that unwanted changes or problems with updates is relatively rare these days.
"There was a time when you had to watch and be very careful with your patches," Ayoub said. "And some of the big ones are a problem, but there haven't been big problems with patches for ages."
Home users, Ayoub predicted, will not start to take security seriously until Internet service providers start to make antivirus and antispyware software compulsory. That may or may not be the best solution, he said, but incidents like this are a "perfect storm" for users not protecting themselves.
"That's extremely dangerous," Ayoub said. "Maybe what we need to do is run public service announcements."
MySpace is "strongly" urging all Internet users to "follow basic Internet security practices such as running the latest version of the Windows operating system, installing the latest security patches, and running the latest anti-spyware and anti-adware software."