MySpace
Security companies have already found vulnerabilities in MySpace

Month-of-bugs project targets MySpace

Tongue-in-cheek campaign finds flaws in social networking site

Shaun Nichols in California

Social networking site MySpace has become the latest company targeted by a 'month of bugs' project. 

The project, run by security researchers using the aliases 'Mondo Armando' and 'Müstachio', is officially known as Month of MySpace Bugs, Yuss!, or Momby for short. 

Advertisement

Previous 'month of bugs' projects have targeted everything from Mac OS X to PHP

As the name suggests, the projects aim to disclose a new vulnerability every day for a month. This latest effort, however, takes as many swipes at other month of bugs projects as the target itself.

"Months of Bugs are annoying, so rather than suffering through another, we figured it'd be better to just create our own where we could at least direct the content a little," said 'Mondo Armando' in the 'official announcement' of the project.

The pair decided on targeting MySpace for a variety or reasons, including its substantial user base.

"Months of Bugs are whiny, attention-seeking ploys for acceptance. MySpace's design use is to enable whiny, attention-seeking ploys for acceptance," said the researchers.

The project will take place during April and will be run from a special LiveJournal blog, or at an alternative site should the account be revoked by LiveJournal owner Six Apart.

"Most of what we intend to publish are silly XSS/misleading CSS style bugs that MySpace users may actually be able to use for a little while, and that involve only MySpace.com stuff," wrote Armando.

The pair are also asking fellow researchers to contribute their own bugs to Momby, requesting details and working proof-of-concept samples.

'Mondo Armando' and 'Müstachio' may not need to search too hard for content in the first few days. F-Secure and Sunbelt Software alerted users on Monday to a pair of security hazards currently doing the rounds on MySpace. 

One bug, according to F-Secure, uses a QuickTime vulnerability to steal user information. The other uses fake MySpace profile pages to trick users into downloading adware programs disguised as video plug-ins, according to Sunbelt.

  • Have your say
  • Send to a friend
  • Print
  • Digg
  • Reddit
  • Share

Tags:

Do you agree?

Further reading

Apple security

Apple releases 'highly critical' QuickTime patch

Fix available for remote-code exploit released New Year's Day

Apple security flaw

New Mac OS X exploit disclosed

Auto-launch feature in Safari leaves door open for attack

MySpace launches £1m movie competition

Cash prize for world's first user-generated feature film

Paris Hilton thrashed by MySpace

'MySpace' continues to dominate online searches, but Hilton coming from behind

Related whitepapers

Related jobs

Most watched

eu flag

V3.co.uk weekly debrief, 6 Nov 09

This week, Europe decides what to do with illegal file sharers

Intel unveils its micro server platform

Small-enclosure systems take aim at hosting market

Analysis and Reports

Remote access - Three steps to getting connected

3.4 million UK professionals now work from home – is your company equipped?

Cost benefits of a global collaboration network

This white paper is a must read for organisations looking for evidence of the bottom-line benefits of high-definition video and voice communications

Poll

Impact of Information Overload poll

Impact of Information Overload poll

What is the biggest problem your firm faces as a result of the data explosion?

View poll results

Advertisement

White paper library

Keep up to date with the latest products, services and technologies from the world's leading IT companies; IThound.com brings you over 6,000 white papers, case studies and analyst reports.

Advertisement

Newsletter signup

Sign up for our range of FREE newsletters:

Existing User

Newsletter user login:

Enter email address to edit your newsletter preferences

Job of the week

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Hiring now on ComputingCareers:

Related IT jobs

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Advertisement

Spotlight

Alcatel-Lucent logo

Summit: Networks swamped by information overload

Alcatel-Lucent's Neal Tilley talks about how enterprises and carriers can...

EU flag

Breach notification laws get green light

Privacy rights strengthened in Europe

Richard Thomas

Summit: Richard Thomas advises on handling the data deluge

Former Information Commissioner speaks out on government databases and data...

oracle sun

War of words escalates between EU and Oracle

Commission comes out fighting after criticism from Oracle and Washington

Primary Navigation