Samy opens new front in worm war

Samy opens new front in worm war

Summary: Security experts fear would-be attackers will copy the worm, which exploits an unaddressed scripting flaw.

SHARE:
The newly discovered Samy worm is one of the first to exploit a cross-site scripting vulnerability, a technique security experts fear could be used to open a new front in attacks.

Samy is a self-propagating worm that appears to have been written by a member of MySpace.com, a community site dedicated to helping friends stay in touch and share pictures. By exploiting vulnerabilities in the MySpace.com site, the worm added a million users to the author's "friends" list.

Although the worm is no threat to other Web sites, security experts say the new self-propagating cross-site scripting (XSS) worm will likely be copied by other writers of malicious software.

Adam Biviano, senior systems engineer at Trend Micro Australia and New Zealand, explained that the MySpace.com user--called Samy--had created a "malicious" profile by taking advantage of a flaw in the Web site's design. The profile, when viewed, automatically activated code to add the visitor to Samy's "friends" list.

Additionally, the malicious code would be copied into the victim's profile, so that when that person's profile was viewed, the infection spread.

"The infection stays on the Web site and almost creates a denial-of-service attack, because there is an exponential explosion of entries in your friends list that will eventually consume the resources of the infrastructure," Biviano said.

Scott Chasin, chief technology officer at MX Logic, said that although cross-site scripting vulnerabilities have been recognized for some time, this is the first worm he has come across that was designed to exploit one.

"This attack highlights the opportunity for a self-propagating worm to take advantage of XSS technologies...The vulnerability leveraged by Samy allows code to be injected into Web sites with the aim of being parsed and/or executed by Web browsers or e-mail clients," he said.

Chasin said that worms taking advantage of cross-site scripting flaw will become more common as browsers and e-mail applications evolve.

"The XSS worm threat is only becoming more relevant as the sophistication of browsers and the underlying technologies being rendered by them continue to saturate the Internet through blogs and e-mail applications," he said.

"They could have a significant impact for Internet continuity…including distributed denial of service attacks, spam attacks and dissemination of browser exploits," Chasin added.

Trend Micro's Biviano said administrators should take note, because this creates yet another method of attack.

"It is definitely something to consider is you are an application designer or a Webmaster. It is another security issue you need to contend with," he said. "You don't want the ability for a loop like this to be created that will end up causing a denial of service on your Web site."

Munir Kotadia of ZDNet Australia reported from Sydney.

Topics: Malware, Browser, Security, New Zealand

Munir Kotadia

About Munir Kotadia

Munir first became involved with online publishing in 1998 when he joined ZDNet UK and later moved into print publishing as Chief Reporter for IT Week, part of ZDNet UK, a weekly trade newspaper targeted at Enterprise IT managers. He later moved back into online publishing as Senior News Reporter for ZDNet UK.

Munir was recognised as Australia's Best Technology Columnist at the 5th Annual Sun Microsystems IT Journalism Awards 2007. In the previous year he was named Best News Journalist at the Consensus IT Writers Awards.

He no longer uses his Commodore 64.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

0 comments
Log in or register to start the discussion