Another Worm, This Time on Myspace

Dietrich Kappe, Wednesday, July 19, 2006 @ 9:00 am

Over at Simple Thoughts, they disect a Flash/AJAX worm that has been laying waste to MySpace.

The unnamed worm isn't malicious but the Shockwave Flash (.swf) file containing the payload embeds JavaScript into the profile of any MySpace user who views the .swf file. This can easily replicate Samy is my friend worm without breaking a sweat.

This javascript code would then be interpreted by any user who visited the site, allowing sensitive data to be stolen, such as a hash value required to carry out operations as a user, and performing operations on behalf of that users (without consent obviously). Currently, that access is being used only to spread the JavaScript code to other profiles on the popular social network site.

They go on to describe how this worm, if malicious, could be used to compromise MySpace security and a user's Office applications. Defanged (commented) Javascript is included.

It's fair to say that this is just the beginning of these worms/viruses. The fundamental security situation in the browser hasn't really changed -- the same sort of mischief that could be done in 2004 or 2002 can be done today. So what has changed? At least three things as I see it.

1. Web 2.0 sites now persist Javascript and other executable online artifacts. We all know that a Word or Excel file from a buddy must be treated with caution. We have no such expectations when it comes to their MySpace profiles or plain text emails. It's this persistence of executable artifacts that turns a malware into a worm, flowing from one user to another with Web 2.0 haste.
2. Our guard is down. If in 1989 anyone outside of a University campus had found a piece of software contacting all manner of remote computers and transfering data, they would have shut it down immediately. Now we don't even blink when our browser secretly accesses other web sites via XMLHttpRequest. How to identify malicious activity when it doesn't look all that different from normal AJAX activity? That's sort of like the old Mac virus detection tools complaining about a compiler because it tried to modify a resource fork of a file. It's about context.
3. Although Flash, XMLHttpRequest, browser extensions and rich Web 2.0 apps haven't really changed the basic security picture for browsers, in combination they can lead to unforseen vulnerabilities. This latest worm simply demonstrates how inching the security door open in Flash and Web 2.0 at the same time can lead to trouble. When you design webapps for security, don't assume a pristine client environment. Assume the worst and design accordingly.

I don't have any solutions to these problems other than "don't use flash or AJAX." I'd be interested to hear your thoughts on this topic. Comment away.

agile ajax

Comments: 1 so far

• Leave a comment
• Comment feed for this post
• TrackBack URL

1. 

   “Now we don’t even blink when our browser secretly accesses other web sites via XMLHttpRequest”

   In fact, XMLHTTPRequest is restricted to the current domain.

   Comment by Stickman, Friday, July 21, 2006 @ 3:33 am

Leave a comment