The Washington Post blog have the story that adverts which recently appeared on popular social networking site MySpace were using a serious exploit recently found in Microsoft Windows to infect target machines with spyware.
The advert used the recently found security flaw in Windows’ handling of Windows Meta File (WMF) images which could allow a malicious WMF image to run any code whatsoever on the target system. One of the worst things about this vulnerability was that it was effective regardless of the user’s browser, as the flaw occured within Windows’ graphocs processing software itself and wasn’t limited to Internet Explorer, for example. The flaw sparked a lot of heated debate about whether it was an intentional backdoor introduced by Microsoft, but no evidence was ever conclusive.
Microsoft had released a patch for the flaw by December 2005, but anyone without the patch could well be infected with the malware if they visited MySpace recently. The spyware (PuritScan/Clickspring), if installed, bombards the user with pop-up advertisements and is a privacy risk.
You can see whether you are vulnerable to this type of attack using this tool. Users of Windows NT4, 2000, XP and Server 2003 (but not Windows 95, 98 or Me) are vulnerable if they’re not patched up.
This is really irresponsible behaviour by MySpace and their advertisers. MySpace should be fully aware of who is advertising on their site and they should have strict policies in place about what things their advertisers can do more than just static banner ads. Especially when you consider that a large proportion of MySpace’s visitors are teenagers who probably don’t actually own themselves the computer they use for browsing, this is ridiculously irresponsible behaviour.
There should be some kind of code of practice in place for web advertisers, or else we’ll inevitably see more attacks like this as more vulnerabilities are discovered.
