MySpace attack uses background images not iframes

Researcher Roger Thompson has found a new way for Web 2.0 to be attacked.

Security researcher Roger Thompson has found a new way to link to malicious servers that doesn't involve iframes (inline frames). An attack in June used cross-site scripting to place malicious iframes on legitimate Web sites. Iframes are used by Web designers to open additional windows (often hosted on other sites) within a main Web page; iframes can also be used by criminal hackers to redirect browsers to malicious-code sites.

"The interesting thing about this is that rather than using an iframe for an automatic embed, as they usually do, they've added some sort of image background href, with a large size...8000 by 1000 pixels, with the effect that a click that slightly *misses* a control or link on the page, ends up going to the exploit site," Thompson wrote on his blog. In particular, he found this trick used on the Alicia Keys MySpace.com page.

"The fact that this site is media-rich, with lots of sound and videos means that the FakeCodec trick will be much more effective. The click-er is probably expecting to see a vid, or hear a song, and is quite likely to think he genuinely needs to install something extra."

Thompson notes that the HTML code links to a site in China that is not indexed on Google or Yahoo. When CNET News.com tried the URL mid-afternoon on Thursday, a message said the URL was down for maintenance.

Thompson has posted a YouTube video of the attack here.

About the author

    As CNET's former resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security.

     

    Join the discussion

    Conversation powered by Livefyre

    Show Comments Hide Comments
    Latest Galleries from CNET
    Bento boxes and gear for hungry geeks (pictures)
    The best tech products of 2014
    Does this Wi-Fi-enabled doorbell Ring true? (pictures)
    Seven tips for securing your Facebook account
    The best 3D-printing projects of 2014 (pictures)
    15 crazy old phones from a Korean museum (pictures)