MySpace data phished and leaked

56,000 login details exposed by phishing researchers.

A large quantity of MySpace user login and password data has been posted online, according to some reports by researchers into phishing techniques available on the social site.

The data was apparently gathered via a spoofed login page linked to from the site, and over 56,000 sets of details made publicly available online. At least some of the details entered make it clear that some visitors spotted the phish and posted fake and even abusive login data. Various phishing filters, including Firefox, were quickly updated to warn users visting the site.

A link to the listing was later posted to the Full Disclosure security forum, claiming the 56,000 figure was still rising. Although the site hosting both the phish and the data has since been taken down, it is thought the data was exposed to numerous visitors and is still available elsewhere on the web.

The original Full Disclosure posting is here, with some commentary from bloggers at SecuritTeam here and ComputerDefense.org here.

19 January 2007

Tags: del.icio.us digg this