Fighting malware and spam

MySpace data phished and leaked

56,000 login details exposed by phishing researchers.

A large quantity of MySpace user login and password data has been posted online, according to some reports by researchers into phishing techniques available on the social site.

The data was apparently gathered via a spoofed login page linked to from the site, and over 56,000 sets of details made publicly available online. At least some of the details entered make it clear that some visitors spotted the phish and posted fake and even abusive login data. Various phishing filters, including Firefox, were quickly updated to warn users visting the site.

A link to the listing was later posted to the Full Disclosure security forum, claiming the 56,000 figure was still rising. Although the site hosting both the phish and the data has since been taken down, it is thought the data was exposed to numerous visitors and is still available elsewhere on the web.

The original Full Disclosure posting is here, with some commentary from bloggers at SecuritTeam here and ComputerDefense.org here.

19 January 2007

Tags:    del.icio.us   digg this

Quick Links

Poll

virusbtn: RT @emailsecmatters: The typical spam message has sources as diverse as the spam lunch meat: http://ht.ly/2yucd
2 hours ago

virusbtn: Can anyone write a rap about our RAP tests (http://bit.ly/255ySQ) and submit it to the Symantec competition http://bit.ly/bOJg8r
6 hours ago

Virus Bulletin

• VB100 – Windows Vista Business Edition Service Pack 2
• Apple pie order?
• Anti-unpacker tricks – part eleven
• Advanced exploit framework lab set-up
• HTML structure-based proactive phishing detection
• What’s the deal with sender authentication? Part 3