Re: myspace hack

[Stephen de Vries <stephen () corsaire com>]

From his account of events it seems to be an excellent example of an  
XSS virus.  A paper on this concept was announced on this list just a  
few hours ago: http://www.bindshell.net/papers/xssv.html

The difference in the myspace case was that the payload of the virus  
was a Cross Site Request Forgery attack (also known as a session  
riding attack) that inserted his profile into the victims' favourites.


On 13 Oct 2005, at 18:28, Akash wrote:

> Does anyone has more technical details about how 1 million accounts
> got hacked in about 24 hours.
>
> This is the supposed confession of the hacker
> http://fast.info/myspace/
>
> I currently studying for CEH and just finished reading about XSS. So
> this is of special interest.
>
> regards
>
> akash