avatar
Security

Hackers Stay off MySpace


MySpace may be teeming with sexual predators, scammers, and married men pretending to be sweet 16-year-olds.

But there’s one less class of creep to worry about. Security experts said that cyber-criminals are showing little interest in attacking the web’s most popular social networking site.

Despite its uber-popularity among young Internet users, MySpace has been relatively low on the radar of hackers because it offers little financial gain, said experts.

“MySpace is not as attractive to criminals as, say, targeting PayPal or eBay, which is where 75 percent of the phishing attacks at the moment are directed,” said Graham Cluley, senior technology consultant with the security firm Sophos.

eBay

It’s not as if MySpace isn’t big enough to lure criminals. MySpace had about 46 million unique users in June, according to Nielsen//NetRatings. The site is owned by Rupert Murdoch’s News Corp., which bought the site in July 2005 when it acquired Intermix Media for $580 million (see Murdoch Buys Intermix: $580M).

Murdoch Buys Intermix: $580M

“In general we know that malware affects user audiences of a critical mass,” said Shane Coursen, senior technical consultant for Kaspersky Lab, another security firm. “The greater number of users there are, the greater the chance their operating system or application like MySpace is going to be attacked.”

Crime Does Not Pay

But attacking the site’s teen audience offers little monetary incentive to criminals, said experts.

“The users of MySpace are a certain audience, which is basically a young crowd,” said Mr. Coursen. “So all their users haven’t reached a level where when they are affected it makes a big financial impact across critical infrastructure.”

And that critical infrastructure or information is what online attackers are seeking these days. The main motive for virus and worm attacks has moved away in recent years from a pure desire for creating online mayhem.

Increasingly hackers have been launching targeted attacks to steal financial or personal information that can be sold or traded in the online underground markets.

Social networking sites like MySpace offer little potential for financial incentives. “At this point, attacking MySpace only pays off for spammers,” said Mr. Coursen. “But for hackers, there are other social networks that allow users to share professional contact information that could be more attractive.”

Kaspersky’s six-month analysis, said Mr. Coursen, has shown no increase in security-related threats on other social networking sites, however.

Malware for MySpace

That’s not to say MySpace hasn’t faced any malware. In October, the Samy worm attacked some users on the site by adding thousands of users to a victim’s “friends” list. There have also been profiles hosted on MySpace that contained malicious programs.

The damage caused by these attacks has been limited, however. “Most of this does not affect home users,” said Mr. Cluley. “It only affects a percentage of users who are on the MySpace site.”

Still, it may be too early for MySpace users to breathe easily. A virus or worm attack, if well executed, would undoubtedly cause widespread chaos on the site. Such an attack, said experts, is only a matter of time.

Hackers would not have to work hard to penetrate the security defenses of many MySpace users. A worm could simply be activated by a user viewing a message within the browser, or by visiting a site that contains the malicious code.

Contact the writer:PGanapati@RedHerring.com