Worried about protecting your privacy while viewing people's Myspace profiles? If that person has a Myspace Tracker on their profile they can see all kinds of information about you!
Grown Up Geek member Metasyntactic has put together a page explaining how you can easily block Myspace trackers from collecting any data about you.
See Metasyntactic's page here: How to block Myspace Trackers
Well, it's on Digg.com so it MUST be true.
Over the last week or so we've had a little tit-for-tat going on between us and Joyboner.com regarding some content issues.
The problem began a week or so ago when a Grown Up Geek.com member posted some allegedly 'stolen' content at our site - resulting in a Cease and Desist'ish type complaint, and several other headaches. Caught up in the middle were some new codes that allow anyone to view information stored on private Myspace profiles.
Well, the Joyboner and us have come to an agreement, we've kissed and made up (figuratively of course) and the most important part, we've posted the Myspace codes.
All is now back in balance in the world of the Grown Up Geek..
On August 18 2006 a post was made at our website explaining how easy it was to access comments and photos on Myspace profiles set to "private". This vulnerability had apparently been known by the "Myspace underground" for some time, but had not been addressed by the Myspace security people. On August 26, this vulnerability was made public on Digg.com and suddenly the whole world new about it. Once in the spotlight, Myspace band-aided this hole in less than 24 hours (See This Post)
From the moment this backdoor was closed, there were posts on Digg.com and our main website hinting that there were still vulnerabilities on Myspace that would allow anyone to view photos on profiles set to 'private'. I was ready to blab these new vulnerabilities to the world, but I had not actually seen one in action yet.
Well.. Today yet another member of GrownUpGeek.com posted how to use a modified URL that will allow ANYBODY to view pictures on profiles set to private. I've seen it in action and can vouch that it's real. This second vulnerability is very similar to the one published on August 18, but this one only works for private photos (sorry, doesn't work for private comments).
So let this be an open letter to the Myspace security gurus:
I'm not going to publish the vulnerability here... YET (gotta give those Myspace guys a chance to fix it.. right?) But it's out there, and it's in use - and if history serves as a guide, this vulnerability may not be fixed until it hits Digg.com or CNN (but I bet you won't hear about it on FOX news..)
Mr. Murdoch, if you need help finding the vulnerability, just post a comment here or send me an email. :-)
UPDATE: 8/30/06
1) Unless you're Rupert Murdoch (or one of his minions) I'm not going to email you the code! Based on postings i've seen by members at the forums area of our website, it IS out there at other sites.
2) in response to this comment:
Why does your webpage have a link saying "New private profile hole published" linking only to this blog post? You have NOT published it...yet. Quite misleading.
The code WAS published on our main website by a member - We then UNpublished the code to give Myspace a chance to fix it (we are trying to be responsible netizens). Based on what I've read in our forums the code IS published at other websites.. The reason for the link to the blog was so everyone could read that the exploit is out there. Upon reflection, we will update the text in the link to avoid further confusion.
UPDATE: 8/31/06
Well, it looks like Myspace has closed this particular security hole sometime in the last day or two. This latest hole, which worked using a variation of "http://mail.myspace.com....." would allow photos on private profiles to be viewed in Firefox after repeatedly refreshing the page.
So that's it boys and girls, it looks like the fun is over! ..until the next vulnerability....
¶ 8:35 PM 44 Comments
Late in the evening hours of Saturday August 26, 2006 a story was posted on DIGG.COM about a very simple "hack" (more like an easy backdoor)
that would allow anyone to view comments and photos on a private Myspace page. Private pages, you may recall is the setting for all children under the age of 16 on Myspace. This was part of the "enhanced security" that Myspace implemented a few months back (previously, only children 14 and under had mandatory 'private' profiles).The only problem is that (based on user reports), for the last few months anyone has been able to access the comments and pictures of these so-called private profiles by exploiting this glitch.. Now, in Myspace's defense, maybe they weren't aware of this little secret - but c'mon.. it's been floating out there in cyberspace for months - I thought these Myspace security guys were good?!
So it looks like now that this backdoor was on DIGG.COM, Myspace has fixed this security hole - Kudos to Myspace for that. But lets not forget that this little 'bug' has been in the wild since at least April 2006, based on reports from people who say they've been using it since then.
All you parents worried about your kids, all you kids worried about your "private" posts and pics.. NOW you have something to worry about: who's been lurking at your 'private' Myspace stuff...
UPDATE 8/29/06:
A hole STILL exists, allowing ANYONE to view photos on profiles set to private. See THIS POST
Labels: Myspace
¶ 3:43 PM 7 Comments