Worm uses QuickTime to spread on MySpace
update A malicious video on MySpace.com pages changes people's profiles when played, embedding itself and adding links to fraudulent Web sites, experts have warned. — The video is a rigged QuickTime file that exploits a MySpace vulnerability …
Context & Ripple Effects
MySpace's scale has made it a repeated target rather than an occasional one: in July 2006, a hacked banner ad served spyware to roughly a million visitors, showing that anything third-party rendered onto a profile page is attack surface. The new twist here is that the payload is not bought or injected through the ad system — it is an ordinary-looking QuickTime video uploaded by the attacker, which rewrites the viewer's own profile once played.
That matters because it turns every viewer into a distributor. The confirmed mechanics — profile alteration, self-embedding, and links out to fraudulent Web sites — make this a profile-to-profile worm riding user-generated content, not a one-shot defacement.
First-order effects
- Users who play the rigged QuickTime file have their profiles rewritten without consent, seeding the worm further and pointing their friends at fraudulent Web sites.
- MySpace is under immediate pressure to close the underlying vulnerability and strip malicious embeds from member pages, since its open embedding model is the delivery mechanism.
Second-order effects
- The incident forces social networks and the sites hosting embeddable media to treat uploaded video as untrusted input, pushing sanitization of media metadata and player behavior up the priority list.
- Advertisers and labels using rich media on MySpace face brand-safety risk by association, since viewers cannot easily distinguish legitimate embeds from rigged ones.
Third-order effects
- If the pattern holds, worm propagation migrates from email attachments toward social-graph distribution, where each infected profile is a trusted sender and containment depends on platform-side filtering rather than user caution.
- Media players like QuickTime become part of the Web attack surface, raising the stakes for how desktop software handles files fetched by social sites.
The trend: Social-network attacks are shifting from purchased ad placements to self-propagating payloads hidden inside user-uploaded media, making the embed pipeline itself the battleground.