MySpace Security Failures

In an article titled MySpace Bug Leaks ‘Private’ Teen Photos to Voyeurs (Jan 17 2008), Kevin Poulsen reported that the photographs of some MySpace users with private profiles could be accessed simply by putting the user’s account number into a specially constructed URL ¹. This only worked if the user has set their profile as private but not the photos themselves. The following day, Poulsen announced MySpace had quietly fixed the bug but added:

The bug had been around since at least October (Thanks to Rose for tipping me off), during which time it had been gleefully exploited by voyeurs, hackers, entrepreneurs and lechers; you can find pages and pages of public message board comments around the web in which posters are peeking in on 14 and 15-year-old girls and sharing what they find ².

Some of the posters in these message boards were self-described “pedos”, which he quotes in this article. It also quite troubling that some websites were created to make money off this bug.

REFERENCES

1. 1. Poulsen, Kevin. MySpace Bug Leaks ‘Private’ Teen Photos to Voyeurs, Wired.com, January 17 2007, Retrieved on January 28 2008.
2. 2. Poulsen, Kevin. MySpace Quietly Fixes Bug that Gave Voyeurs Access to Teens’ Private Photos, Wired.com, January 18 2007, Retrieved on January 28 2008.