MySpace users who expressed an interest in patio furniture got more than
they bargained for if they clicked on an ad for DeckOutYourDeck
Michael La Pilla, an analyst for VeriSign iDefense, was searching MySpace on
July 16 when he discovered that a patio furniture ad prompted a file called
exp.wmf.
If installed, up to five adware programs could have landed on the users'
computers. La Pilla contacted MySpace but the company's defense team had
already taken the ad down and was working to find its source.
Any user that was browsing with Internet Explorer and had not installed the
latest Microsoft patches was vulnerable to this attack. In January, Microsoft
released a patch that prevents WMF (Windows Metafile) files, so users that had
installed the patch were safe. Browsers using Firefox version 1.5 or later are
also protected from WMF files.
iDefense estimates that the ad was served to MySpace, Webshots, and possibly
Facebook, installing the malware on 1.07 million computers.
MySpace executives were not available for comment, but Hemanshu Nigam, chief
security officer for MySpace, issued the following statement: