Web 2.0 Worms Make Their Appearance: MySpace

While we're all hunkered down over what may be the nest MS worm, the real news this week on the worm front is the appearance of a cross sit scripting worm that hit MySpace:

One clever MySpace user looking to expand his buddy list recently figured out how to force others to become his friend, and ended up creating the first self-propagating cross-site scripting (XSS) worm. In less than 24 hours, "Samy" had amassed over 1 million friends on the popular online community.

If you're curious, you can read the author's writeup and examine the JavaScript worm source. Cross site scripting vulnerabilities, which aren't going away, are described in this CERT advisory from 2000. And finally, Paul Bissex has a nice writeup about the worm on his site.