Xanga Website XSS Worm, and IM Worm Using the WMF Attack

It looks like another social gathering site, Xanga, has been hit by an XSS worm. Xanga is a blogging site popular with middle school kids, think of it as LiveJournal for the younger masses. From: Xanga Hit By Script Worm from the always great SecuriTeam blog:

The worm consists of a simple HTML/script combination, and is highly primitive in nature. The worm propagates by using the XMLHTTP interface in some browsers to create worm-infected posts on the xanga weblogs of users who visit an infected site while signed in. This approach blurs the line between worm and old-style file infecting viruses. I’ll refer to it as a worm for clarity, since most of the literature on the recent MySpace attack uses the same term. Of particular note is that the worm is ‘dumb’ — it will repeatedly repost itself to previously-infected sites. The attack is extremely noisy, with each post carrying the malware’s obnoxious message.

Aside from the fact that such immature and badly-written messages as the one dropped by the worm would already stand out on most xanga blogs (that I care to read, anyway), the incessant reposting as the worm spread more than likely caused serious clogging. As a result, this worm’s life was extremely short. It is already over as you’re reading this analysis.

It appears upon further research that this worm was a variant of the similar Exodus worm that went quietly and unnoticed on December 19th. It was only in researching this outbreak that I saw the reports of Exodus. It appears that neither worm was written by a very skilled individual, as both strains are easily uprooted, browser-specific, badly-structured, trivially-decoded, and unnecessarily bloated. The worm is technically unimpressive (particularly vis-a-vis Exodus) and is a feat on par with the scores of VBSWG tweaks and edits following the infamous “Kournikova” worm outbreak of 2001.

In other news, I haven't commented on the WMF thing this week, but it looks like someone has gone and mashed up the IM worm space with an infected link via the normal IM link-spamming technique. This one is detected as an SDBot variant and appears to use the Kelvir IM-worm codebase, and affects the MSN network. You can find some analysis on the Kaspersky Lab Weblog: More on WMF exploitation. Both the F-Secure blog and the Kaspersky weblog have had great writeups, and so has the MoMusings blog, which has a concise, clear and accurate description of the situation.