[WEB SECURITY] MySpace "private" profiles unmasked

[Jeremiah Grossman <jeremiah@xxxxxxxxxxxxxxx>]

From the scant technical details, it appears to be an Insufficient  
Authorization using a basic URL number manipulation.


Teen data on Myspace compromised
http://www.theregister.co.uk/2006/08/30/myspace_teen_data_hacked/


I tracked back the digg.com references to here:


Myspace closes GIANT SECURITY hole
http://grownupgeek.blogspot.com/2006/08/myspace-closes-giant-security- 
hole.html

Security hole exposes private Myspace profile information
http://grownupgeek.com/view-private-comments


Regards,


Jeremiah Grossman
Chief Technology Officer
WhiteHat Security, Inc.
http://www.whitehatsec.com/



----------------------------------------------------------------------------
The Web Security Mailing List: 
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]