One clever MySpace user looking to expand his buddy list recently figured out how to force others to become his friend, and ended up creating the first self-propagating cross-site scripting (XSS) worm. In less than 24 hours, "Samy" had amassed over 1 million friends on the popular online community.

MySpace has gotten hit with the first XSS worm to target social networking sites. Here is some analysis from Acidus:

Basically the worm was XSS embedded in someone’s profile on MySpace. When someone would view the profile, they would execute the Javascript in their own browser. The payload of the XSS was Ajax which would make GET and POST requests to MySpace, adding the XSS Payload to that user’s profile. This spreads the worm!

As with most worms using a new attack vector, this was harmless, adding the message “samy is my hero” to each infected profile along with the XSS payload.

Acidus has also posted the source code of the XSS Payload, and says he plans to post a more detailed analysis later.

BetaNews | Cross-Site Scripting Worm Hits MySpace