First, I am responding, regarding a recent class assignment,and secondly, because I'm interested in the dialogue.

In response to MySpace being out of compliance, according to my understanding, there has to have been some legal ramification! Without reading the other replies, or knowing how this situation turned out, I sure hope that the participants didnot let it end here.

Finally, now that I've experienced this activity, I plan to be an avid user.

Francine

Hi, My nephew recently had some of these very same problems. He asked me if I would take a look at the HTML CSS scripting that he used for his profile layout and see if I could find out why the login screen was always opening. I have just in the last few months started learning to write these scripts. When I put the script in a web page design program that I have I found a very shot single line of script in to different locations in the layout script. These lines caused a false login screen to open if they were clicked on. As far as I was able to tell pretty much anything that you clicked on his MySpace profile would open the false login. I was able to remove the script, and his page works fine now. I have sent you an email regarding this because there are so many cases of it in the last couple of months. When you get the email it will give you a lot more detail. Meanwhile I am checking some of the providers of these profile layouts, trying to find where these lines could have been added. Maybe soon we can tell people what to look for in their profile layout that can help them. I do not think it would be a good idea to post them here and now. And I am sure you can understand why. I am really not even all that good at writing and understanding script yet. I still have a lot to learn. Fact is this was just pretty much good old fashion luck. If it had not happened to a relative I would have not had a need to look at another persons layout script. In the mean time you are all exactly right about a way of protecting yourself. When you point at a link look down in the lower left hand corner of you web browser and you can see where it is pointing. If do not know or understand where that is the do not click the link. Another thing if you see a bulletin posted from a friend that seems really strange. Like a porn site or very bad language, anything that you know that person would not post. Then leave it alone don’t open it at all. Until someone is able to find out how these are getting into profiles, if it is something that you do not understand then leave it alone. I look forward to hearing from you when you have a chance to read that email.
Terry L. White

While writing our book we helped a MySpace user whose account was frequently being hijacked to post bulletins that were advertisements for porn web sites. I worked with the user and investigated one of the instances, and the code implied that the hijacking of the user's account was related to the MySpace "Online Now" indicator.

I recommended that the user go to his "Account Settings" and "Privacy Settings" and select "Hide Online Now". Since he changed that setting, his account has never been hijacked to send porn bulletins.

Thanks for the advice. Yes they know they are being monitored. I have a MySpace to be able to monitor them and they have added me as their friend. Yes, Anne, I thought that was something like you described, phishing. I have told my nephew not to click on any ads. He said he does not but I know he does. He was living with me and now is back at home and his parent does not monitor him and will not make him change his password. So I am stuck. I just hate to see that on the bulletins and my daughter can see it too. Along with his twelve year old brother. Sad. I wish MySpace could stop this. I know they have been really trying to clean it up.

Here's the answer from MySpace: "There is an abuse situation occurring where users are getting phished, and then the phishers are selling the lists and/or posting affiliate bulletins through the victims’ accounts. You should advise the parent to have their child change their password." What MySpace means by "getting phished" is that users are tricked (by clicking on something and having a msg pop up saying "you need to log in to do/see this") into typing their screennames and passwords into forms that collect and either sell them to a third party or use them to take control of accounts or computers.
Anne
BlogSafety.com co-director

Talk to them about it first. Actually, firstly, do they know you are monitoring them?

Anyway, talk to them about it, about why they shouldn't be on whatever sites you're trying to keep them away from. And check the Myspace T.O.S [terms of service] to see if such things are against their policies, if they are, report them, if not, nothing you can do.

--
Edited by fuzzybutton at 09/13/2006 12:15 PM