MySpace Virus#2

There has been some discussion in the last few hours, of a new MySpace virus (JS/SpaceFlash) that has recently been discovered. This is the second to target the MySpace community this year. While the first virus had a significant spread, this one seems to have spread much less. There have also been updates to MySpace this morning, to require a more recent and specific flash-player in order to view videos.

There has been some criticism about the inclusion of active content on sites like MySpace. MySpace is a social networking site that was created with the specific aim of helping musicians post their wares, so that they could gain more exposure without having to have the backing of major labels. This has also recently been expanded to include comedians as well. In light of this aim, it seems necessary that a certain amount of active content be present to achieve this end. What is the point of a site for promoting musicians and comedians without any way to see or hear them?

This situation strikes me as similar to the early days of the addition of macros to MS Office: It's important to balance powerful functionality and security. Despite the best attempts at including security features in any given product, with a large enough user base, it's likely holes will occasionally be found. At that point, the speed and thoroughness of a vendor's response becomes most important.

In the end, macro viruses all but died out, due in large part to the security features added to MS Office, and generic macro-virus detection added by all major antivirus vendors. It will be difficult for MySpace to address things like cross-site scripting and external modification of profiles without hampering users' ability to add content or to use tools to customize their pages. Obviously more still needs to be done on this front, and the battle is far from over.

MySpace has acted reasonably quickly so far, though there's issues left to be addressed in order to keep this sort of thing from happening again in the future. Hopefully they're taking an in-depth look at these issues, particularly external modification of profiles, so that they can minimize the risk of this being done maliciously.