Several band profiles on MySpace have been hacked to serve up some nasty tricks, according to security vendor FaceTime Communications.

The bands' MySpace pages have a transparent overlay that, when clicked, either links to a Web site that tries to start downloading malware disguised as a media codec or attempts to exploit a browser security flaw, said Chris Boyd, security research manager with FaceTime.

When a cursor passes over part of the overlay, the IP (Internet Protocol) address for a Web server in China is shown in some browsers. However, the fake media codec site is hosted in Russia, Boyd said. He posted screenshots of the problem on his blog Wednesday.

At some point, the log-in details for the bands' pages must have been obtained, likely through a phishing attack, Boyd said.

"So far, I think we've seen around seven or eight music bands hacked -- not a huge number as it seems to be pretty fresh," Boyd said.

But if the hackers have the bands' log-in details, they can send bulletins to users who have joined the site as friends. Those bulletins are used to attract more people into visiting the infected pages and potentially downloading the malware. That could ramp up infection levels, Boyd said.

"It's a great hook for a malware writer to tap into," Boyd said.

MySpace officials could not immediately be reached for comment. Boyd said the company has been notified by FaceTime via e-mail.

The IDG News Service is a Network World affiliate.

Whitepapers

• Gene Kim's Practical Steps to Mitigate Virtualization Security Risks
• Selecting Effective Virtual Directories
• A Modern Approach to On-Demand Email and Data Security
• Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange
• Compliance, Protection, Recovery: A Layered Approach to Laptop Security
• Endpoint Security: Data Protection for IT, Freedom for Laptop Users

View more SECURITY whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies
• Technical Overview of Exchange Server 2007 with HP Servers and Storage
• Bringing Order and Security to your Mobile Workforce: Corporate Mobility Policy and Device Management On-Demand

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• Learn how to Keep your Mobile Workforce Connected
• The self-managed network

View more SECURITY special reports