"this chick is using like almost all of ur pix and part of ur profile.. people have no lives, i swear. heres the URL if u want to check it out"

Followed by a link to their Myspace page. The page itself is hosted within the Myspace.com domain and is a users profile page. Upon accessing the site the user is presented with their login credentials.

A couple things to note here. The code writer took special note to change the authentication picture to show that it says, “profile.myspace.com” instead of “login.myspace.com” as it normally should. One mistake the code writer made was that he did not create a password field which hides the password while the end user types it in.

The attacker used code within a Cascading Style Sheet (CSS) to overlay the main user profile and present their own text and images. If users enter in their credentials the information is posted to a website which is hosted in the United Kingdom.

Myspace Message:

Myspace Login Site:

Users (attackers) Profile: