Re: Social viruses ? (Hi5, Ringo, etc.)
"Steve" <[email protected]>
| Newsgroups | gmane.comp.security.virus |
|---|---|
| Message-ID | <01a001c52655$9af3c5f0$4f0aa8c0@GATEWAYSOLO> |
Similar sites include Plaxo and LinkedIn but those do ask you before they send to anyone from your address book and they ask you to import your address book, work you through it etc. STEVE ----- Original Message ----- From: "Chris Caydes" <[email protected]> To: <[email protected]> Sent: Thursday, March 10, 2005 7:11 PM Subject: Social viruses ? (Hi5, Ringo, etc.) In the past few weeks, I have received a few messages from people that I know, asking me to join their "network of friends" on such sites as Ringo, Hi5 and Bebo. From what I understand, these sites offer you to hold your address book for you. The idea is that each member keeps his own contact info up to date, effectively keeping your own address book up to date. I also saw one such invitation (for Ringo) sent to a mailing list (and the sender getting flamed for it shortly afterwards) In one case, out of curiosity, I clicked on the link provided (it was from hi5). The several-step form asked me for personal information that I did not want to provide, including the *password* for the Hotmail address I had provided ! The reason why hi5 wanted my Hotmail password was to "automatically import my entire Hotmail address book to my hi5 account" That's where my curiosity reached its limit: I did not go any further. The person who initially sent me that invitation later told me that he had received the same invitation himself, had joined the hi5 network, and that hi5 then sent invitations to his entire address book without him even realizing it. I then thought that the guy who sent the Ringo invitation to the mailing list perhaps sent it unvoluntarily as well. What I'm getting at is, if these invitations "to join the network" really are sent without the members' consent (or knowledge), they share a lot of similarities with email-bornes viruses. They would be viruses without a malicious payload (except for the flames you get from spamming your entire address book, and the fact that you hand out your Hotmail/Yahoo email password to a third party website). This would then be like a virus that doesn't even require you to write a line of code: all you need is to invite a few people to "join the network", and let the website do the rest. Has anyone else witnessed this ? Are invitations to such sites as Hi5, Bebo and Ringo really sent without the member's knowledge ? Or is it a choice left to the member to send invites (and in that case, what is the default ?) Regards Chris