Security hole that lead to the pictures being stolen plugged in the meanwhile

Jan 25, 2008 22:16 GMT  ·  By

Last week, there was a security risk for all the MySpace users that had their profiles set to "Private" because somebody found a way to view their photos without having to be in the friend list. Several YouTube videos on how to do that were quickly uploaded and the photo downloads soon took wings.

A 17 GB file containing almost half a million of these photos has recently been found available for download with BitTorrent. That's not going to be easy on the social network, as it is the proof needed that it has security liabilities which can be exploited. I'm not sure how many of the users affected by the photo theft will be coming back to the site if the pictures were indeed personal. Not many, I wager.

What's most interesting is that the company does not admit to having suffered the breach in its security system, but it did plug it. It came at a most unfortunate time for the social network, as it had just announced the initiative to crack down on sexual predators by adding new options to enhance the security level and working together with attorneys general from 45 states in the U.S.

The creator of the file told Wired.com that the sole purpose of his action was to prove that it could be done, while acknowledging that others might use the backdoor he found for "nefarious reasons." Going under the name of DMaul, he ran an automated script on almost 44,000 profiles and said that the process took nearly 94 hours.

The file was already downloaded by a second person, so now there are 2 seeders and 40 leechers. I bet that in a week the ratio will be a lot bigger on the seeder part, so it will have a wider spread because of the increase in speed for download. Nevertheless, I only wonder why somebody would want to see 500,000 pictures of unknown people. Other than a symbol of what can be done, I cannot think of another reason.