## 5 Attack Example
### Attack Vector Example  
In this section we illustrate a brief description of the MySpace QT attack, a simple example of attack vector as introduced in Section 5.1. MySpace was one of the first Web 2.0 online services to introduce the possibility for users to embed movies, audio, pictures and comments on their own profile. MySpace users can watch other users' profiles and interact with them. One of the most appreciated MySpace features is the capability to upload movies; in fact many movie stars and music stars are using their MySpace profile to show up new backstage videos, inedited live acts and unpublished pictures. Garage bands and music lovers are also using MySpace as a launching platform where they can show to the world what they do, for free on both sides, gaining popularity and receiving feedbacks from people. Apple's QuickTime [46] is one of the most used tools to play multimedia contents such as movies, picture galleries and audio files, by MySpace users as well as all over the Internet. The QuickTime movie file structure incorporates a feature called HREF tracks which allows users to embed URLs into an interactive movie. This feature is widely used to dynamically link contents into advertisements or political races. For example a soda brand can show a movie trailer featuring its product. On the bottom of the screen or directly on the bottle an ad with a \"buy me now\" message can be displayed. The user can click on it and be redirected directly on the company e-Commerce page. The attacker can exploit this feature by adding malicious JavaScript code through the HREF tag, so when the movie is played by unaware users the evil code is executed. The code below represents a working implementation of this kind of attack: QTWorm. ```
1 javascript:
2
3 void((
4 function(){
5
6 vare=window.document.createElement('script');
7
8 varl1=newArray();
9l1[0]='[[http://www.daviddraftsystem.com/images/](http://www.daviddraftsystem.com/images/)]([http://www.daviddraftsystem.com/images/](http://www.daviddraftsystem.com/images/))';
10l1[1]='[[http://www.tm-group.co.uk/images/](http://www.tm-group.co.uk/images/)]([http://www.tm-group.co.uk/images/](http://www.tm-group.co.uk/images/))';
11
12
13 varl1=l1[Math.floor(2*(Math.random()%1))];
14
15e.setAttribute('src',l11+'js.js');
16
17 window.document.body.appendChild(e);
18})
```  
Line 6 contains the critical vulnerability. QuickTime filters potentially dangerous HTML elements like script, img, _etc._ but lets the programmer create whole new elements through the APIcreateElement. The worm uses this API to create a new script element, circumventing QuickTime filters. Each script element has got the ability to perform actions, even system actions like binding a new listening port or connecting to a remote address. It is a kind of self standing program inside the web browser. From line 8 through line 10 the worm initializes an array containing \"n\" (in this case 2) malware repositories from which it will download the malicious code and execute it. Line 13 implements the oracle, which decides from which site to load the malicious code. Finally line 15 appends to the current page the freshly-downloaded script. The last instruction, on line 17, starts the execution of the malicious code by adding the script to the body of the page. As a self standing program the script is able to show, to hide and generally speaking to modify the user interface behavior, altering the user's perspective. If the user, as discussed in Section 2, has to take decisions through this interactive channel, he might be influenced by the script. For example, assume a record producer is looking for new talents on MySpace. Once he finds some candidates, he wants to figure out how they work by clicking on their video trailers. If the video trailers are compromised by an attacker the producer might see fake videos, he might listen to counterfeited music or be redirected to unrelated (without he realizing it) sites containing questionable contents to alienate whichever favor he might have about the candidate.