<http://schema.org/articleBody>
"We reported back in October that a phishing attack had hit MySpace, creating fake login forms that looked like the real thing.  These appeared on 3000 profile pages, according to Mashable Labs.  They worked by using MySpace's popular html editing features (an essential part of the MySpace layouts craze) to display a login form - once you'd entered your login details, the creators could hijack your profile page, creating another fake login form and sending out spam bulletins.  What's more, we noted briefly that Firefox identified these as real MySpace login pages, and automatically filled in your details.\nNow CNET and others are picking up on the story, pointing out that this is a major flaw with the Firefox Password Manager.  The flaw affects both Mozilla Firefox and Internet Explorer 7, but it's being said that Firefox is more vulnerable.  Firefox sees \"http://www.myspace.com\" in the address bar and assumes that the form is a genuine MySpace login page - it doesn't check, however, where the login details are sent to once you submit them.  But what's even more worrying is that this can be done without a visible login form: a site can hide the login form from view, and have the details automatically submitted when you click a link.  Mozilla are working on a fix, but for now the solution is not to use the Password Manager to remember your passwords.\nThe sites where you'll see this attack are generally social networks, since they're the biggest class of sites where ordinary users can edit the html.  However, I've noticed in the past that some of MySpace's competitors (Friendster, hi5, Tagworld and a few others) seem to prevent you from putting forms on your pages.  MySpace could do the same, but that would annoy the large number of bands on MySpace Music who allow their visitors to sign up for newsletters via a form.\n"^^<http://www.w3.org/2001/XMLSchema#string>
<http://mashable.com/2006/11/23/myspace-attack-highlights-firefox-flaw/>