The Myspace Chat hack

MySpace uses the userplane chat application. It is a flash based chat that works well when it isn't being abused. Unfortunately it is often abused and this is disruptive to anyone in that chat room.

It used to be the people who wished to stop the room from functioning would simply send a screenful of emoticons and it would slow everyone's computer to a crawl and many people simply left. For whatever reason (I can only hope it might have been a security update) that fell out of favor for this new exploit.

What happens now is someone says something only you don't see it. You see their name but nothing after that. Then it simply sits there with your network at 100% usage and cpu at 100%. Refresh the page and it is fine.

So I decided to give this a closer look. I suspected they were using packet editors and knew they weren't all that smart so I decided to ask my favorite guru what the appropriate program to use was and he pointed me to a very good packet logger. I found the packet our little friend sent and it looked a lot like this:

rooms/public/2/dispatch_sosendChatTextGoodbye Room. Soon To Be Destroyed. thank your imature lame fucks who have no life ed and kev have fun mind fucking somthing that can't see you
312088735Bqup

So it looks like he's sending a font with one too many characters to begin with. But is there more to it? Not sure yet. And what is the cure? to filter for a packet containing that string, 0ii6699? That seems a bit wasteful on the client end. I do wonder if that number near the end is the user's MySpace number. No confirmation on that just yet. More testing I guess.
--update: That number is the user number of the chatter.

Don't know.

But there it is. So if your google search led you here because you wonder why the room is freezing, there's what I know. I'd bet they'll be changing that font number regularly.

Edit, I see I can't put the actual breakage in here and have it display, so for those of you paying attention at home it is font color=#<0ii6699>