Invisible Images Do Visible Harm

Apparently the MySpace site for singer Alicia Keys (or more likely, the MySpace site of her PR folks) was victim to a transparent image ruse similar to the one reported by ScanSafe in early October. The difference was that instead of using a transparent GIF overlay, the attackers embedded a linked background image (a JPG) into one of the elements on the page and supersized it. Any clicking within the supersized area (that turns everything on top of it into one big link) leads to a remote site that presumably is designed to leverage exploits to install malicious code. (The site was not operating at the time of this post). The attack method is very low tech, but sometimes it's the really simple things that get people.

When hovering over a link, the mouse pointer typically changes to a hand. If you witness a mouse pointer remaining as a hand over a large portion of a site (unless you're hovering over an expected clickable image), be very suspicious.

In the meantime, let's hope Keys or her PR reps change the password on that MySpace account. Looks like one of them may have fallen victim to a phishing scam and given up the login credentials.