Spammers have taken advantage of YouTube to help deliver their spam, but not in the way you be expecting.  They are not doing it through videos, they are doing it through YouTube’s ‘Invite a Friend’ feature.  Seems like some spammers were able to exploit a vulnerability that allowed them access to the mail server that sends the automated YouTube invitation emails out.  So, instead of someone receiving an email from YouTube stating that they have been invited to see a video, use their service, etc. they are probably now getting invitation to try Viagra or a variety of pharmeceuticals…

Spammers are hijacking a service on YouTube to send out waves of e-mails that evade spam defenses by hiding under the video Web site’s coattails.

Security company Sophos warned users last week that spammers are exploiting the highly popular video Web site YouTube in an attempt to promote their own goods and online stores. The cyber criminals are dropping their spam messages in the ‘comments’ section of the ‘invite-a-friend’ service on YouTube, enabling them to send out spam that flies under the normal anti-spam radar.

“Normally spammers take over innocent people’s PCs to send their unwanted messages across the Internet,” said Graham Cluley, senior technology consultant for Sophos, in a written message. “In this case, however, they don’t need to do that. Instead, they are using a Web site to relay a message to their intended audience. “The criminals are hoping that by embedding themselves inside a YouTube e-mail, they will be able to slip past spam filters at the recipient’s e-mail gateway.”[more]

Tags: Spam