SPI Labs has acquired and analyzed the source code for the worm. This worm is capable of executing because Quicktime movies are not validated by MySpace to ensure that HREF tracks do not contain JavaScript code. While MySpace does not allow users to upload Quicktime movies directly to its servers, MySpace is not verifying that links to multimedia files hosted on external sites do not contain malicious code.
