Adware hidden in Morpheus Chat by Kayaman

[dumwaldo]

this was posted at http://www.dslreports.com/forum/rema...ping~mode=flat


Quazell (anonymous from domain 216.181.20.x)
Adware hidden in Morpheus Chat by Kayaman
Saw this Posted and checked it and found that it was correct!

-----------------------------------------
Post May 17, 2002:

...Did you ever go to the Music City Morpheus chat and get barraged by popup ads? Well, it turns out there was spyware code embedded into the Java Chat. Turns out it was put in there by Kayaman. lol. And all this time he was getting ad clicks.

Here's the info:

You know how when you went to »chat.musiccity.com[?] that all these annoying popup ads came up in your face? For things like cellphones and whatnot... Well upon tracking the source of these ads, it turns out that the chat page opened several session connections to the IP of www.popuptraffic.com, also media.popuptraffic.com. This turns out to be a notorious popup ad/spam site that is on many spam 'BlackLists' including anti-spam sites that supply lists of sites to block out in your HOSTS file. (see »www.smartin-designs.com[?] for how to block ad/popup/spam sites )

So ok, I thought musiccity morpheus was doing it. Nope.

MusicCity's Morpheus chat was admin'd by a person named Kayaman who recently also started a competing chat server called p2pchat.org. p2pchat.org was supposed to be the spillover chat where people could chat about various p2p clients and touted as being against spyware. It is also home of chat rooms for p2p clients such as xolox, a simple gnutella p2p program. And is populated by many ops from the Morpheus chat.

Well, The music city chat server has been rumored to be shutting down for a while now, but a few hours ago it just happened.

The morpheus chat just changed, morpheus chat is now gone, and users are now routed to p2pchat.org. That's how the spyware in the java chat revealed itself. Here's how...

For the switchover, the Webmaster ConferenceRoom java chat was replaced by Kayaman's own JAVA CHAT. Inspecting the code put there, revealed it. Right clicking on the page you can VIEW the SOURCE CODE. And hidden in the source code of the page was this:

>SCRIPT LANGUAGE="JavaScript" src="http://www.popuptraffic.com/assign.php?l=kayaman&mode=behind">

>SCRIPT LANGUAGE="JavaScript" src="http://www.popuptraffic.com/assign.php?l=kayaman">>/script>

If you don't know what that means, that is the code that spews those cellphone popup ads from popuptraffic.com in your face when you go to morpheus chat. But look at the end... Notice it doesn't say MusicCity at the end. It says 'l=kayaman'. It turns out that Kayaman put *himself* as the affiliate. So all this time, while touting spyware and ad free systems, he was secretly getting ad impression credits from all of you. LOL.

By the way, I looked for the user and tried to contact them in the chat server, but upon getting no answer I posted the spyware info into the chat rooms to tell everyone. Upon Kayaman seeing it in the chat room, I was killed off the server with the following message:

*** You were killed by KayaMan (irc2!netadmin.p2pchat.org!KayaMan (learn the difference between a popup and spyware))

LOL.

-Notice that it doesn't say "No. There's nothing there." but rather he seems to be admitting it and just arguing whether or not it's popups or spyware. In any case, you can argue over definitions if you like, but I'd say anything that is hidden code and is embedded secretly, pops up ads at you, and directs revenue credits to someone is not too good no matter what term you want to use for it.

By the way, Kayaman says he is NOT an employee of music city. Although he does administer their chat and have the keys to edit and manipulate their website to add his own name in there for revenue credits, and direct people to his new p2pchat server.

Whether or not someone deserves or does not deserve ad revenue, the fact that it was hidden and designed to launch popup ads by someone who at all other times was vocal against such things is a little questionable.

As soon as I revealed the popup ad code and that the credit was going to Kayaman, the site was quickly edited to prohibit RIGHT-CLICKING to view the source code, and the ad code was edited out. LOL!

But here is what it was:

>HTML>>HEAD>
>title>. . MusicCity - Java Client . .>/title>

>meta http-equiv="Content-Language" content="en-us" />
>meta name="robots" content="none" />

>SCRIPT LANGUAGE="JavaScript" src="http://www.popuptraffic.com/assign.php?l=kayaman&mode=behind">
>/script>
>SCRIPT LANGUAGE="JavaScript" src="http://www.popuptraffic.com/assign.php?l=kayaman">>/script>

>/HEAD>

>body class=background bgcolor="#FFFFFF" text="#828282" link="#669999" vlink="#669999" topmargin="1" >



Hmmm, Kayaman also has XOLOX using his java chat code. I wonder what kind of stuff is in now embedded in XOLOX chat... ?

-Helena Brocker

-------------------------------------------

Went to popuptraffic.com... Username kayaman is used/taken.
This p2pchat forum has something to do with this guy??
-Quazell

[butterfly_kisses]

great info...hilarious

[Snarkridden]

The phrase "Red Faced" and "Caught with hand in cookie Jar" comes to mind here....

We must expect these things, now that personal greed is the rule

Snark... (Missing my favourite smiley, where did it go?)