A Facebook developer named Yvo Schaap has uncovered a massive security flaw present on both Facebook and MySpace that would give hackers the ability to steal all of your account data, including your photos, personal messages, and basically everything else you’ve ever put on the social networks, without you ever realizing it.
Update: MySpace tells us that in their case no private data was actually exposed, see their statement below. However, Schaap believes that MySpace is simply wrong, and that they were in fact open to the exploit.

Schaap stumbled upon the exploit and contacted both Facebook and MySpace. According to his blog MySpace has since fixed the bug, and while his blog indicates that Facebook is still working on it we’ve confirmed that they’ve fixed it as well. So what exactly could the exploit do? From Schaap’s blog:

You don’t need much time to think of all the ways this could be exploited. All what has to happen is a active session, or a “auto login”-cookie and a URL which hosts a exploiting Flash file. For example when accessed, a automatic “post update” could be made, that would lure friends of the user to access the exploit URL, and the exploit would spread virally. An more invasive and hidden exploit could harvest all the users personal photo’s, data and messages to a central server without any trace, and there is no reason why this wouldn’t be happening already with both Facebook and MySpace data.

The industry is definitely making big changes to self regulate around social gaming offer scams (complete background here, with updates). Zynga, the largest social gaming company and the worst offender when it comes to scams, said yesterday that they will take steps to remove scams from games. They were quickly followed by RockYou.

Today MySpace is making a big move itself. They are instituting a “zero tolerance for app scams” policy, says CEO Owen Van Natta, and are amending their apps developer terms of use to further restrict the types of offers than can be presented to users.

The existing terms of use already prohibit many types of scams and require clear and accurate descriptions of offers. But as we’ve shown in previous posts, sometimes a clear and accurate description hidden at the bottom of a page in 8 point type isn’t all that useful.

Last week Google launched the Music Onebox — a special new search result that lets users stream songs in their entirety for free. The feature is being powered through partnerships with MySpace and Lala, who are providing the song streams, with contributions from a host of other partners like Pandora and imeem. Millions of people will doubtless stumble across the new feature on their own as they run searches for their favorite bands, but Google also has a few tricks up its sleeve to get the word out. We’re hearing that a number of well known artists will soon be actively promoting the service, offering exclusive content to fans who Google them.

We’ve heard that artists will be offering songs that can only be found through Google search, some of which will be given away for free. Over 20 artists are involved. Beyond that details are still scant, but we hear that the new promotion will start running soon — perhaps later this week.

A big part of the debate about the lead gen scams plaguing Facebook and MySpace via social games is over how much money is being made on these “offers.” Zynga, by far the most successful at building and monetizing these games, is now telling us exactly how much – 1/3 of total revenues, according to Andrew Trader, a co-founder of Zynga:

Andrew Trader, co-founder of Zynga, said the company makes about a third of its revenue from advertising and another third from virtual goods transactions. The last third comes from companies that provide commercial offers, trading Netflix memberships and marketing surveys for in-game cash.

Zynga revenue guesses range all over the place, but are likely $250 million a year or more. That means $80+ million/year is being brought in from legitimate offers like Netflix subscriptions, as well as the really smelly stuff like recurring mobile phone and learning CD subscriptions that trick users into paying big dollars for little or no return value.

What percentage of offer revenue is scammy? We believe it varies over time, and is heading in the wrong direction. Legitimate advertisers like Netflix and Blockbuster, hit with countless laundered subscriptions from repeat subscripers, are said to be dramatically lowering bounty fees paid on signup. Far less scrupulous advertisers like Video Professor and Tatto take their place.

Last night we wrote about the lead generation scams within social gaming networks. This is a guest post by Dennis Yu, the CEO of BlitzLocal, a privately held 50 person advertising agency in Denver, Colorado, specializing in local search engine marketing for franchises and professional service firms via Google and Facebook. BlitzLocal is no longer in the business of spam, but they do specialize in Facebook advertising and are now using the platform they’ve developed to run campaigns for big brands and small businesses. Dennis writes a blog at dennis-yu.com

Did you know how Mark Zuckerberg supported Facebook in the early days, before he got venture funding? Casino ads. And how about those advertisers who were making over $100,000 a day selling Acai Berry and other weight loss products – they are friends of mine, pioneers of new advertising channels. You see those ads saying “Inbox (5). Nick, someone in San Francisco has a crush on you!” (with your name, profile picture, and city in the ad). I generated millions of dollars from these offers on Facebook – I am not proud of it, but it was very lucrative.

I will walk you through how these online scams work on Facebook and other social networks – the mechanics of how the money is made, some of the people involved, and who is actually clicking on ads. If you’re reading this article, there is a good chance that you are not the type of person actually clicking on these spam ads, but are you curious as to who actually is?

In June 2007, Facebook opened up their application developer platform so that anyone could build games on top of the social network. By having access to user data, game developers could instantly make engaging, viral games. Rate who is hottest among your friends, share quizzes, race cars, grow vegetables, and so forth – all with a click of a button. Users in one click gave the game permission to access their profile data and they didn’t think twice about it.

Last weekend I wrote about how the big social gaming companies are making hundreds of millions of dollars in revenue on Facebook and MySpace through games like Farmville and Mobsters. Major media can’t stop applauding the companies long enough to understand what’s really going on with these games. The real story isn’t the business success of these startups. It’s the completely unethical way that they are going about achieving that success.

In short, these games try to get people to pay cash for in game currency so they can level up faster and have a better overall experience. Which is fine. But for users who won’t pay cash, a wide variety of “offers” are available where they can get in-game currency in exchange for lead gen-type offers. Most of these offers are bad for consumers because it confusingly gets them to pay far more for in-game currency than if they just paid cash (there are notable exceptions, but the scammy stuff tends to crowd out the legitimate offers). And it’s also bad for legitimate advertisers.

The reason why I call this an ecosystem is that it’s a self-reinforcing downward cycle. Users are tricked into these lead gen scams. The games get paid, and they plow that money back into Facebook and MySpace in advertising, getting more users. Who are then monetized via lead gen scams. That money is then plowed back into Facebook and MySpace in advertising to get more users…

Here’s the really insidious part: game developers who monetize the best (and that’s Zynga) make the most money and can spend the most on advertising. Those that won’t touch this stuff (Slide and others) fall further and further behind. Other game developers have to either get in on the monetization or fall behind as well. Companies like Playdom and Playfish seem to be struggling with their conscience and are constantly shifting their policies on lead gen.

The games that scam the most, win.

Now that the dust is settling on the newly launched Google Music (if you don’t yet have it in your normal Google search results, you can use it here) that integrates LaLa and iLike/MySpace streaming music, all I can think of is this: What were Facebook and Ticketmaster thinking when they passed up the opportunity to acquire iLike?

MySpace is the big lottery winner here. They bought iLike for $20 million in August. What they got: a talented (literally) team that is starting to fill the executive ranks at MySpace, the biggest music application on Facebook, and, it turns out, a deal with Google that is now sending massive traffic flow directly to MySpace Music.

Our understanding from sources is that MySpace made an offer to iLike without knowing about the Google deal. Supposedly, since iLike was under NDA, all they knew was that iLike had a big partnership opportunity with some big company, nothing more. In hindsight the iLike deal looks smart even without Google. Add that in and it looks absolutely brilliant. I’m no fan of MySpace CEO Owen Van Natta, but I’ll give the man credit here.

TechCrunch writer Jason Kincaid traveled down to Los Angeles earlier today to cover the launch of Google Music Onebox. In addition to his live notes from the event and the panel, he managed to point his camera at just about everyone involved in the new service: Google Director Product Management Search R.J. Pittman, MySpace Music President Courtney Holt and LaLa founder Bill Nguyen. Jason also recorded his own first demo of the product, which didn’t go so well based on the mouse and browser setup.

Key takeaways – Google will integrate new partners as it makes sense. And while MySpace knew about the negotiations between iLike and Google prior to announcing their acquisition of iLike in August, the deal was far from certain. More on that in a subsequent post.

All are below:

I’m here at Capitol Records in Hollywood, California for a special media event where Lala, MySpace, iLike, Google and others are officially announcing the launch of Google’s Music Onebox — a special new kind of Google search result that will let you instantly stream songs directly from Google’s results page. We first broke the news of the feature’s impending launch last week, though none of the companies involved have been willing to comment on it until now.

Here’s how the new feature will work: Onebox will let users stream songs directly from Google’s search result page, and will also include additional content like tour information and music videos (the actual content shown will vary depending on the partner — more on that later). Enter a query for “Use Somebody”, and you’re going to see a small ‘play’ button in your search result that lets you stream the Kings of Leon song in its entirety, or buy the song. Clicking on the play button will bring up a small browser window that will immediately start streaming your song.

Yesterday at the Web 2.0 Summit, Founder’s Fund managing partner Sean Parker gave a provocative presentation entitled “The New Era Of The Network Service.” In it, he argues that so-called “network services” like Facebook (which he helped start) and Twitter will soon dominate the web, rather than “information services” like Google and Yahoo.

It’s a very interesting idea, to say the least, and obviously you’re interested in it, as about 200 of you commented on it yesterday. So we’ve obtained Parker’s full slide deck from his presentation. Find the full presentation embedded below, definitely worth the read.

Today at the Web 2.0 Summit in San Francisco, News Corp. Chief Digital Officer Jonathan Miller sat down to talk with Federated Media’s John Battelle. Miller oversees a lot of projects for News Corp., most notably MySpace.

Miller reiterated some of what MySpace CEO Owen Van Natta said yesterday at the conference. They have a plan to move forward focusing on what they believe they’re good at, socializing content, which will be music-heavy thanks to their deals with the music labels.

MySpace CEO Owen Van Natta is here at the Web 2.0 Summit in San Francisco. He sat down with Federated Media’s John Battelle to answer some questions about his company.

Van Natta clearly had a strategy for this Q&A: To say “the socialization of content” as much as possible. That’s the direction he wants to lead the social network in as it attempts to prove it can exist in a world where Facebook has passed it as the dominant social network.

So what does the catchphrase mean? Van Natta thinks MySpace has a unique position on the web because of its music deals with all the major labels and the independent ones. And because it’s a much more open network than Facebook, he believes this will work to MySpace’s advantage in helping people find content.

None of the companies involved will confirm the new Google Music service – we have “no comments” or absolute silence from Google, LaLa, MySpace and iLike. But the new service is all but confirmed. And we have the screenshots showing how the service, which will be announced on October 28, will look to prove it.

Matt Ghering, a product marketing manager at Google, has been one of the people talking to the big four music labels about the new service, we’ve heard from one of our sources. And he has supposedly sent these screenshots of the look and feel of Google Music search to various rights holders and potential partners.

The first screenshot shows how a search result might look on Google for a search for “U2.” A picture of the band is to the left of four streaming options for various songs, and the user has the option of listening via either iLike or LaLa. Click on one of the results, and a player pops up from the services that streams the song, along with an option to purchase the song for download.

News Corp., via MySpace, acquired photo/video sharing site Photobucket back in 2007 for $250 million, plus a $50 million earnout. We’ve now learned through a source with knowledge of the deal that MySpace is in the process of selling at least a majority interest in Photobucket. The likely buyer? Disney-backed Ontela, a Washington state startup.

Photobucket has grown steadily since the acquisition, and currently brings in 54 million worldwide users each month (Comscore). But MySpace never integrated with Photobucket, keeping their own separate photo and video platforms.

It’s been little more than a side show ever since the acquisition, and the founders have left to do other projects. With News Corp. scrambling to fix up its digital division, it’s no wonder Photobucket has been on the chopping block.

Best of all, the deal will bring in new cash to News Corp.

It’s not clear that the final terms have been worked out. But our source tells us that News Corp. will sell a majority stake in Photobucket, retaining some equity. If Ontela is the buyer, the merged company will take a new round of financing, with most of the cash going to News Corp., and part of it going into the new company.

Presumably this deal won’t look much different from eBay’s spinoff of StumbleUpon earlier this year, except on a larger scale. News Corp. gets a cash injection and retains a portion of Photobucket. And the service, combined with Ontela or another buyer, gets a new start.

Something is up at MySpace. Everything was quiet for a long while as they went through executive turnover and mass layoffs. But suddenly they are back seeking the limelight.

CEO Owen Van Natta is making his first public interview next week at the Web 2.0 Summit. The Wall Street Journal, which is owned by the same parent company as MySpace (News Corp.) wrote a glowing if somewhat vague turnaround story on MySpace today titled “MySpace Tries to Recover Its Cool.” And, of course, MySpace is throwing a party. Van Natta sent an email to Silicon Valley tech and entertainment press inviting them to a “secret show” concert next week right after he’s interviewed, with the exact venue and band to be announced the day before.

Parties to cover bad (or vague) news aren’t a new thing for MySpace – they threw one earlier this year in Europe right as European operations were being decimated.

The odd WSJ article, which disclosed the sister-company conflict of interest nine paragraphs into the article, seems to be saying that MySpace will focus on social networking around content as a way to win. In a sentence that appears to be directly from a press release, the article says: “In a strategy shift, MySpace is striving to become an online hangout for people to connect with friends over entertainment content, whether it’s the new Pearl Jam album, blogs from celebrities like British pop singer Lily Allen or a karaoke contest for the Fox musical comedy “Glee.”" The article also quotes Chief Product Officer Jason Hirschhorn: “This is not an all-things-for-everybody portal…This is a social entertainment experience.”

One thing about MySpace – they’ve always had far more colorful executives than the more buttoned up Facebook exec team. Of course, those partying and committing federal crimes days are history with the new team in place.

Or so we thought…

A new group of execs were brought in today. And among them are the cofounders of music startup iLike, Ali Partovi and Hadi Partovi. As usual, we peruse the MySpace profiles of new execs because every once in a while we find a new exec hire that hasn’t actually ever used the service.

All the new execs appear to have MySpace profiles. But just before I signed out of the last one i checked, Ali Partovi, a video he uploaded caught my eye. He says “Here’s a little video I just made for the MySpace sales conference next week (Oct 13-15). They told everybody, “make a video showing how MySpace is YOUR space”…..”

Anyway, meet your new SVP Business Development at MySpace, who is most definitely not buttoned up and boring. We’ve also added this video to his Crunchbase profile. Because we can never, ever let him live this down:

MySpace has just announced the appointment of four new members to its executive team, which saw a major shakeup last April. The new hires include Nada Stirratt, who will serve as Chief Revenue Officer and Dustin Finer, who is now Chief People Officer. Joining them will be iLike founders (and brothers) Ali Partovi, who is now SVP of Business Development based in San Francisco, and Hadi Partovi as SVP of Technology, based out of Seattle.

MySpace acquired streaming music service iLike in August for $20 million.

MySpace continues to flesh out its executive team after the shakeup earlier this year that saw the departure of much of the site’s old guard. Today the company has named Mark Rosenbaum as Chief Financial Officer — a position that didn’t previously exist at MySpace. Rosenbaum will be charged with running finance and accounting for the company, and will work under CEO Owen Van Natta.

Here’s the bio MySpace is sending out about Rosenbaum:

Prior to joining MySpace, Rosenbaum served as a consultant to MGM, advising on business intelligence and financial management system implementation. Prior to MGM, Rosenbaum held the Senior Vice President, Corporate Finance position at Gemstar-TV Guide (formerly a News Corporation Company), and served as CFO of the tvguide.com and TV Guide Mobile units.

When it comes to free media streaming, the United States is flush with premium content from great sites like Hulu and MySpace Music. But aside from a handful of exceptions, the rest of the world is out of luck. Today, the balance changes a bit: MySpace has just launched its hugely popular MySpace Music service in Australia and New Zealand, bringing those regions unlimited streaming of songs and albums from all four major music labels, as well as many indies.

AU/NZ users will have access to the same features as the US site, including shareable playlists, artist activity feeds, and other social functionality. But there is at least one notable difference: while MySpace Music launched in the United States with Amazon as its partner for purchasing digital downloads, the AU/NZ version has teamed with Apple’s iTunes. MySpace wouldn’t comment on whether this is foreshadowing a larger partnership, but we may well see the Apple deal extend stateside. MySpace likely had an exclusive partnership with Amazon for the US launch, but it’s been a year (which may well have been the length of the deal), so it may soon be free to explore other options.

MySpace has just announced that CTO and co-founder Aber Whitcomb will be leaving the company, to be replaced by MySpace Music’s current CTO Alex Maghen. The news doesn’t come as much of a surprise — we speculated that Whitcomb would be leaving as part of the core executive shakeup that swept through MySpace last April (if anything it’s surprising that Whitcomb stayed on this long). At this point the last remaining member of MySpace’s old guard is Tom Anderson, who remains onboard in a limited capacity.

Maghen will take on the core responsibilities for running MySpace’s platform and will report to COO Mike Jones. Before joining MySpace, Maghen has previously served as CTO of MTV Networks and CTO of Yahoo Entertainment.