YouTube hit by scripting attack

YouTube was hit by a scripting attack this weekend, which inserted nasty comments below videos and redirected users to adult sites.

The cross-site scripting attack reportedly targeted videos of Canadian pop star Justin Bieber.

Google said it hid the comments within an hour of the attack, and rolled out a complete fix within two hours. “We’re continuing to study the vulnerability to help prevent similar issues in the future,” a spokesperson said.

Google Accounts weren’t compromised by the attack, the spokesperson added.

Posts on the YouTube forums suggested the script deleted existing comments, and may have been a 4 July prank to mark the American holiday.

“It seems that this ‘script’ is being used to attack the comment sections of video and rendering all previous comments invisible, as well as possibly affecting the addition of new comments,” said user Fyreffect, adding a “side-scrolling message can be seen which states ‘Hacked you all! Haha!!!’.”