The networks that allow untrusted code (js or flash) are the ones to blame for this, and I'm glad that seems to be the general consensus. It seems bizarre to me that anyone would allow this in 2013. We've been talking about scripting "attack" vectors for years now. It's not new.