Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

12/19/2007
06:05 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Google's Orkut Social Network Hacked

Hundreds of thousands of users infected by XSS worm hidden in messages from 'friends'

A fast-moving cross-site scripting worm spread overnight through Google's Orkut social network, infecting users who viewed the emails or Orkut messages carrying its payload. The victims didn't even have to click on a link to be infected.

The worm, which used Flash-based JavaScript malware and took advantage of an XSS vulnerability in Orkut, added the victims to its rogue Orkut community, reportedly called "Infectados pelo Virus do Orkut," which at one point today had captured hundreds of thousands of involuntary members.

Scraps, or message posts to an Orkut user's profile, were the main culprit. Victims either got alerts from Orkut that they had a new entry to their scrapbook, or received emails from other Orkut friends who also had been infected. The worm was adding members to its rogue Orkut community at a rate of about 100 per minute at one time during the attack.

Orkut fixed the XSS bug earlier today, but according to OrkutPlus, a security community within the social network, the vulnerability was still active in Orkut's so-called sandbox profiles as of this posting. Google's Orkut sandboxes are closed "containers" for Orkut members, such as developers testing out applications.

The hacker behind the attack appears to have unleashed the worm to prove a point: to show how easy it is to use JavaScript and XSS to infect multiple users quickly. The attacker wrote a message in Portuguese on the rogue community site -- translated, it says: "This just to show how orkut may be dangerous, you came up here without clicking absolutely no link malicious, everything was done reading scraps." The message also said that no data was stolen in the attack.

Security experts say there was no malicious activity associated with the worm -- mostly it just was an annoyance to the infected users and their friends that caught the worm from them. "It's just a proof-of-concept, but had it been real, it could have harvested hundreds of thousands of Google accounts," says one researcher who was infected by the attack. "The attack didn't do anything malicious; it was there to prove a point. All it did was join you to a specific Orkut group."

Researcher David Maynor, CTO of Errata Security, says he got multiple Orkut-related email messages from a fellow researcher, but didn't open them and wasn't infected. He says the messages looked suspicious: "It was completely unsolicited, plus I got more than one in a very short [period] of time," Maynor says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Google (Nasdaq: GOOG)
  • Errata Security

    Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Sodinokibi Ransomware: Where Attackers' Money Goes
    Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
    Data Privacy Protections for the Most Vulnerable -- Children
    Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon
    Current Issue
    7 Threats & Disruptive Forces Changing the Face of Cybersecurity
    This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
    Flash Poll
    2019 Online Malware and Threats
    2019 Online Malware and Threats
    As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2019-18198
    PUBLISHED: 2019-10-18
    In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
    CVE-2019-18197
    PUBLISHED: 2019-10-18
    In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclo...
    CVE-2019-4409
    PUBLISHED: 2019-10-18
    HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the entere...
    CVE-2019-13545
    PUBLISHED: 2019-10-18
    In Horner Automation Cscape 9.90 and prior, improper validation of data may cause the system to write outside the intended buffer area, which may allow arbitrary code execution.
    CVE-2019-13541
    PUBLISHED: 2019-10-18
    In Horner Automation Cscape 9.90 and prior, an improper input validation vulnerability has been identified that may be exploited by processing files lacking user input validation. This may allow an attacker to access information and remotely execute arbitrary code.