Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

12/19/2007
06:05 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Google's Orkut Social Network Hacked

Hundreds of thousands of users infected by XSS worm hidden in messages from 'friends'

A fast-moving cross-site scripting worm spread overnight through Google's Orkut social network, infecting users who viewed the emails or Orkut messages carrying its payload. The victims didn't even have to click on a link to be infected.

The worm, which used Flash-based JavaScript malware and took advantage of an XSS vulnerability in Orkut, added the victims to its rogue Orkut community, reportedly called "Infectados pelo Virus do Orkut," which at one point today had captured hundreds of thousands of involuntary members.

Scraps, or message posts to an Orkut user's profile, were the main culprit. Victims either got alerts from Orkut that they had a new entry to their scrapbook, or received emails from other Orkut friends who also had been infected. The worm was adding members to its rogue Orkut community at a rate of about 100 per minute at one time during the attack.

Orkut fixed the XSS bug earlier today, but according to OrkutPlus, a security community within the social network, the vulnerability was still active in Orkut's so-called sandbox profiles as of this posting. Google's Orkut sandboxes are closed "containers" for Orkut members, such as developers testing out applications.

The hacker behind the attack appears to have unleashed the worm to prove a point: to show how easy it is to use JavaScript and XSS to infect multiple users quickly. The attacker wrote a message in Portuguese on the rogue community site -- translated, it says: "This just to show how orkut may be dangerous, you came up here without clicking absolutely no link malicious, everything was done reading scraps." The message also said that no data was stolen in the attack.

Security experts say there was no malicious activity associated with the worm -- mostly it just was an annoyance to the infected users and their friends that caught the worm from them. "It's just a proof-of-concept, but had it been real, it could have harvested hundreds of thousands of Google accounts," says one researcher who was infected by the attack. "The attack didn't do anything malicious; it was there to prove a point. All it did was join you to a specific Orkut group."

Researcher David Maynor, CTO of Errata Security, says he got multiple Orkut-related email messages from a fellow researcher, but didn't open them and wasn't infected. He says the messages looked suspicious: "It was completely unsolicited, plus I got more than one in a very short [period] of time," Maynor says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Google (Nasdaq: GOOG)
  • Errata Security

    Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
     

    Recommended Reading:

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    COVID-19: Latest Security News & Commentary
    Dark Reading Staff 8/3/2020
    Pen Testers Who Got Arrested Doing Their Jobs Tell All
    Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
    New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
    Nicole Ferraro, Contributing Writer,  8/3/2020
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Current Issue
    Special Report: Computing's New Normal, a Dark Reading Perspective
    This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
    Flash Poll
    The Changing Face of Threat Intelligence
    The Changing Face of Threat Intelligence
    This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2020-17452
    PUBLISHED: 2020-08-09
    flatCore before 1.5.7 allows upload and execution of a .php file by an admin.
    CVE-2020-17451
    PUBLISHED: 2020-08-09
    flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title, page_content, or page_extracontent parameter, or the acp/acp.php?tn=system&sub=sys_pref prefs_pagename, prefs_pagetitle, or prefs_pagesubtitle parameter.
    CVE-2020-17447
    PUBLISHED: 2020-08-09
    MyBB before 1.8.24 allows XSS because the visual editor mishandles [align], [size], [quote], and [font] in MyCode.
    CVE-2020-16248
    PUBLISHED: 2020-08-09
    ** DISPUTED ** Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability.
    CVE-2020-15820
    PUBLISHED: 2020-08-08
    In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.