Google's Orkut Social Network Hacked

[Daniel ~]

Written by Daniel
Thursday, 20 December 2007
Hundreds of thousands of users infected by XSS worm hidden in messages from 'friends'

DECEMBER 19, 2007 | 4:05 PM
By Kelly Jackson Higgins
Senior Editor, Dark Reading

A fast-moving cross-site scripting worm spread overnight through Google's Orkut social network, infecting users who viewed the emails or Orkut messages carrying its payload.... Front Page

[Áedán]

It's an interesting interaction between flash and JavaScript. My understanding is that Orkut allows your friends to use arbitrary HTML commands. This was used to load up a bit of flash that downloaded a JavaScript file and execute it (from hpp://files.myopera.com/virusdoorkut/files/virus.js).

The JavaScript uses Web 2 technologies (AJAX) to do it's stuff, so that you don't see it working. Roughly, it does the following:

• Joins you to a community (/CommunityJoin.aspx?cmm=44001818)
• Uses the Compose.aspx in order to gain a list of your friends
• Sends each one a scrap containing the JavaScript

There doesn't appear to be any payload attached to it, so it just infects a bunch of people and then does nothing.

[Daniel ~]

So Google has been warned?