digg

Orc! Roll 1d20 with + mod.

Still amazing to me how Orkut took off in Brazil and no where else!

Interesting analysis...I wonder how the eventual gaming of myspace will occur. Has NewsCorps protected itself from the backlash that will occur if (more likely when) this happens?

I don't get the Brazalian fan fever either. I have heard awful stories about hate groups using it to recruit, but im sure it goes on in any network...Still this kind of stuff in Google...I would expect it at Myspace.

It seems the web is becoming a toxic waste area when new sites pop up.

OK this is a real weirdo development. They now have evidence the malware is actually a worm, and to boot a mistimestamped worm. I think the post office most of put it out.

ADDENDUM: A startling event was discovered during extended testing on an infected machine, which was infected in a lab setting on the 13th of June. The link to the dangerous payload was propogated on the 16th...however the infection message is timestamped as having been sent on the 14th of June.

what i dont get is how someone wouldnt notice the "form" thing poppin up in their my computer box. isnt that like, the tiniest bit of a giveaway that youve been 0wned?

Sure, if they were paying attention and knew what it was. Otherwise, most people probably just shrug and go on.

Stealing the identities of a bunch of arrogant Brazilians who take over Orkut communities and ***** on anyone who requests an English only group? Oh the horror...

/rock on, Malware!

I haven't been on Orkut since you started needing to communicate in Portuguese to get yourself understood there...

Essa parada ai ta foda.

WOW!

direct link to movie :)
http://c.securevox.com/media/datatheft.wmv

00:00 to 00:09 seconds: End-user is going about their daily business, logging into Orkut. Note that you could be performing any web-based activity here; it's just a little thing I like to call context. Plus, I don't actually have any Brazilian bank accounts so you'll just have to make do with Orkut.

00:10 to 00:14 seconds: The end-user clicks into "My Computer". Oh dear - an "error message", warning that you have insufficient virtual memory and the application will now close (or words to that effect. I never was very good with Babelfish).

00:17 to 00:27: At this point, the end-user is probably wondering what on Earth is going on, as they see a message telling them their "form has been submitted", and that they will be redirected somewhere in 5 seconds. Can you guess where?

00:28 to 00:34: That's right, Orkut! I mean, he stole all your bank details and website logins, but at least he gives you a chance to get back into Orkut and change your password before he steals that too!

I still don't totally understand what this is. Is this an .exe that you download/run? Is it a javascript exploit? The article doesn't realy lay it out.

from the article: This (infection) message is deposited in an Orkut user's "Scrapbook" (similar to a guestbook), and as the Scrapbooks are public, anyone visiting can see the link and click it.

The end-user is presented with what looks like an image file (when they click the link) - open that thing up, and covert ops of the nastiest kind are instigated against the PC. The below files are installed:

(picture of two files installed on the pc), followed by a description of what they do (and a video of the data being sent home to boot).

I noted two interesting updates on the Paperghosts and Porters spywareguide blog so it seems Google is preparing up a rapid response and talking to Facetime Security Labs (company who cited the story.) Quotes were made by Wayne Porter, the Director of Graynet Research.

A) "IMPORTANT UPDATE: Google has reacted very quickly to our concerns, and we have been in discussions with their top engineers. As netizens we are encouraged by their quick reaction to our concerns, and willingness to listen thoughtfully to our feedback. Successful companies like Google understand that one must be a part of the conversation, not stand outside the conversation or try to obscure it. Our hats are off!
Stay tuned for more news...(See Addendum At Bottom)

-Wayne Porter
Sr. Dir. Greynets Research, FaceTime Communications"


and then Porter quote's CNET

B) ADDENDUM Saturday, 17 2006 Happy Endings for Orkut

From CNET:
Google confirmed the worm. "We are aware of this issue and will have a temporary fix in place within the hour," a company representative said in an e-mailed statement. "We are working on a more permanent solution for users to guard against these malicious efforts."

For their protection, Orkut users, just as users of all online services and applications, should always be careful when opening or clicking on anything suspicious, the Google representative said."

Good to see Google is on the ball and treating it seriously, unlike some companies who tend to ignore stuff like this and hopes it goes away.

Nice research