http://www.techworld.com/security/news/index.cfm?newsID=6251 By John E. Dunn Techworld 19 June 2006 An automated information theft worm has been discovered spreading through Google's social networking website, Orkut. Using a URL as the lure, MW.Orc installs itself in an Orkut scrapbook, a public guestbook where visitors can leave comments or links. Infection follows for anyone clicking on this, after which it attempts to steal banking user names and passwords in trusted phishing style, should such services be accessed. The worm also gives criminals the potential to use the infected PC as a bot for the distribution of pirated movie files. Written in Portuguese, the link is believed to be designed to hook Brazilians, the main users of the system. Google is said to have come up with a temporary patch to stop its activities, although a posting by FaceTime Security Labs' researchers on blog.spywareguide states that the worm has been causing problems for some time. "The idea of problems behind "gated" communities is a pretty interesting one, even more so when the idea regularly rolls around that segregating various parts of the Internet to "keep the bad guys out" would be a great idea. But what happens when those bad-guys are already inside the gates?," the blog entry continues. "Sometimes there is a false sense of security and trust that an end user has in a "gated" community such as Orkut. This is similar to what we see happening in instant messaging," was the official comment from FaceTime's Chris Boyd. A relatively obscure part of the Google empire, the invitation-only Orkut is said to have been named after its creator, Google employee Orkut Buyukkokten. _________________________________ Attend the Black Hat Briefings and Training, Las Vegas July 29 - August 3 2,500+ international security experts from 40 nations, 10 tracks, no vendor pitches. www.blackhat.com
This archive was generated by hypermail 2.1.3 : Tue Jun 20 2006 - 23:31:07 PDT