Google repairs `Orkut' worm

The search giant Google has reportedly repaired a prolific spam worm launched on its social networking site Orkut.

Earlier this week, a Trend Micro engineer Robert McArdle published a blog entry warning that a worm was replicating itself across Orkut using a Flash object that invokes malicious JavaScipt code.

"The attack works due to Orkut allowing users to embed Flash content in their scrap posts (although it does filter for normal XSS techniques)," said McArdle in the blog post. "The author appears to have created a SWFObject that calls the malicious JavaScript and was able to use this to bypass Orkut's filters."

The attack began as an e-mail message alerting Orkut users that they have a new Scrapbook (guestbook) entry.

On receiving the scraps, the members' browsers then downloaded and executed the embedded virus. After adding its victims to a community called "Infectados Pelo Virus Orkut" or "Those Infected by the Orkut Virus," the worm then started to send messages to members of the affected user's friends list.

In an email statement Google representative said that Google takes the security of its users very seriously. "We worked quickly to implement a fix for the issue recently reported in Orkut. We also took steps to help prevent similar problems in the future. Service to Orkut was not disrupted during this time."

Orkut, Google's first pass at social networking, was launched in January 2004 and named after its creator and Google employee, Orkut Buyukkokten. The site is reported to have in excess of 67 million registered users overall. By comparison, MySpace boasts 110 million users.