Orkut Email Address Disclosure
Rajesh Sethumadhavan just sent me an interesting one. It looks like Google’s version of social networking, Orkut, discloses email address information for friends, regardless if they are friends or not. Looks like a pretty quick way to buy yourself a massive spam list. Here is his advisory:
Overview:
Orkut is an Internet social network service run by Google and named after its creator, Orkut Büyükkökten. It claims to be designed to help users meet new friends and maintain existing relationships with pictures and messages, and establish new ones by reaching out to people you’ve never met before.Orkut service is vulnerable to email address disclosure vulnerabilities. Due to this It is possible to get email address of any users in orkut. This is caused due to improper designing of orkut portal.
Description:
A remote attacker can get the email address of anyone in the orkut as demonstrated below. The victim interaction is not required at all.Demonstration:
Note: Demonstration leads to email address information disclosure
- Login to your orkut account
- Add any user as your friend (Person you want to get email address)
- Click ‘friends’ tab
- Click ‘open friend requests’ tab
- Click edit button the email address of the user will be displayed
as in the screenshot
Same way your can find your friends email address also
That’s a pretty nasty information disclosure issue and brings home what I was talking about before about companies using email addresses as half factor authentication, and since that may not be as secure as some people think it is, disclosing usernames in combination with email addresses can be part of the fatal flaw. It’s not the information in particular that’s valuable (other than for spam or phishing email lists) it’s how that information is used in combination.
December 7th, 2006 at 4:06 pm
Ouch!
always scary if they ask your Gmail or Hotmail login, and be amazed how many people actually do it.
December 7th, 2006 at 4:37 pm
You can also do something similar in the “Google Groups” - click on someones posting and use “reply with quote”, select the user (not the group) to send it to and select “send me a copy” on the bottom.
It’ll send the user a direct email and send you a copy of the email (with their address in it).
It takes more steps and sends an email with your logged-in account, but you get their signup-address.
December 8th, 2006 at 5:02 am
I had no idea on the google groups one… cool! Thanks.
B-
December 23rd, 2006 at 7:28 am
I would like to talk about protection on Orkut. I´m disguisted with this community. Because one girl from Brazil with her friend created my false profile…this profile abuses my personal entries and my photos and and in this case this profile is illegal…what can I do to delete this?why orkut doesn´t protect people before this???????I would like to report this to any contact of orkut…but does it exist anything like email address of orkut????please help me…
you can look at this false profile http://www.orkut.com/Profile.aspx?uid=641368603985811238
I´m very frustrated
…please help me to delete this
December 23rd, 2006 at 4:18 pm
http://www.orkut.com/FlagProfile.aspx?uid=641368603985811238
April 2nd, 2007 at 6:31 am
can i protect my photos from being copied by any one ….
is there any photo protection option in orkut…..
pls tell me…….
May 13th, 2007 at 5:54 pm
Hello Friends,
I am not sure but the above method didn’t work for me.
Is this technique still working or its fixed?
Kindly leme know on hardrock2007@yahoo.com
I’ll be really thankfull to you.
Regards,
Josh
June 7th, 2007 at 6:43 am
this technique no longer workz here is one method that still works :
http://digitalpbk.blogspot.com/2007/06/get-anyones-email-id-on-orkut.html
December 24th, 2007 at 1:29 am
hi………………………i hve a freind i also added him but the email address on his profile is fake………………….can one tell me how to get his email address …………….he is also not telling me about his email address