As with any online social networking community, a number of fake and cloned
profiles exist on Orkut. Due to the large number of users and the deactivation
of the jail system, the profiles were often left unremoved or, when removed,
recreated easily. These profiles are normally created to have fun with other
fakes and creating "Fake Families" and sometimes for trolling or spamming.

[edit]Invisible profiles

In 2005, invisible profiles, communities and topics started to appear in Orkut.
This could be achieved by using HTML escaping codes and 1x1 pixel photos
to fool the engine behind the site.This hole was later fixed, and currently
there is a lower limit on profile image dimensions.

It is still possible to create invisible topics in communities.

[edit]Flooders

In August 2005 a freeware program was made in Delphi called Floodtudo 
("tudo" in Portuguese means "everything". This was developed by a Brazilian)
specifically for flooding Orkut^{[citation needed]}. It quickly spread through the
users and was easily downloadable. The most common Floodtudo versions
were 1.2, 1.5, 2.0 and 2.2. As this program was massively used by
thousands of spammers, a big spam wave struck Orkut in September
and October 2005.

During 2007-2008, Another most commonly used Scrap Flooder
"Carbon Copy Scraper" & "Blind Carbon Copy Scraper" (commonly
called CCS & BCCS) was javascript based (popular versions 2.4, 3.3,
and 5.1), available on almost every famous Orkut community. The main idea
behind this was to let profile holders send the same scrap to all their friends
at a once, but it was misused by spammers.

As the flooding of Orkut came out of control, the developers implemented
features to stop it by

• not allowing 2 or more verbatim topics or scrapbook entries to be submitted
• forcing the user to wait before posting another topic or scrapbook entry
• requiring captchas, whenever a scrap entry is hyperlinked.

Community moderators were given the ability to ban users outright instead
of relying on the developers to remove them.

[edit]Electronic spam

Recently, Orkut implemented an automated system to prevent spam.
Orkut users can't send too many friend requests or scraps within a short
time interval. If anyone does so, the user will temporarily be disabled from
that feature for 24 hours to 1 week, depending on the users activity.

[edit]The Frandshippers

Between 2006 and 2007, Orkut was troubled with stalkers which were called
"frandshippers", these were mostly male users looking for female friends who
would often keep trying to convince people to accept their friend requests,
eventually fake profiles of frandshippers were made to annoy people on
purpose, some even to humour them.

[edit]Hate groups

There has recently^[when?] been controversy revolving around the use of
Orkut by various hate groups. Several hate communities focusing on
 racism, Nazism and white supremacy have been deleted due to guideline
violation.^{[citation needed]}

In 2005, various cases of racism were brought to police attention and
reported on in the Brazilian media. In 2006, a judicial measure was
opened by the Brazil federal justice denouncing a 20-year-old student 
accused of racism against those of Black African ancestry and spreading

defamatory content on Orkut. Brazilian Federal Justice subpoenaed Google
on March 2006 to explain the crimes that had occurred in Orkut.

Anti-national, and anti-ethnic hate groups have also been spotted.
Recently an Indian court has issued notices to Google on some of the groups.
The Mumbai Police are seeking a ban on Orkut post objections raised by
political groups. Groups denigrating various political leaders and celebrities
have also emerged. Also in a reported case of 2005, racist groups have
been reported. They were anti-Tamil groups.

Orkut has a Report Abuse feature available for all communities. Orkut communities
can be reported if they contain hate/violence content. Any Orkut user (even those
who are not the members of such a community) can report the abuse. The reasons
for reporting abuse can be nudity or sexual content, theft of identity or personal
information, child abuse, promoting illegal activities, any kind of personal
attacks against any individual and a few others.

[edit]State censorship

[edit]In Iran

Orkut was very popular in Iran, but the website is now blocked by the government.
According to official reports, this is due to national security issues, and Islamic
 ethical issues about dating and match-making. To get around this block, sites
such as Orkutproxy.com (now defunct) were made for Iranian users. Other
websites such as Yahoo! Groups and Google Groups have communities
dedicated to receiving updates on the newest location of Iran's Orkut proxy.
At one time it was possible to bypass governmental blockage of Orkut, but the
site has closed its HTTPS pages on all anonymous proxies. Now it is almost
impossible for ordinary users to visit this site inside Iran.

Many other sites have been published in Iran since Orkut's blockage, using
the same social-networking model - examples include MyPardis, Cloob and
Bahaneh.

[edit]In the United Arab Emirates

In August 2006, the United Arab Emirates followed the footsteps of Iran
in blocking the site. This block was subsequently removed in October 2006.
On July 3, 2007, Gulf News revisited the issue, publishing complaints from
members of the public against Orkut communities like "Dubai Sex", and
officially bringing the complaints to the attention of the state telecom
monopoly Etisalat. By July 4, 2007, Etisalat had placed a renewed ban
on the site, which remains in effect despite Google's promise to negotiate
the ban with the UAE.

[edit]In Saudi Arabia

Saudi Arabia is another country that has blocked access to Orkut, while 
Bahrain's information ministry is also under pressure to follow suit.

[edit]Privacy

Earlier in Orkut it was possible for anybody to view anyone's pictures,
videos as well as scraps, but people started misusing the photos and videos
and placing them on the Internet with fake details. Many of them were vulgar,
especially pictures of women. Moreover, the scraps could be easily read.

Currently privacy covers such features as scraps (separate read and write
access), videos, photo albums, testimonials, and applications.

In December 2008,2009 Orkut developers introduced another privacy
update that allow users to restrict viewing of their albums to certain number
of friends, as well as selected e-mail contacts. The user can limit
visibility of her/his profile to a certain region or group of regions (known as
a "network"); in this case outside of these regions no user information is
available.

[edit]Security and safety

In December 2007, hundreds of thousands of users accounts were affected,
using XSS vulnerability and a worm.^{[citation needed]} A user's account was
affected when the user simply read a particular scrap containing an embed
which caused the user to automatically become a part of a community on
the site, without approval. The affected user's account was then used to
send this scrap to everyone present in the user's friend list thereby creating
a sort of a huge wave.^{[citation needed]}

[edit]MW.Orc worm

On June 19, 2006 FaceTime Security Labs' security researchers Christopher
Boyd and Wayne Porter discovered a worm, dubbed MW.Orc.
The worm steals users' banking details, usernames and passwords by
propagating through Orkut. The attack was triggered as users launched an
executable file disguised as a JPEG file. The initial executable file that causes
the infection installs two additional files on the user's computer. These files then
e-mail banking details and passwords to the worm's anonymous creator when
infected users click on the "My Computer" icon. The infection spreads
automatically by posting a URL in another user's Orkut Scrapbook, a guestbook
where visitors can leave comments visible on the user's page. This link lures
visitors with a message in Portuguese, falsely claiming to offer additional photos
. The message text that carries an infection link can vary from case to case.
In addition to stealing personal information, the malware can also enable a
remote user to control the PC and make it part of a botnet, a network of
infected PCs. The botnet in this case uses an infected PC's bandwidth to
distribute large, pirated movie files, potentially slowing down an end-user's
connection speed.^{[citation needed]}

The initial executable file (Minhasfotos.exe) creates two additional files when
activated, winlogon_.jpg and wzip32.exe (located in the System32 Folder).
When the user clicks the "My Computer" icon, a mail is sent containing their
personal data. In addition, they may be added to an XDCC Botnet (used for
file sharing), and the infection link may be sent to other users that they know
in the Orkut network. The infection can be spread manually, but also has the
ability to send "back dated" infection links to people in the "friends list" of the
infected user. According to statements made by Google, as noted in
Facetime's Greynets Blog, the company had implemented a temporary
fix for the dangerous worm[edit]HTTPS Not Obvious

In and around April 17, 2007 users began reporting that secure (https)
access to the Orkut login server was no longer available. In fact, Google
had changed the main login page to http delivery to improve efficiency,
but the actual login remained secure using https in an iframe. This
information had not been well-published by Google, and did not give
the users the reassurance of seeing the "secure connection" padlock
in the browser. On July 17, 2007, a revised login page, which is
delivered via https, addressed these issues.

[edit]Session Management and Authentication

On June 22, 2007 Susam Pal and Vipul Agarwal published a security
advisory on Orkut vulnerabilities related to authentication issues.
The vulnerabilities are considered very dangerous in cybercafes, or
in the case of man-in-the-middle attack as they can lead to 
session hijacking and misuse of legitimate accounts. The vulnerabilities
are not known to be fixed yet and therefore pose threat to the Orkut users.

A week later, on June 29, 2007 Susam Pal published another security
advisory which described how the Orkut authentication issue can be
exploited to hijack Google and Gmail sessions and misuse the
compromised account of a legitimate user under certain conditions.

Joseph Hick performed an experiment on the basis of the advisories
published by Susam Pal, to find out how long a session remains alive
even after a user logs out. His experiment confirmed that the sessions
remain alive for 14 days after the user has logged out. It implies that a
hijacked session can be used for 14 days by the hijacker because
logging out does not kill the session.

[edit]W32/KutWormer

On December 19, 2007, a worm written in Javascript started to cause havoc.
Created by a Brazilian user called "Rodrigo Lacerda", it automatically
made the user join the virus related community and infect all friends'
scrapbooks with copies of itself, the worm infected over 700,000 Orkut
 users. The worm is spreading through Orkut’s recently introduced tool
that allows users to write messages that contain HTML code. The ability to
add Flash/Javascript content to Orkut scraps was only recently introduced.

[edit]W32/Scrapkut worm

On March 3, 2008 W32/Scrapkut.worm was found. The worm
attempts to spread itself by sending Orkut users scraps that
contains the link to the worm itself. Aliases are Downloader.Banload
.ONK (GRISoft)

• TR/Dldr.Orkut.A (Avira)
• Trojan-Downloader.Win32.Banload.auf (IKARUS)
• Trojan.DL.Win32.Banload.dzm (Rising)
• W32.Scrapkut (Symantec)

[edit]Bom sabado Worm

On September 25, 2010 Bom sabado worm was found. The word
"Bom sabado" is a portmanteau of "Bom sábado", which means
"Good Saturday" in Portuguese. This worm attempts to spread itself by
sending scraps and adding users to a Bomsabado group on Orkut.

[edit]Other attacks

[edit]Private album crack

In December 2007, a Brazilian cracker named "Rodrigo Lacerda"
published a script that allowed users to scrape other people's private
photos. The exploit consisted of generating album photo urls, due to
their simple structure.

This crack made Orkut team implement new secure album/photos
implementation.^{[citation needed]}

[edit]Legal issues

[edit]India

On October 10, 20t Manager, Manu Rekhi,on the Orkut internal blog.
There has also been some media outcry against Orkut after a couple
of youngsters were apparently lured by fake profiles on the site and
later murdered.

On November 24, Bombay High Court asked the state government
to file its reply in connection with a petition demanding a ban on social
networking site, Orkut, for hosting an anti-Shivaji Web community.

Recently, the Pune rural police cracked a rave party filled with narcotics.
The accused have been charged under anti-narcotic laws, the (Indian)
Narcotic Drugs and Psychotropics Substances Act, 1985 (NDPS).
Besides the NDPS, according to some media reports, the police
were deliberating on the issue of charging the accused under the (Indian)
Information Technology Act, 2000 perhaps because Orkut was believed
to be a mode of communication for these kind of drug abuses.

The Cyber police in India have entered into an agreement with Orkut
to have a facility to catch and prosecute those misusing Orkut since
complaints are rising.^[

[edit]Brazil

On August 22, 2006, Brazilian Federal Judge José Marcos Lunardelli
ordered Google to release by September 28 Orkut user’s information of
a list of about two dozen Brazilian nationals, believed to be using Orkut to
sell drugs and to be involved in child pornography. The judge ordered Google to
pay $23,000 per day in fines until the information is turned over to the Brazilian
government. According to the Brazilian government, the information would also
be used to identify individuals who are spreading child pornography and
 hate speech. As of September 27, 2006 Google has stated that it will not
release the information, on the grounds that the requested information is on
Google servers in the U.S. and not Google servers in Brazil, and is therefore
not subject to Brazilian laws.