Assessing The Security Threat Of Google&#39;s Desktop Search
1146
There is some confusion about threats posed by the new search tool. Google says common sense is enough of a patch. By Thomas Claburn.
26357
For purposes of comparison, many people are sizing up MSN&#39;s new desktop search program and toolbar suite against Google&#39;s previously released desktop search program.
669209
Ziff Davis - Google's phishing vulnerabilities could foretell new security threats for major Internet companies cozying up to the desktop.
228672
A pair of phishing vulnerabilities this week targeted at Google Inc. point to the kind of new threat Web companies can face as they expand their services into desktop applications, security experts say.
339881
The logic behind Google (GOOG ) Desktop Search is simple enough: Why shouldn&#39;t the best tool for finding things on the Web do equally well at helping people search their own computers?
524116
(InfoWorld) - Google's PC search software is vulnerable to a variation on a little-known Web-based attack called anti-DNSÂ pinning that could give an attacker access to any data indexed by Google Desktop, security researchers said this week. This is the second security problem reported this week for the software. On Wednesday, researchers at Watchfire saidÂ they'd found a flaw that could allow attackers to read files or run unauthorized softwareÂ on systems running Google Desktop. As with Watchfire's bug, attackers would first need to exploit a cross-site scripting flaw in the Google.com Web site for this latest attack to work, but the consequences could be serious, according to Robert Hansen, the independent security researcher who first reported the attack. "All of the data on a Google desktop can now be siphoned off to an attacker's machine," he said. Cross-site scripting flaws are common Web server vulnerabilities that can be exploited to run unauthorized code within the victim's browser. Hansen, who is CEO of Sectheory.com, did not post proof of concept code for his attack, but he said that he has "tested every component of it, and it works." He has posted some details of how Google Desktop data could be compromised on his blog. Google said it was investigating Hansen's findings. "In addition, we recently added another layer of security checks to the latest version of Google Desktop to protect users from vulnerabilities related to Web search integration in the future," the company said in a prepared statement. Anti-DNS pinning is an emerging area of security research, understood by just a handful of researchers, said Jeremiah Grossman, CTO at WhiteHat Security. The variation of this attack described by Hansen manipulates the way the browser works with the Internet's DNS in order to trick the browser into sending information to an attacker's computer. "Once you can re-point Google to another IP address, instead of Google getting the traffic, the bad guy does," he said. Because this type of attack is so difficult to pull off and is poorly understood, it is unlikely to be used by the criminals any time soon, Grossman said. But anti-DNS pinning shouldn't be ignored, he added. "We should keep our eyes on it in case the bad guys shift gears." News of the attack comes as Google is trying to enter the desktop productivity market. On Thursday, Google launched a suite of Web-based collaboration software, called the Google Apps Premier Edition, that analysts sayÂ could become a competitor to Microsoft Office. The troubling thing about the attack Hanson identified, which he calls anti-anti-anti-DNS pinning, is that there is very little that can be done to avoid it short of eliminating cross-site scripting vulnerabilities on the Web. "This is really just fundamentally about how browsers work," he said. "If you allow a Web site to have access to your drive -- to modify, to change things, to integrate, or whatever -- you're relying on that Web site to be secure." Hansen and Grossman say that Google is not the only company vulnerable to a growing category of Web-based attacks. For instance, MySpace.com was hit when a fast-moving worm spread through the MySpace community in early December, stealing MySpace log-in credentials and promoting adware Web sites. "A lot of these new attack techniques are going to require the browsers to improve," Grossman said. "The users really have very little ability to protect themselves against these attacks" he said. "It's very bad. Even the experts are afraid to click on each other's links anymore." Â
240059
NEW YORK Oct. 18, 2004 - People who use public or workplace computers for e-mail, instant messaging and Web searching have a new privacy risk to worry about: Google&#39;s free new tool that indexes a PC&#39;s contents for quickly locating data.
136916
InfoWorld - Much as the ubiquity of Microsoft&#39;s Windows operating system and Office productivity tools has made the software giant a focal point of security research, search giant Google is facing new scrutiny as it diversifies its products and moves further into the business environment.
3037
If you use shared or public computers, you have a new privacy risk to consider: Google Desktop Search. Announced last week and currently available in a beta version, Google Desktop Search allows you to scour
226937
Google, the world&#39;s most popular search engine announced the launch of a beta desktop search utility application that goes beyond basic web search.
607647
Google's new Google Desktop Search tool raises a number of search privacy issues. In this article, we'll look at some of the usual specters of search privacy plus some new things people should consider.
314572
A security flaw that could have caused big trouble for Google and its new Desktop Search tool has been fixed, thanks to a Rice University professor and two of his graduate students.
462478
A flaw in Google&#39;s desktop search program was revealed on Monday by a team of computer researchers. They showed it could be used to capture valuable personal information from a remote user&#39;s computer.
229381
Google has announced a new desktop search application that enables users to search their e-mail, files, web history, and chats. Perhaps learning from previous mistakes, Google says it has designed the product &quot;from the ground up to respect user privacy.
510349
GOOGLE caused a stir when it announced recently that its search engine can now look for data that is stored in users&#39; computers.
40526
Google's PC search software is vulnerable to a variation on a little-known Web-based attack called anti-DNS (Domain Name System) pinning, that could give an attacker access to any data indexed by Google Desktop, security researchers said this week.
390723
The much hyped Desktop Search Tool (DST) of Google is found to have a critical security flaw. The flaw was discovered by Rice Universityâs computer scientist Dan Wallach and his two graduate students, Seth Fogarty and Seth Nielson.