Major flaw found in Google Desktop
113328
Computer scientists have discovered a potentially serious flaw in Google&#39;s desktop search utility that could allow attackers to steal information.
148871
Onslaught of Google bugs continues Google security lieutenants can't get a break. Over the past week, they've taken a public pounding, following reports of at least four previously undisclosed holes that included new cracks in Gmail and weaknesses that jeopardize the privacy of those who rely on the site to organize photos or administer their websites.â¦
22729
(InfoWorld) - Google has released a new version of its desktop search tool, adding a preview feature to help find information more quickly and making some improvements to the interface design. The update, Google Desktop Version 5, also has some new security features to fight phishing and other online attacks. Its release comes after security researchersÂ reported some security holesÂ in the search tool last month. Google Desktop is a free tool that indexes the content on a PC, including e-mail, text documents and Web pages visited, and makes it available for searching. It also includes "gadgets," or small applications that sit on the desktop and display news headlines, a calendar, a to-do list and other information. MicrosoftÂ and Yahoo offer competing tools, here and here. A search in Google Desktop produces a list of results, including the file name and a snippet of the text. Several results can sometimes look similar, so Google has added a preview tool in version 5 that can show the contents of a file without having to launch the application it was created with, it said. The update also aims to fight phishing and malicious code hidden in Web sites. If a user clicks on a Web link in an email or other document, the new Google Desktop will alert the user if it thinks the Web site is going to try to steal information or download malicious code. Version 5 also updates the sidebar, a vertical control panel on the left of the screen. It can now "sample" the color of wallpaper on a PC and change its color to blend in, Google said. It also updates the appearance of the gadgets to make them easier to sort through and view. The new version, which is still in beta like a lot of other Google software, was announced Tuesday in the Google Desktop Blog. Google Desktop has come under fire from security researchers in recent weeks. In February, researchers at Watchfire said they'd found a flaw that could allow attackers to read files or run unauthorized software on systems running Google Desktop.Â Google patched the flaw, but the researchers said the software could be vulnerable to similar threats in the future. They reported a second flaw later in the month, and Google began investigating it. Google is also trying to enter the broader desktop productivity market. Last month it launched a suite of Web-based software called Google Apps Premier Edition, which analysts say could become a competitor to Microsoft Office. Â
219995
BOSTON -- A potentially devastating hole in Google Inc.'s prevalent desktop search product could have exposed personal files on users' computers to data thieves. Google fixed the defect within weeks of being informed about it and says it has no evidence the vulnerability was exploited.
624470
If you use shared or public computers, you have a new privacy risk to consider: Google Desktop Search.
747017
Mozilla is investigating hacker claims that the Web browser has a serious flaw in the way it handles JavaScript.
370286
Google confirmed the findings of a security researcher who warned that a security hole in the Google Toolbar could be exploited to download malicious files or launch phishing attacks.
122038
Google said Monday that it has fixed a security flaw in its new desktop computer search tool that could have allowed attackers to read parts of files stored on a user&#39;s computer.
134325
With four in the last week, is Google the next security buffoon? Analysis Google's desktop search application is vulnerable to an exploit that allows a determined attacker to remotely run most programs installed on a victim's machine. The flaw is one of at least four security holes to visit Google this past week, demonstrating that the search king, despite the god-like aura it enjoys for its pleasing software designs, remains a mere mortal in the security cosmos.â¦
734719
(InfoWorld) - Google quickly patched what security researchers identified Wednesday was a potentially serious cross-site scripting flaw in its popular desktop search and widget application that could leave users vulnerable to outside attack. In a report, researchers at application security software maker Watchfire, based in Waltham, Mass., detailed an existing attack designed to exploit the Google Desktop flaw. Watchfire said the cross-site scripting threat -- which it described as a parasitic virus -- could allow attackers to steal information from affected PCs and track end users' Web browsing habits. Cross-site scripting (XSS) threats typically take advantage of security vulnerabilities in legitimate Web pages to inject malicious content into the browsers of people visiting the URLs or to redirect them to fraudulent sites used in phishing attacks. Like many other XSS threats, the attack currently leveled at Google Desktop uses JavaScript code to deliver its payload. Watchfire experts said the Google Desktop XSS problem was very dangerous for a number of reasons. Among the more serious characteristics is the malicious program's ability to affect clusters of computers connected by Google Desktop's information sharing capabilities. This could allow attackers to spread the attack to new machines or simply steal data from multiple PCs linked by the application. Most enterprises have invested significant amounts of time and money installing security applications to protect against the loss of sensitive data over the last several years, but a Google Desktop attack would circumvent many of those systems, leaving information on corporate desktops running the program open for potential theft. "This attack is almost undetectable, it won't get picked up by any anti-virus system or firewall, and it can be used in a lot of different ways to harm end users," said the director of security research at Watchfire, Danny Allen. "It allows someone using the attack to control all the applications on a computer or access the network to which an affected machine is attached, and it is almost impossible to get rid of." As part of a demonstration of the exploit, Allen showed off how the program could be used to change the version number in the Google Desktop application itself. Doing so could allow attackers to fool users of the desktop search program into believing they have a version of the software that has been fixed for security reasons, when in fact they are still potentially vulnerable. "Some IT security people have dismissed the impact of [cross-site scripting] attacks to a certain extent, but we wanted to highlight the potential damage that something like this could deliver," Allen said. Media representatives at Google said that after Watchfire informed the company of the attack, engineers at the search giant created a patch for the issue that was automatically distributed to Google Desktop users. Google said it has also added a new set of security features to the latest iteration of the product to prevent similar attacks in the future. On Feb. 9, Google launched its newest version of the desktop search program, labeled Desktop 3 Beta. Company representatives said that they have not received any reports of the vulnerability being exploited on end-users' machines. Watchfire researchers said the new security patch appears to fix the flaw and prevent XSS attacks on users of Google Desktop whose systems have been updated. Security analysts considering the problem said it highlighted the need for businesses to look carefully at programs such as Google Desktop that straddle the line between personal and professional PC usage. Although the application may be very useful, and most often gets pulled into the corporate environment by people who use it at home, Google is not a maker of business-grade software and doesn't follow the same security processes as large manufacturers of such products, said John Pescatore, analyst at Gartner. Unlike Microsoft, Oracle, or Sun Microsystems, Google does not publish regular security bulletins or even offer specific details of issues it has already fixed, Pescatore said. This reason, along with the data security issues that can be introduced when Google Desktop isn't configured to bar users from inadvertently sharing search information with outsiders, poses serious questions for corporate IT administrators who must decide whether to allow people to use it in the office, according to the analyst. "The major concern is that while Google isn't an enterprise software vendor, programs it makes, including Google Desktop, are ending up on a lot of enterprise desktops," Pescatore said. "Google doesn't expose how it does patches like Microsoft, so how does an enterprise even know if their users are working with the version that has been fixed?" As malware writers and phishing scheme operators continue to hone their attacks to steal smaller amounts of valuable data from pools of targeted users, and move further away from the massive worm viruses of years past, the IT world will see more XSS threats. "There will be more funded cyber-crime attacks aimed at specific companies and groups of users, and the size of the threats is such, by design, that they won't land on the six o'clock news," Pescatore said. "The perpetrators will continue to increase the volume of these types of threats, and cross-site scripting and targeted phishing will likely be among their favorite formats for doing so." The bug, which was made public Wednesday by Watchfire, has now been fixed. While Google is automatically delivering a patch, Google Desktop users who want to be sure they are running the latest version of the software can download it here. Users should be running version 5.0.701.30540 or later, said Google Spokesman Barry Schnitt. Google was first notified of the problem on Jan. 4 and produced its fix on Feb. 1, a Watchfire spokesman said Wednesday. In addition to its bug fix, Google has added, "another layer of security checks to the latest version of Google Desktop to protect users from similar vulnerabilities in the future," Schnitt said. "We have received no reports that this vulnerability was exploited.â Robert McMillan of IDG News Service contributed to this report.
462478
A flaw in Google&#39;s desktop search program was revealed on Monday by a team of computer researchers. They showed it could be used to capture valuable personal information from a remote user&#39;s computer.
736801
Google Inc.  said on Monday it has fixed a software flaw that could allow hackers to view information contained on personal computers running the No. 1 search engine's desktop search software.
747939
For 15 hours, e-mail addresses exposed through flaw in Google Docs' new Presentations feature, before Google fixes it.
591034
com December 8, 2004, 2:48 PM PT. Several flaws in common Linux code used to process graphics in the GNOME desktop environment could allow an attacker to compromise a computer that
546498
People who use public or workplace computers for e-mail, instant messaging and Web searching have a new security risk to worry about: Google's free new tool that indexes a PC's contents for quickly locating data.
339078
Researchers at Rice University have discovered what they say is a flaw in the beta version of Google's Desktop Search product that could allow third parties to access users' search result summaries, providing a sneak peek at part of the content of personal files.
755302
InfoWorld - Google quickly patched what security researchers identified Wednesday was a potentially serious cross-site scripting flaw in its popular desktop search and widget application that could leave users vulnerable to outside attack.