Google mends security flaw in Desktop Search
121305
A handful of researchers at Rice University uncovered a security flaw in Google&#39;s Desktop Search offering that could allow attackers to view small portions of personal search results.
313012
Google's new Desktop Search software is a muscle car among search engines, racing through personal data stored inside your computer to instantly find things you can't easily locate.
758956
Hole could allow remote attackers to access your local search results.
724507
(InfoWorld) - Much as the ubiquity of Microsoft's Windows operating system and Office productivity tools has made the software giant a focal point of security research, search giant Google is facing new scrutiny as it diversifies its products and moves further into the business environment. In a report to be published on July 16, researchers at Ponemon Institute will detail their findings about existing concerns among IT professionals regarding the overall security of Google Desktop, the company's PC search utility, specifically within the confines of business operations. And while the research revolves around the only significant security flaw to be unearthed in the program thus far -- a cross site scripting vulnerability reported and subsequently patched by Google in February -- authors of the report contend that their work illustrates a growing level of concern over the massive company's rapidly-expanding footprint. Google Desktop marries PC and Web-based technologies in a similar manner as many other products the company has launched in the last several years, such as its Google Apps document system, which competes directly with Microsoft Office. If the company is to succeed in its plans to replace Office with Google Apps and drive other applications like Desktop further into businesses, Ponemon researchers said, the company must be ready to face a wave of inquisition over the potential security impact those products will have. In the Ponemon survey of more than 600 IT security specialists who indicated that they were familiar with the Google Desktop vulnerability, an overwhelming 71 percent said that they believe that the product likely harbors other security flaws. The results gathered by Ponemon -- an Elk Rapids, Mich.-based firm that has gained acclaim in recent years for its studies regarding the cost and causes of data breaches -- illustrate the growing apprehension among businesses about the security implications of Google's applications, said Dr. Larry Ponemon, the research company's founder and chairman. Google has moved to bolster its security skills via recent acquisitions of software makers GreenBorder Technologies and Postini and has sought to become a thought leader via its sponsorship of malware research projects like Stopbadware.org. However, the company must prepare itself to face the daily assault from hackers and researchers previously reserved for Microsoft and other industry bellwethers if it succeeds in becoming a more central provider of business IT products, according to the expert. "Google has a huge bull's eye on its back because of its position in the market and everything it wants to become, specifically to businesses," said Ponemon. "These recent acquisitions may point to steps to try and make it safer to use their applications, but it's likely that they will become a victim of their success as more hackers and researchers focus their efforts on finding flaws in its products." In addition to existing concerns among the general public regarding the amount of data retained by search engine providers about people's individual Web queries, products like Desktop and Google Apps are raising significant questions among business users about the ability for the company to keep hackers from finding a way to break in and use the tools to steal sensitive corporate data, he said. Another finding of the report was that 81 percent of respondents familiar with the Desktop cross site scripting security problem said that they do not feel that users who have sensitive data on their computers should utilize functions of the program that allow them to run remote queries on their machines. Such data provides evidence of the growing fear of Google's plans to foster "deep integration" between desktop and Web-based tools, the researcher said. "Based on the people we talk to in the world of security, many believe that Google's products could present a serious risk; that if someone can get in, they can find a lot of sensitive data very quickly," Ponemon said. "Google is becoming such a major presence on so many computers that if people are looking for attack vectors that can get them the most information, Google has become an attractive target." While conceding that Google has encountered very few serious security issues in its products, especially when compared to other major IT companies like Microsoft, the researcher said that concerns about the search giant's technologies are nonetheless going to increase if more business users begin working with its tools. Ponemon denied that his company was attempting to "lead witnesses" with the Google survey by reminding them of the Desktop vulnerability before posing its questions. "To Google's credit, they haven't had many major security problems, but people clearly believe that they may still be vulnerable and that the bad guys will eventually find a way to break in," Ponemon said. "People are scared because they are wondering if this is just the tip of the iceberg in terms of bugs and if the bad guys really are ramping-up their activities around attacking Google products in general." Google representatives complained that the Ponemon report was too narrow and suggestive in trying to provoke people's concerns about their company's overall security standing. Executives with the company said that the search giant is working as hard as it can to ensure that there are no problems in either its existing or future technologies. The firm has long considered its ability to foster trust among users regarding the privacy of their search habits as key to its overall success, said Douglas Merrill, Google's CIO and vice president of engineering. "Search is the oxygen of today's information economy, but we don't believe that search works without users trusting in us to protect their information, so we're focused constantly on improving security and privacy and have been since day one," Merrill said. "That was long before Desktop or our other forays into the enterprise, and it continues with Google Apps; we run our own business on these applications, and I wouldn't be able to recommend them to other CIOs if I didn't know that they were truly secure." Merrill said that Google engages in rigorous examination of the underlying code in its products to eliminate potential vulnerabilities both during their production and after the tools have gone live. He said that by fostering open communication with security researchers, white hat hackers, and other technology providers and encouraging responsible disclosure of any problems, the company has been able to head off attacks that could be aimed at its products. Google currently employs over 1,000 engineers whose sole responsibility is to test for holes in its software and has built proprietary code-scanning tools, he said while acknowledging that the threat of attacks is a reality that no firm can write off in today's environment. "The reality of the world is that Web applications have a larger attack surface and that client-based technologies have been around a lot longer and still struggle with security issues, but we have a big advantage in that if a problem is found, we can fix it right away on our servers versus trying to send patches out to all of our users," Merrill said. "That doesn't mean we will find all the issues. Security is a constantly changing field, but we're happy with the progress we've made." Merrill contends that Google's products actually represent a significant advantage over other technologies in terms of security and that they have proven useful in helping companies solve and locate data management problems. Google's Search Appliances and Desktop products are useful in helping companies find data that may be stored or used improperly within corporate systems, for instance, and its Apps tools require users to authenticate themselves before they are given access to shared documents, adding a new layer of protection to collaborative business efforts, he said. Through its Google Security Blog and participation in Stopbadware.org -- a malware research effort launched in cooperation with experts at Harvard University Law School, among others -- the CIO said that the company is keeping customers informed of its ongoing work and staying abreast of the latest attack methods. "As companies get more widely-known they provide a larger attack surface, but we hope we will continue to maintain our close relationships with security researchers, and we will continue to invest in research and development to protect data as our tools get more popular," Merrill said. "We don't feel that the published risks have been too severe, but we will continue to focus on finding and fixing any problems." Industry analysts agreed that Google has done well thus far in protecting its users from major product vulnerabilities and attacks but observed that the company must learn from the mistakes of companies such as Microsoft if it is to retain its positive image. Google is in the same position of any dominant technology provider in terms of potential attack and will need to remain open to criticism and stay aggressive in quashing potential problems if it is to maintain that standing, said Paul Stamp, analyst for Forrester Research. "Google has to learn from Microsoft's mistake of avoiding talk about security issues based on the idea that it will embolden the people trying to take advantage of any vulnerabilities," Stamp said. "If they think that there aren't people out there who know their products as well as they do or who can't exploit any existing problems, that would be a mistake." The analyst lauded Merrill's pledge to remain open about potential security issues and to court the help of researchers versus making them feel like adversaries. "Google needs to be transparent and be forward-thinking and use the community to find bugs before even they can find them for themselves," said Stamp. "It's a matter of saying, 'These are the types of attacks we expect to see,' and challenging the research community to go find the bugs first."
358859
Copernic Desktop Search does the work without Google's security flaws.
734719
(InfoWorld) - Google quickly patched what security researchers identified Wednesday was a potentially serious cross-site scripting flaw in its popular desktop search and widget application that could leave users vulnerable to outside attack. In a report, researchers at application security software maker Watchfire, based in Waltham, Mass., detailed an existing attack designed to exploit the Google Desktop flaw. Watchfire said the cross-site scripting threat -- which it described as a parasitic virus -- could allow attackers to steal information from affected PCs and track end users' Web browsing habits. Cross-site scripting (XSS) threats typically take advantage of security vulnerabilities in legitimate Web pages to inject malicious content into the browsers of people visiting the URLs or to redirect them to fraudulent sites used in phishing attacks. Like many other XSS threats, the attack currently leveled at Google Desktop uses JavaScript code to deliver its payload. Watchfire experts said the Google Desktop XSS problem was very dangerous for a number of reasons. Among the more serious characteristics is the malicious program's ability to affect clusters of computers connected by Google Desktop's information sharing capabilities. This could allow attackers to spread the attack to new machines or simply steal data from multiple PCs linked by the application. Most enterprises have invested significant amounts of time and money installing security applications to protect against the loss of sensitive data over the last several years, but a Google Desktop attack would circumvent many of those systems, leaving information on corporate desktops running the program open for potential theft. "This attack is almost undetectable, it won't get picked up by any anti-virus system or firewall, and it can be used in a lot of different ways to harm end users," said the director of security research at Watchfire, Danny Allen. "It allows someone using the attack to control all the applications on a computer or access the network to which an affected machine is attached, and it is almost impossible to get rid of." As part of a demonstration of the exploit, Allen showed off how the program could be used to change the version number in the Google Desktop application itself. Doing so could allow attackers to fool users of the desktop search program into believing they have a version of the software that has been fixed for security reasons, when in fact they are still potentially vulnerable. "Some IT security people have dismissed the impact of [cross-site scripting] attacks to a certain extent, but we wanted to highlight the potential damage that something like this could deliver," Allen said. Media representatives at Google said that after Watchfire informed the company of the attack, engineers at the search giant created a patch for the issue that was automatically distributed to Google Desktop users. Google said it has also added a new set of security features to the latest iteration of the product to prevent similar attacks in the future. On Feb. 9, Google launched its newest version of the desktop search program, labeled Desktop 3 Beta. Company representatives said that they have not received any reports of the vulnerability being exploited on end-users' machines. Watchfire researchers said the new security patch appears to fix the flaw and prevent XSS attacks on users of Google Desktop whose systems have been updated. Security analysts considering the problem said it highlighted the need for businesses to look carefully at programs such as Google Desktop that straddle the line between personal and professional PC usage. Although the application may be very useful, and most often gets pulled into the corporate environment by people who use it at home, Google is not a maker of business-grade software and doesn't follow the same security processes as large manufacturers of such products, said John Pescatore, analyst at Gartner. Unlike Microsoft, Oracle, or Sun Microsystems, Google does not publish regular security bulletins or even offer specific details of issues it has already fixed, Pescatore said. This reason, along with the data security issues that can be introduced when Google Desktop isn't configured to bar users from inadvertently sharing search information with outsiders, poses serious questions for corporate IT administrators who must decide whether to allow people to use it in the office, according to the analyst. "The major concern is that while Google isn't an enterprise software vendor, programs it makes, including Google Desktop, are ending up on a lot of enterprise desktops," Pescatore said. "Google doesn't expose how it does patches like Microsoft, so how does an enterprise even know if their users are working with the version that has been fixed?" As malware writers and phishing scheme operators continue to hone their attacks to steal smaller amounts of valuable data from pools of targeted users, and move further away from the massive worm viruses of years past, the IT world will see more XSS threats. "There will be more funded cyber-crime attacks aimed at specific companies and groups of users, and the size of the threats is such, by design, that they won't land on the six o'clock news," Pescatore said. "The perpetrators will continue to increase the volume of these types of threats, and cross-site scripting and targeted phishing will likely be among their favorite formats for doing so." The bug, which was made public Wednesday by Watchfire, has now been fixed. While Google is automatically delivering a patch, Google Desktop users who want to be sure they are running the latest version of the software can download it here. Users should be running version 5.0.701.30540 or later, said Google Spokesman Barry Schnitt. Google was first notified of the problem on Jan. 4 and produced its fix on Feb. 1, a Watchfire spokesman said Wednesday. In addition to its bug fix, Google has added, "another layer of security checks to the latest version of Google Desktop to protect users from similar vulnerabilities in the future," Schnitt said. "We have received no reports that this vulnerability was exploited.â Robert McMillan of IDG News Service contributed to this report.
555338
Security researchers have discovered a serious flaw in Google Inc.'s desktop software that could be used to wreak havoc on a victim's computer.
669952
Search engine leader Google has been forced to respond to a security vulnerability in its Google Desktop Search software, which reportedly made it possible for computer intruders to view desktop search results via the Web.
406505
HOUSTON - A computer scientist and two of his graduate students at Rice University found a security flaw in a search tool distributed by Google, allowing the popular Web site to fix the problem.
135588
Search engine darling Google has patched a hole in its search engine the could have allowed malicious hackers to modify the content of the Google search results page or silently modify search results, but a new hole may have already appeared.
445403
Security Flaw Found in Google Desktop Search  Google practically sparked the fire in the dynamite called Desktop Search genre. Since then, we have seen entry of Microsoft with MSN Desktop Search and Ask Jeeves. Yahoo! would be releasing their version using X1 technology next month. But Googleâs own entry has not ...
665395
Just one day after Google's Firefox toolbar was revealed to have vulnerabilities that could be exploited in an online attack, a similar flaw has been discovered in Google Desktop.
657731
Google is working to fix a bug in the Google Toolbar that could allow criminals to steal data or install malicious software on a system, a security researcher warned Tuesday.The flaw lies in the mechanism Google Toolbar uses to add new buttons on the browser. Because the toolbar does not perform adequate checks when new buttons are being installed, a hacker could make his button appear as though it was being downloaded from a legitimate site when in fact it came from somewhere else. By spoofing the origin of the toolbar button, an attacker could download malicious files or launch a phishing attack against the victim, wrote security researcher Aviv Raff in a blog post on the issue.Raff has posted proof of concept code, showing how such an attack would work with the Internet Explorer browser. A Google spokeswoman confirmed Tuesday that the company is working to fix the problem.The attack requires many steps. First, the victim would have to be tricked into clicking on a Web link that would then pop up a window asking the user if he wants to install a custom button on his toolbar. Because of the flaw, this alert could look like it was downloading the button from a legitimate site, such as Google.com, even if it were not. Once the button was installed on the toolbar, the victim would then have to click on it and, finally, agree to download and run an executable file for the malicious software to be installed.Because the user would have to go through so many steps in order to fall victim to the attack, the bug isn&#39;t a critical one, said Marc Maiffret, an independent security researcher. &quot;While it is interesting, it&#39;s probably a low threat compared to other flaws out there,&quot; he said.Still, it was sloppy work on Google&#39;s part to miss such a simple attack, he said. &quot;They should definitely assess how it slipped through the cracks,&quot; he said.This is not the first obvious Google flaw that Raff has found. Last month, he showed how a simple Web programming error on the Google.com Web site could allow attackers to launch what&#39;s known as a cross-site scripting attack.Because Google&#39;s programmers didn&#39;t properly check the HTML generated by the Google search engine, Raff was able to create a specially crafted Google link that, when clicked by the victim, would trick the browser into running unauthorized scripting code. This type of link could be used to steal the victim&#39;s Google account or conduct phishing attacks, Raff saidThis error was fixed by Google just hours after Raff notified the company of the problem, but a demo of the flaw being exploited can be seen online.
228672
A pair of phishing vulnerabilities this week targeted at Google Inc. point to the kind of new threat Web companies can face as they expand their services into desktop applications, security experts say.
648882
Search engine darling Google Inc. has patched a hole in its search engine the could have allowed malicious hackers to modify the content of the Google search results page or silently modify search results, but a new hole may have already appeared.
563048
Internet search giant Google&#39;s aficionados may just have lost some vital information that could hurt their wallet! Hackers exploiting a flaw in Google&#39;s desktop search tool launched a week back could have
314572
A security flaw that could have caused big trouble for Google and its new Desktop Search tool has been fixed, thanks to a Rice University professor and two of his graduate students.