Be careful while using Google Desktop Search
530189
Google Desktop Search like most Google products makes an awesome first impression. I have tried other desktop search tools, but none of them can match the convenience that Google Desktop Search comes with.
411669
Security researchers say that Google Desktop is vulnerable to a new type of attack -- the second such disclosure this week.
219995
BOSTON -- A potentially devastating hole in Google Inc.'s prevalent desktop search product could have exposed personal files on users' computers to data thieves. Google fixed the defect within weeks of being informed about it and says it has no evidence the vulnerability was exploited.
701997
Beta search app creates vulnerabilities that may threaten your data's security.
466718
Google fixed a flaw in its beta desktop search tool that could have given hackers access to users&#39; local searches, officials said Monday.
102369
Google has released Google Desktop Search, which enables users to search their desktop computers using the same technology as Google&#39;s online-search tool.
330204
SEATTLE - The latest search engine from Google could turn out to be a privacy nightmare! Once installed in a computer running Windows XP or Windows 2000 (with Service Pack 3 or higher), the Google Desktop
401063
People who use public or workplace computers for e-mail, instant messaging and Web searching have a new privacy risk to worry about: Google's free new tool that indexes a PC's contents for quickly locating data.
103140
Google has said that the software flaw found in its Desktop Search utility has been fixed. The flaw allowed hackers to view information contained on a PC running the search software.
524116
(InfoWorld) - Google's PC search software is vulnerable to a variation on a little-known Web-based attack called anti-DNSÂ pinning that could give an attacker access to any data indexed by Google Desktop, security researchers said this week. This is the second security problem reported this week for the software. On Wednesday, researchers at Watchfire saidÂ they'd found a flaw that could allow attackers to read files or run unauthorized softwareÂ on systems running Google Desktop. As with Watchfire's bug, attackers would first need to exploit a cross-site scripting flaw in the Google.com Web site for this latest attack to work, but the consequences could be serious, according to Robert Hansen, the independent security researcher who first reported the attack. "All of the data on a Google desktop can now be siphoned off to an attacker's machine," he said. Cross-site scripting flaws are common Web server vulnerabilities that can be exploited to run unauthorized code within the victim's browser. Hansen, who is CEO of Sectheory.com, did not post proof of concept code for his attack, but he said that he has "tested every component of it, and it works." He has posted some details of how Google Desktop data could be compromised on his blog. Google said it was investigating Hansen's findings. "In addition, we recently added another layer of security checks to the latest version of Google Desktop to protect users from vulnerabilities related to Web search integration in the future," the company said in a prepared statement. Anti-DNS pinning is an emerging area of security research, understood by just a handful of researchers, said Jeremiah Grossman, CTO at WhiteHat Security. The variation of this attack described by Hansen manipulates the way the browser works with the Internet's DNS in order to trick the browser into sending information to an attacker's computer. "Once you can re-point Google to another IP address, instead of Google getting the traffic, the bad guy does," he said. Because this type of attack is so difficult to pull off and is poorly understood, it is unlikely to be used by the criminals any time soon, Grossman said. But anti-DNS pinning shouldn't be ignored, he added. "We should keep our eyes on it in case the bad guys shift gears." News of the attack comes as Google is trying to enter the desktop productivity market. On Thursday, Google launched a suite of Web-based collaboration software, called the Google Apps Premier Edition, that analysts sayÂ could become a competitor to Microsoft Office. The troubling thing about the attack Hanson identified, which he calls anti-anti-anti-DNS pinning, is that there is very little that can be done to avoid it short of eliminating cross-site scripting vulnerabilities on the Web. "This is really just fundamentally about how browsers work," he said. "If you allow a Web site to have access to your drive -- to modify, to change things, to integrate, or whatever -- you're relying on that Web site to be secure." Hansen and Grossman say that Google is not the only company vulnerable to a growing category of Web-based attacks. For instance, MySpace.com was hit when a fast-moving worm spread through the MySpace community in early December, stealing MySpace log-in credentials and promoting adware Web sites. "A lot of these new attack techniques are going to require the browsers to improve," Grossman said. "The users really have very little ability to protect themselves against these attacks" he said. "It's very bad. Even the experts are afraid to click on each other's links anymore." Â
140360
A Rice University computer scientist and two of his students have discovered a potentially serious security flaw in the desktop search tool for personal computers that was recently distributed by Google.
692964
Richard Stiennon, Webroot vice president of threat research, said the increasing number of desktop search tools -- now coming out from Google, Yahoo, MSN and others -- may also be leveraged by attackers.
65613
Researchers at Rice University on Monday made public a bug in Google Desktop Search that could let hackers secretly search the contents of a user&#39;s hard drive.
92815
Search site Google has inadvertently helped a worm hit thousands of websites.
555338
Security researchers have discovered a serious flaw in Google Inc.'s desktop software that could be used to wreak havoc on a victim's computer.
339881
The logic behind Google (GOOG ) Desktop Search is simple enough: Why shouldn&#39;t the best tool for finding things on the Web do equally well at helping people search their own computers?
758956
Hole could allow remote attackers to access your local search results.