Google patches critical desktop flaw
527646
Integrated attack Google has fixed a security flaw in its desktop search software that created a means for hackers to rifle through personal files on users' PCs.â¦
524116
(InfoWorld) - Google's PC search software is vulnerable to a variation on a little-known Web-based attack called anti-DNSÂ pinning that could give an attacker access to any data indexed by Google Desktop, security researchers said this week. This is the second security problem reported this week for the software. On Wednesday, researchers at Watchfire saidÂ they'd found a flaw that could allow attackers to read files or run unauthorized softwareÂ on systems running Google Desktop. As with Watchfire's bug, attackers would first need to exploit a cross-site scripting flaw in the Google.com Web site for this latest attack to work, but the consequences could be serious, according to Robert Hansen, the independent security researcher who first reported the attack. "All of the data on a Google desktop can now be siphoned off to an attacker's machine," he said. Cross-site scripting flaws are common Web server vulnerabilities that can be exploited to run unauthorized code within the victim's browser. Hansen, who is CEO of Sectheory.com, did not post proof of concept code for his attack, but he said that he has "tested every component of it, and it works." He has posted some details of how Google Desktop data could be compromised on his blog. Google said it was investigating Hansen's findings. "In addition, we recently added another layer of security checks to the latest version of Google Desktop to protect users from vulnerabilities related to Web search integration in the future," the company said in a prepared statement. Anti-DNS pinning is an emerging area of security research, understood by just a handful of researchers, said Jeremiah Grossman, CTO at WhiteHat Security. The variation of this attack described by Hansen manipulates the way the browser works with the Internet's DNS in order to trick the browser into sending information to an attacker's computer. "Once you can re-point Google to another IP address, instead of Google getting the traffic, the bad guy does," he said. Because this type of attack is so difficult to pull off and is poorly understood, it is unlikely to be used by the criminals any time soon, Grossman said. But anti-DNS pinning shouldn't be ignored, he added. "We should keep our eyes on it in case the bad guys shift gears." News of the attack comes as Google is trying to enter the desktop productivity market. On Thursday, Google launched a suite of Web-based collaboration software, called the Google Apps Premier Edition, that analysts sayÂ could become a competitor to Microsoft Office. The troubling thing about the attack Hanson identified, which he calls anti-anti-anti-DNS pinning, is that there is very little that can be done to avoid it short of eliminating cross-site scripting vulnerabilities on the Web. "This is really just fundamentally about how browsers work," he said. "If you allow a Web site to have access to your drive -- to modify, to change things, to integrate, or whatever -- you're relying on that Web site to be secure." Hansen and Grossman say that Google is not the only company vulnerable to a growing category of Web-based attacks. For instance, MySpace.com was hit when a fast-moving worm spread through the MySpace community in early December, stealing MySpace log-in credentials and promoting adware Web sites. "A lot of these new attack techniques are going to require the browsers to improve," Grossman said. "The users really have very little ability to protect themselves against these attacks" he said. "It's very bad. Even the experts are afraid to click on each other's links anymore." Â
329888
Google says it has patched a hole in its search engine that could have allowed hackers to modify the content of the Google search results page, reports PC World.
22729
(InfoWorld) - Google has released a new version of its desktop search tool, adding a preview feature to help find information more quickly and making some improvements to the interface design. The update, Google Desktop Version 5, also has some new security features to fight phishing and other online attacks. Its release comes after security researchersÂ reported some security holesÂ in the search tool last month. Google Desktop is a free tool that indexes the content on a PC, including e-mail, text documents and Web pages visited, and makes it available for searching. It also includes "gadgets," or small applications that sit on the desktop and display news headlines, a calendar, a to-do list and other information. MicrosoftÂ and Yahoo offer competing tools, here and here. A search in Google Desktop produces a list of results, including the file name and a snippet of the text. Several results can sometimes look similar, so Google has added a preview tool in version 5 that can show the contents of a file without having to launch the application it was created with, it said. The update also aims to fight phishing and malicious code hidden in Web sites. If a user clicks on a Web link in an email or other document, the new Google Desktop will alert the user if it thinks the Web site is going to try to steal information or download malicious code. Version 5 also updates the sidebar, a vertical control panel on the left of the screen. It can now "sample" the color of wallpaper on a PC and change its color to blend in, Google said. It also updates the appearance of the gadgets to make them easier to sort through and view. The new version, which is still in beta like a lot of other Google software, was announced Tuesday in the Google Desktop Blog. Google Desktop has come under fire from security researchers in recent weeks. In February, researchers at Watchfire said they'd found a flaw that could allow attackers to read files or run unauthorized software on systems running Google Desktop.Â Google patched the flaw, but the researchers said the software could be vulnerable to similar threats in the future. They reported a second flaw later in the month, and Google began investigating it. Google is also trying to enter the broader desktop productivity market. Last month it launched a suite of Web-based software called Google Apps Premier Edition, which analysts say could become a competitor to Microsoft Office. Â
618884
An alert posted on the company&#39;s Web site outlined the patches that should be posted to fix numerous security holes in a number of applications.
553531
Google Inc. said on Thursday it fixed a flaw in its site that could allow outsiders to launch phishing attacks based on Google&#39;s familiar interface, and is working on a second fix for another similar vulnerability.
176052
Microsoft has issued a patch to fix the security flaw, and urges its customers to use a new utility to locate the computer applications that are vulnerable.
382634
Google plugs security holes in popular desktop search software that could open up data on a PC to intruders.
665395
Just one day after Google's Firefox toolbar was revealed to have vulnerabilities that could be exploited in an online attack, a similar flaw has been discovered in Google Desktop.
406505
HOUSTON - A computer scientist and two of his graduate students at Rice University found a security flaw in a search tool distributed by Google, allowing the popular Web site to fix the problem.
375793
A potentially devastating hole in Google Inc.'s prevalent desktop search product could have exposed personal files on users' computers to data thieves. Google fixed the defect within weeks of being informed about it and says it has no evidence the vulnerability was exploited.
383745
Web search powerhouse Google has acknowledgedâand patchedâa security vulnerability in its desktop search utility that opens the doors for man-in-the-middle data leak attacks.
679280
InfoWorld - Security researchers have discovered a serious flaw in Google&#39;s desktop software that could be used to wreak havoc on a victim&#39;s computer.
17746
SEATTLE -- Microsoft released a patch for its latest &quot;critical&quot; rated security flaw affecting its Windows, Office and developer tools software programs, the company said Tuesday.
543022
Code that exploits a serious, yet-to-be-patched hole in Microsoft's Web browser has been posted on the Net.
140360
A Rice University computer scientist and two of his students have discovered a potentially serious security flaw in the desktop search tool for personal computers that was recently distributed by Google.
517091
Fixes made for "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite.