Google acts to cover up phishing hole
547363
Google on Thursday fixed a security flaw in its Web search service that could have allowed malicious hackers to modify its pages. According to a report posted to the Bugtraq Security Focus list on Wednesday
85579
(InfoWorld) - Google Inc. has inadvertently given online attackers a new tool. The company'sÂ new source-code search engine, unveiled Thursday as a tool to help simplify life for developers, can also be misused to search for software bugs, password information, and even proprietary code that shouldn't have been posted to the Internet in the first place, security experts said Friday. UnlikeÂ Google's main Web search engine,Â Google Code Search peeks into the actual lines of code whenever it finds source-code files on the Internet. This will make it easier for developers to search source code directly and dig up open-source tools they may not have known about, but it has a drawback. "The downside is that you could also use that kind of search to look for things that are vulnerable and then guess who might have used that code snippet and then just fire away at it," said Mike Armistead, vice president of products with source-code analysis provider Fortify Software Inc. Attackers could also search code for vulnerabilities in password mechanisms, or to search for phrases within software such as "this file contains proprietary," possibly unearthing source code that should never have been posted to the Internet. Security experts say that the security implications of Google Code Search are noteworthy, if not earth-shattering. Skilled hackers may already be able to do this type of search with Google's Web search engine, but Code Search is "another tool that makes it a tad easier for the attacker," said Johnny Long, a security researcher with Computer Sciences Corp, in an e-mail interview. For its part, Google did not have much to say about possible misuse of its new product. "Google recommends developers use generally accepted good coding practices including understanding the implications of the code they implement and testing appropriately," the company said in a statement. Google has never said much about the steps it takes to cut down on this kind of misuse of its search engine, though the issue comes up from time to time.Â In July, Websense Inc. used a little know binary search capability within Google Inc.'s search engine to look for malware on the Internet. While Google Code Search will probably not have much of an effect on popular open-source projects, which are already heavily scrutinized, it could help ferret out vulnerabilities in lesser known pieces of code, according to Lev Toger, a software developer with Beyond Security Ltd. "Using Google's code search, it's much easier to find interesting code portions," he said via e-mail. "If your task is to find vulnerability in some random code, this filtering can save you a lot of time. " Â
734135
Google's search appliances could expose Web sites that use the products to information-stealing phishing attacks.
592284
Update to free browser will warn people if a Web site looks like a phishing scam, its maker says.
49498
THE PROBLEM with phpBB software, which we reported on this time yesterday is over. And it&#39;s thanks to Google, it appears. F-Secure said that the Santy worm, which defaced web sites and used a Google search
558542
Easy-peasy-sleazy: A new piece of PHP code making the malware rounds can install a phishing site on a compromised server in about two minutes.
721294
Dec 10, 2004: A new web browser security hole has been uncovered by a security firm, which could provide scammers with the means to launch phishing attacks from pop-up windows on genuine, trusted websites.
195853
Google, Inc., one of the top most search engines, informed that it has fixed the flaw that was discovered by Rice Universityâs researchers.
280141
Google gets into the Web registration business.
3000
Google fixed a flaw in its Google Desktop Search(GDS)that could have given hackers access to users&#39; local searches, officials said Monday.
550626
Company patches one search engine security flaw and is notified of another.
669209
Ziff Davis - Google's phishing vulnerabilities could foretell new security threats for major Internet companies cozying up to the desktop.
671152
Code that lets organizations put search tool on their own pages could have given a toehold to scammers.
406505
HOUSTON - A computer scientist and two of his graduate students at Rice University found a security flaw in a search tool distributed by Google, allowing the popular Web site to fix the problem.
418284
GADFLY ALREADY the internet age has given us 'phishing', when criminals use emails to persuade you to give them your bank details.  Now it seems we have the less crooked but nonetheless enraging online experience of 'philfing'  an acronym for 'purposely hiding what I'm looking for'.
317554
Computer criminals are making phishing more potent by automating attacks. Anti-Phishing Working Group (APWG) analysts reckon fraudsters are using automated tools and botnets to ramp up attacks.
558823
(InfoWorld) - Google Inc. has enhanced the way it notifies webmasters that their sites contain malware, improving on a service the Mountain View, California, company launched in November of last year in a partnership with The Stop Badware Coalition . Google has begun providing more detailed alerts and to send these notifications via e-mail to webmasters, according to a posting Monday on an official Google blog. Previously, Google only informed webmasters that their sites had been identified as having malware and made generic suggestions for fixing the problem. Now, the company also points webmasters to specific offending pages from their sites that Google has determined contain malicious components. "This can be helpful when the malicious content is hard to find," the posting reads. "By providing example URLs, webmasters are one step closer to diagnosing the problem and ultimately re-securing their sites." Before, Google notified webmasters by placing a note in the site's summary page in Google's Webmaster Tools site , but now it is sending the alert via e-mail as well. Google flags Web sites according to guidelines set by The Stop Badware Coalition. Webmasters who feel their sites have been incorrectly flagged as having malware need to contact the coalition and request a review. In August, and also in conjunction with The Stop Badware Coalition, Google started displaying malware alerts for users of its search engine. When users attempt to click over to a Web site considered to be potentially dangerous, Google shows an alert page that informs them of the possible risk and gives them the option to click back to the results page or continue on to the questionable Web site. However, these alerts sometimes anger webmasters who are convinced their sites don't contain malware. The Stop Badware Coalition is a nonprofit organization led by Harvard University and the University of Oxford and backed by Google, Lenovo Group Ltd. and Sun Microsystems Inc. A study published in May of last year by security vendor McAfee Inc.'s SiteAdvisor unit found that U.S. Internet users land on malicious Web sites about 285 million times per month by clicking on search results from the five major search engines, which are operated by Google, Yahoo Inc., Microsoft Corp.'s MSN unit, IAC/InterActiveCorp's Ask.com and Time Warner Inc.'s AOL LLC. Malicious Web sites are those that download spyware and adware to visitors' PCs, exploit security vulnerabilities and attempt to scam users and include them in spam lists, among other dangers. Â