Google Security API Spots Dangerous URLs
553729
Google's experimental API lets other programs access its blacklist of Web sites that may host malware.
724391
Security experts warn of banner ads with a bad attitude--and a link to malicious code. Also: Phishers, be gone.
367211
Days after sample attack code for a yet-to-be-patched flaw surfaced, malicious sites are popping up that exploit the hole.
615818
A new worm has been detected that uses Google to find vulnerable phpBB forums. The worm - named Net-Worm.Perl.Santy.a - queries Google to find sites using outdated versions of the phpBB forum software which can be exploited.
607294
Recently disclosed security holes that affect Internet Explorer 7 and Firefox could let attackers grab data via malicious Web sites.
141049
(InfoWorld) - Just one day after a security researcher showed how Google'sÂ Firefox toolbar could be exploitedÂ in an online attack, a similar flaw has been discovered in the Google Desktop. On Thursday, Google hacker Robert Hansen posted proof of concept details showing how attackers could use Google Desktop to launch software that had already been installed on the victim's computer. The attack is hard to pull off and could not necessarily be used to install unauthorized software on the victim's PC, but it does illustrate the kind of security issues that arise with Web-based applications, said Hansen, the CEO of Web security consultancy Sectheory.com, and a contributor to the Ha.ckers.org Web site. "When you have third parties writing code that interacts with your browser, it inherently breaks the browser security model," he said. To exploit Hansen's Google Desktop vulnerability, an attacker would first have to launch a successful "man-in-the-middle" attack, somehow placing himself between the victim and Google's servers. This could by done by tricking the victim into logging onto a malicious wireless network, Hansen said. Once this was done, the hacker could launch Hansen's attack by changing the Web pages being delivered to the victim's PC. By returning Web pages that have been doctored with new JavaScript code, the victim could be tricked into clicking onto a malicious link, Hansen said. "When they actually click that mouse button, they're not clicking on the Web page, they're clicking on a link to Google Desktop that actually runs code, " he said. The steps Hansen took to pull off the attack are complex because of the security features that Google has built into its software, he added. "What I've done is combine a lot of different attacks that Google desperately tries to prevent." On Wednesday researcher Christopher Soghoian showed how a man-in-the-middle attack could be used to install malicious software on computers that used a variety of popular Firefox add-ons, including the toolbars from Google, Yahoo, and AOL. Hansen has posted a video showing how this attack could be used to launch Windows HyperTerminal. But it could be used to launch virtually any application that has already been installed on the PC, he said. This isÂ not the first bug in Google Desktop. In February, engineers at WatchfireÂ showed how a flaw in the program's Advanced Search Feature could be used to gain access to data or even run unauthorized software on a victim's computer. Two days after the Watchfire bug was disclosed, Hansen himself showed how attackers couldÂ steal information from Google Desktop usersÂ using what is called an anti-DNS (Domain Name System) pinning attack. Google was not immediately available to comment for this story. Â
228672
A pair of phishing vulnerabilities this week targeted at Google Inc. point to the kind of new threat Web companies can face as they expand their services into desktop applications, security experts say.
285360
Blog: Researcher shows how URLs can be spoofed and content arbitrary within Safari 3.0 beta.
365486
A security company has identified a Trojan horse program that replaces Google text advertisements on Web pages with ads from another source, depriving Google of revenue and potentially causing problems for end users.Google may be powerless to stop the trick since it involves the modification of an internal PC file, called the hosts file, that is used to match domain names of Web sites with IP (Internet protocol) addresses, said Romanian security company BitDefender.When a person visits a Web site, the browser checks the hosts file to see if it has an IP address for a particular domain name. If the hosts file is corrupted or hijacked, the browser can be directed to fetch a different Web page than the one the user intended to.Modifying the hosts file can be done for legitimate reasons. For example, PC users can change the hosts to block banner ads served from known ad networks. When a Web page tries to contact an ad server, the request is diverted by the hosts file and no ad appears.BitDefender said in an advisory this particular malware directs a browser to download advertisements from a different server than Google&#39;s ad server.BitDefender named the malware Trojan.Qhost.WU and said it is not spreading fast and poses a &quot;medium&quot; risk of damage. It did not say how the Trojan is being circulated, and company representatives did not return a call for comment.Besides costing Google ad revenue, there is a danger that those replacement advertisements could contain links to sites with malicious software, BitDefender said. Web site owners who buy ads through Google, as well as Google itself, can lose out on both Web traffic and revenue if people are diverted from its ads.There is not much that Google can do for those who download the malware. However, security products such as BitDefender&#39;s can detect and remove it.Without commenting on the Trojan specifically, Google said it removes Web sites from its search index that contain malware.&quot;We have canceled customer accounts that display ads re-directing users to malicious sites or that advertise a product violating our software principles,&quot; the company said in a statement.
638921
Security firm Secunia has issued an advisory regarding a newly discovered "highly critical" security flaw in Firefox 2.0 and later, which involves a special URI handler. Although the problem was initially attributed to Internet Explorer by researcher Thor Larholm, Firefox is the culprit.
182979
Google Desktop is vulnerable to a Web-based attack that could give an attacker access to data indexed by the software, say security researchers.
306958
The latest malware trend should prompt you to think twice about the links you click next time you search.
355754
Hot Fuzz Google is developing an automated tool for finding common web application vulnerabilities.â¦
115940
Streaming malware Video clips from YouTube might come booby-trapped with malware, security watchers warn.â¦
78443
Flaw in the way the Net phone software handles Web links could enable an attacker to launch arbitrary code on some Macs.
598555
People who use public or workplace computers for e-mail, instant messaging and Web searching have a new security risk to worry about: Google&#39;s free new tool that indexes a PC&#39;s contents for quickly locating data.
734719
(InfoWorld) - Google quickly patched what security researchers identified Wednesday was a potentially serious cross-site scripting flaw in its popular desktop search and widget application that could leave users vulnerable to outside attack. In a report, researchers at application security software maker Watchfire, based in Waltham, Mass., detailed an existing attack designed to exploit the Google Desktop flaw. Watchfire said the cross-site scripting threat -- which it described as a parasitic virus -- could allow attackers to steal information from affected PCs and track end users' Web browsing habits. Cross-site scripting (XSS) threats typically take advantage of security vulnerabilities in legitimate Web pages to inject malicious content into the browsers of people visiting the URLs or to redirect them to fraudulent sites used in phishing attacks. Like many other XSS threats, the attack currently leveled at Google Desktop uses JavaScript code to deliver its payload. Watchfire experts said the Google Desktop XSS problem was very dangerous for a number of reasons. Among the more serious characteristics is the malicious program's ability to affect clusters of computers connected by Google Desktop's information sharing capabilities. This could allow attackers to spread the attack to new machines or simply steal data from multiple PCs linked by the application. Most enterprises have invested significant amounts of time and money installing security applications to protect against the loss of sensitive data over the last several years, but a Google Desktop attack would circumvent many of those systems, leaving information on corporate desktops running the program open for potential theft. "This attack is almost undetectable, it won't get picked up by any anti-virus system or firewall, and it can be used in a lot of different ways to harm end users," said the director of security research at Watchfire, Danny Allen. "It allows someone using the attack to control all the applications on a computer or access the network to which an affected machine is attached, and it is almost impossible to get rid of." As part of a demonstration of the exploit, Allen showed off how the program could be used to change the version number in the Google Desktop application itself. Doing so could allow attackers to fool users of the desktop search program into believing they have a version of the software that has been fixed for security reasons, when in fact they are still potentially vulnerable. "Some IT security people have dismissed the impact of [cross-site scripting] attacks to a certain extent, but we wanted to highlight the potential damage that something like this could deliver," Allen said. Media representatives at Google said that after Watchfire informed the company of the attack, engineers at the search giant created a patch for the issue that was automatically distributed to Google Desktop users. Google said it has also added a new set of security features to the latest iteration of the product to prevent similar attacks in the future. On Feb. 9, Google launched its newest version of the desktop search program, labeled Desktop 3 Beta. Company representatives said that they have not received any reports of the vulnerability being exploited on end-users' machines. Watchfire researchers said the new security patch appears to fix the flaw and prevent XSS attacks on users of Google Desktop whose systems have been updated. Security analysts considering the problem said it highlighted the need for businesses to look carefully at programs such as Google Desktop that straddle the line between personal and professional PC usage. Although the application may be very useful, and most often gets pulled into the corporate environment by people who use it at home, Google is not a maker of business-grade software and doesn't follow the same security processes as large manufacturers of such products, said John Pescatore, analyst at Gartner. Unlike Microsoft, Oracle, or Sun Microsystems, Google does not publish regular security bulletins or even offer specific details of issues it has already fixed, Pescatore said. This reason, along with the data security issues that can be introduced when Google Desktop isn't configured to bar users from inadvertently sharing search information with outsiders, poses serious questions for corporate IT administrators who must decide whether to allow people to use it in the office, according to the analyst. "The major concern is that while Google isn't an enterprise software vendor, programs it makes, including Google Desktop, are ending up on a lot of enterprise desktops," Pescatore said. "Google doesn't expose how it does patches like Microsoft, so how does an enterprise even know if their users are working with the version that has been fixed?" As malware writers and phishing scheme operators continue to hone their attacks to steal smaller amounts of valuable data from pools of targeted users, and move further away from the massive worm viruses of years past, the IT world will see more XSS threats. "There will be more funded cyber-crime attacks aimed at specific companies and groups of users, and the size of the threats is such, by design, that they won't land on the six o'clock news," Pescatore said. "The perpetrators will continue to increase the volume of these types of threats, and cross-site scripting and targeted phishing will likely be among their favorite formats for doing so." The bug, which was made public Wednesday by Watchfire, has now been fixed. While Google is automatically delivering a patch, Google Desktop users who want to be sure they are running the latest version of the software can download it here. Users should be running version 5.0.701.30540 or later, said Google Spokesman Barry Schnitt. Google was first notified of the problem on Jan. 4 and produced its fix on Feb. 1, a Watchfire spokesman said Wednesday. In addition to its bug fix, Google has added, "another layer of security checks to the latest version of Google Desktop to protect users from similar vulnerabilities in the future," Schnitt said. "We have received no reports that this vulnerability was exploited.â Robert McMillan of IDG News Service contributed to this report.