Google Patches Serious Desktop Flaw
555338
Security researchers have discovered a serious flaw in Google Inc.'s desktop software that could be used to wreak havoc on a victim's computer.
22770
Unpatched Windows machines are vulnerable to latest adware attack
339078
Researchers at Rice University have discovered what they say is a flaw in the beta version of Google's Desktop Search product that could allow third parties to access users' search result summaries, providing a sneak peek at part of the content of personal files.
86222
In brief Exploit circulating for unpatched vuln
571638
(Article Central) A glitch was discovered in Google Desktop that could allow an attacker to access the contents of a PC from the Internet, according to a report in The New York Times.
524116
(InfoWorld) - Google's PC search software is vulnerable to a variation on a little-known Web-based attack called anti-DNSÂ pinning that could give an attacker access to any data indexed by Google Desktop, security researchers said this week. This is the second security problem reported this week for the software. On Wednesday, researchers at Watchfire saidÂ they'd found a flaw that could allow attackers to read files or run unauthorized softwareÂ on systems running Google Desktop. As with Watchfire's bug, attackers would first need to exploit a cross-site scripting flaw in the Google.com Web site for this latest attack to work, but the consequences could be serious, according to Robert Hansen, the independent security researcher who first reported the attack. "All of the data on a Google desktop can now be siphoned off to an attacker's machine," he said. Cross-site scripting flaws are common Web server vulnerabilities that can be exploited to run unauthorized code within the victim's browser. Hansen, who is CEO of Sectheory.com, did not post proof of concept code for his attack, but he said that he has "tested every component of it, and it works." He has posted some details of how Google Desktop data could be compromised on his blog. Google said it was investigating Hansen's findings. "In addition, we recently added another layer of security checks to the latest version of Google Desktop to protect users from vulnerabilities related to Web search integration in the future," the company said in a prepared statement. Anti-DNS pinning is an emerging area of security research, understood by just a handful of researchers, said Jeremiah Grossman, CTO at WhiteHat Security. The variation of this attack described by Hansen manipulates the way the browser works with the Internet's DNS in order to trick the browser into sending information to an attacker's computer. "Once you can re-point Google to another IP address, instead of Google getting the traffic, the bad guy does," he said. Because this type of attack is so difficult to pull off and is poorly understood, it is unlikely to be used by the criminals any time soon, Grossman said. But anti-DNS pinning shouldn't be ignored, he added. "We should keep our eyes on it in case the bad guys shift gears." News of the attack comes as Google is trying to enter the desktop productivity market. On Thursday, Google launched a suite of Web-based collaboration software, called the Google Apps Premier Edition, that analysts sayÂ could become a competitor to Microsoft Office. The troubling thing about the attack Hanson identified, which he calls anti-anti-anti-DNS pinning, is that there is very little that can be done to avoid it short of eliminating cross-site scripting vulnerabilities on the Web. "This is really just fundamentally about how browsers work," he said. "If you allow a Web site to have access to your drive -- to modify, to change things, to integrate, or whatever -- you're relying on that Web site to be secure." Hansen and Grossman say that Google is not the only company vulnerable to a growing category of Web-based attacks. For instance, MySpace.com was hit when a fast-moving worm spread through the MySpace community in early December, stealing MySpace log-in credentials and promoting adware Web sites. "A lot of these new attack techniques are going to require the browsers to improve," Grossman said. "The users really have very little ability to protect themselves against these attacks" he said. "It's very bad. Even the experts are afraid to click on each other's links anymore." Â
411669
Security researchers say that Google Desktop is vulnerable to a new type of attack -- the second such disclosure this week.
92344
Blog: The most serious involves poisoned PDF files. The update also includes patches for Bind, Fetchmail, and GNU Screen.
466718
Google fixed a flaw in its beta desktop search tool that could have given hackers access to users&#39; local searches, officials said Monday.
736801
Google Inc.  said on Monday it has fixed a software flaw that could allow hackers to view information contained on personal computers running the No. 1 search engine's desktop search software.
148871
Onslaught of Google bugs continues Google security lieutenants can't get a break. Over the past week, they've taken a public pounding, following reports of at least four previously undisclosed holes that included new cracks in Gmail and weaknesses that jeopardize the privacy of those who rely on the site to organize photos or administer their websites.â¦
618884
An alert posted on the company&#39;s Web site outlined the patches that should be posted to fix numerous security holes in a number of applications.
610288
Revamped Google Desktop improves security, adds preview and 'sidebar.'
63906
Shortly after the discovery of a potentially harmful flaw in Google&#39;s beta Desktop Search software, the search firm announced on Monday that a fix for the problem has already been developed and automatically pushed out to users.
298762
Microsoft's IE (Internet Explorer) browser has an unpatched vulnerability that could let hackers hijack, then access, Google Gmail accounts, a California security company warned Monday.IE, said Santa Clara-based Cenzic in an alert issued Monday, contains an unspecified cached files bug that, when combined with a cross-site request forgery flaw in the Web-based e-mail service, exposes Gmail account sign-ons and lets others access those accounts and any messages or file attachments there.Although not a bug that can be leveraged remotely -- an attacker must have local, physical access to the PC -- as Cenzic pointed out in its alert, there are scenarios where that's not a limitation. "These vulnerabilities could be exploited such that all users of a shared computer who use Internet Explorer and share a user account -- a common practice at computer kiosks in a library or Internet cafe -- could be vulnerable," said Cenzic.Gmail contributes to the overall vulnerability because its URLs display attachments when viewed using the "View Source" command, the warning went on. IE, however, sports "improper use of caching directives [and] incorrect access checks on cached Internet Explorer files."Together, the bugs could conceivably let someone at a public PC hijack any Gmail log-on credentials that had been entered on the machine since the IE cache had last been purged. IE deletes the contents of its cache only as new files are added -- and the oldest are deleted -- or when the user explicitly instructs the browser to clear the cache using the "Delete Browsing History" command.Microsoft denied that IE even has a bug. "Microsoft has thoroughly investigated the claim and found that this is not a product vulnerability," said a company spokesman Tuesday morning. "In the scenario in question, an attacker would need authenticated access to the system in order to modify files located in the cache. With that level of access, an attacker could install malicious programs that would have more impact than the scenarios described."While true, that did not address Cenzic's scenario; by design, public PCs such as those in libraries, schools or Web cafes do not require authentication to access. Microsoft was not available for clarification.Google did not immediately respond to questions about Gmail's part in the threat
527646
Integrated attack Google has fixed a security flaw in its desktop search software that created a means for hackers to rifle through personal files on users' PCs.â¦
189807
Browser flaw may leave you vulnerable to phishing attacks.