Google Toolbar Security Warning
601965
Google Toolbar Security Warning  As many of the readers of Search Engine Journal (including myself) probably have the Google Toolbar installed on your machines, we thought that this warning is quite relevant. The Google Toolbar apparently has a security hole which has been posted on SecurityTracker.com.   It is reported that the ...
619820
(InfoWorld) - A vulnerability in Ask.com's toolbar for Internet Explorer could allow an attacker to take control of a person's computer, according to security advisories. The problem concerns a buffer overflow flaw in the toolbar and involves an ActiveX control, according to an advisory posted by security vendor Secunia APS, which rated the problem as "highly critical," its second most severe rating. It affects version 4.0.2 of the toolbar and possibly others. Proof-of-concept exploit code for the vulnerability has been publicly posted on other disclosure forums, with a person named "Joey Mengele" credited with finding the flaw. Ask.com officials contacted in London were not immediately able to comment. The Ask.com toolbar sits below the address bar and can perform a variety of category-specific searches, such as weather information, stock quotes, or search a person's desktop as well as regular Web searching. As of Tuesday afternoon local time,Â WabiSabi Labi, a Swiss company that specializes in selling vulnerability information, was still auctioning the Ask.com toolbar problem for minimum of â¬500 ($705), although no bids were listed. WabiSabi Labi's auctioning of security vulnerabilities has caused a stir among security analysts who believe software companies should be discreetly notified of vulnerabilities and allowed to patch the software so as to not put users in danger. The company maintains security researchers should be rewarded for their work.
758956
Hole could allow remote attackers to access your local search results.
56130
Users should be wary of pressing the 'click here to remove' link on spam messages because it serves to confirm to spammers that junk mail messages are being read.
320458
Web servers may be vulnerable to attack, security company warns.
558823
(InfoWorld) - Google Inc. has enhanced the way it notifies webmasters that their sites contain malware, improving on a service the Mountain View, California, company launched in November of last year in a partnership with The Stop Badware Coalition . Google has begun providing more detailed alerts and to send these notifications via e-mail to webmasters, according to a posting Monday on an official Google blog. Previously, Google only informed webmasters that their sites had been identified as having malware and made generic suggestions for fixing the problem. Now, the company also points webmasters to specific offending pages from their sites that Google has determined contain malicious components. "This can be helpful when the malicious content is hard to find," the posting reads. "By providing example URLs, webmasters are one step closer to diagnosing the problem and ultimately re-securing their sites." Before, Google notified webmasters by placing a note in the site's summary page in Google's Webmaster Tools site , but now it is sending the alert via e-mail as well. Google flags Web sites according to guidelines set by The Stop Badware Coalition. Webmasters who feel their sites have been incorrectly flagged as having malware need to contact the coalition and request a review. In August, and also in conjunction with The Stop Badware Coalition, Google started displaying malware alerts for users of its search engine. When users attempt to click over to a Web site considered to be potentially dangerous, Google shows an alert page that informs them of the possible risk and gives them the option to click back to the results page or continue on to the questionable Web site. However, these alerts sometimes anger webmasters who are convinced their sites don't contain malware. The Stop Badware Coalition is a nonprofit organization led by Harvard University and the University of Oxford and backed by Google, Lenovo Group Ltd. and Sun Microsystems Inc. A study published in May of last year by security vendor McAfee Inc.'s SiteAdvisor unit found that U.S. Internet users land on malicious Web sites about 285 million times per month by clicking on search results from the five major search engines, which are operated by Google, Yahoo Inc., Microsoft Corp.'s MSN unit, IAC/InterActiveCorp's Ask.com and Time Warner Inc.'s AOL LLC. Malicious Web sites are those that download spyware and adware to visitors' PCs, exploit security vulnerabilities and attempt to scam users and include them in spam lists, among other dangers. Â
200263
Secunia issued a warning that the so-called tabbed browsing function in many alternative Web browsers from Mozilla, Opera, Netscape, Avant, Camino and others leave users vulnerable to spoofed
437595
Hackers can drop malicious code into systems running Firefox when the browser is armed with Google Toolbar, Yahoo Toolbar, or other add-ons.
267586
Security researchers have warned of a vulnerability in most web browsers that could let scammers launch phishing attacks from pop-up windows on trusted websites.
191059
A serious flaw in Google's desktop software could be used to wreak havoc on a victim's PC.
571745
Two Google site vulnerabilities that could be used to mount phishing attacks have been reported, says the Internet search giant. It already has fixed one, and expects to patch the second shortly.
141142
Firefox Toolbar: A set of search toolbars for Mozilla users  Yet another search toolbar! But fortunately unlike most Internet Explorer only toolbars it is for the users of the alternate open source browser Firefox and Mozilla. Firefox Toolbar is a set of free toolbars made by a company called Vpop Technologies ...
657731
Google is working to fix a bug in the Google Toolbar that could allow criminals to steal data or install malicious software on a system, a security researcher warned Tuesday.The flaw lies in the mechanism Google Toolbar uses to add new buttons on the browser. Because the toolbar does not perform adequate checks when new buttons are being installed, a hacker could make his button appear as though it was being downloaded from a legitimate site when in fact it came from somewhere else. By spoofing the origin of the toolbar button, an attacker could download malicious files or launch a phishing attack against the victim, wrote security researcher Aviv Raff in a blog post on the issue.Raff has posted proof of concept code, showing how such an attack would work with the Internet Explorer browser. A Google spokeswoman confirmed Tuesday that the company is working to fix the problem.The attack requires many steps. First, the victim would have to be tricked into clicking on a Web link that would then pop up a window asking the user if he wants to install a custom button on his toolbar. Because of the flaw, this alert could look like it was downloading the button from a legitimate site, such as Google.com, even if it were not. Once the button was installed on the toolbar, the victim would then have to click on it and, finally, agree to download and run an executable file for the malicious software to be installed.Because the user would have to go through so many steps in order to fall victim to the attack, the bug isn&#39;t a critical one, said Marc Maiffret, an independent security researcher. &quot;While it is interesting, it&#39;s probably a low threat compared to other flaws out there,&quot; he said.Still, it was sloppy work on Google&#39;s part to miss such a simple attack, he said. &quot;They should definitely assess how it slipped through the cracks,&quot; he said.This is not the first obvious Google flaw that Raff has found. Last month, he showed how a simple Web programming error on the Google.com Web site could allow attackers to launch what&#39;s known as a cross-site scripting attack.Because Google&#39;s programmers didn&#39;t properly check the HTML generated by the Google search engine, Raff was able to create a specially crafted Google link that, when clicked by the victim, would trick the browser into running unauthorized scripting code. This type of link could be used to steal the victim&#39;s Google account or conduct phishing attacks, Raff saidThis error was fixed by Google just hours after Raff notified the company of the problem, but a demo of the flaw being exploited can be seen online.
134325
With four in the last week, is Google the next security buffoon? Analysis Google's desktop search application is vulnerable to an exploit that allows a determined attacker to remotely run most programs installed on a victim's machine. The flaw is one of at least four security holes to visit Google this past week, demonstrating that the search king, despite the god-like aura it enjoys for its pleasing software designs, remains a mere mortal in the security cosmos.â¦
689090
Mozilla Corp. has acknowledged that hackers can drop malicious code into systems running Firefox when the browser is armed with any of several high-profile add-ons, including Google Toolbar and Yahoo Toolbar.
724391
Security experts warn of banner ads with a bad attitude--and a link to malicious code. Also: Phishers, be gone.
141049
(InfoWorld) - Just one day after a security researcher showed how Google'sÂ Firefox toolbar could be exploitedÂ in an online attack, a similar flaw has been discovered in the Google Desktop. On Thursday, Google hacker Robert Hansen posted proof of concept details showing how attackers could use Google Desktop to launch software that had already been installed on the victim's computer. The attack is hard to pull off and could not necessarily be used to install unauthorized software on the victim's PC, but it does illustrate the kind of security issues that arise with Web-based applications, said Hansen, the CEO of Web security consultancy Sectheory.com, and a contributor to the Ha.ckers.org Web site. "When you have third parties writing code that interacts with your browser, it inherently breaks the browser security model," he said. To exploit Hansen's Google Desktop vulnerability, an attacker would first have to launch a successful "man-in-the-middle" attack, somehow placing himself between the victim and Google's servers. This could by done by tricking the victim into logging onto a malicious wireless network, Hansen said. Once this was done, the hacker could launch Hansen's attack by changing the Web pages being delivered to the victim's PC. By returning Web pages that have been doctored with new JavaScript code, the victim could be tricked into clicking onto a malicious link, Hansen said. "When they actually click that mouse button, they're not clicking on the Web page, they're clicking on a link to Google Desktop that actually runs code, " he said. The steps Hansen took to pull off the attack are complex because of the security features that Google has built into its software, he added. "What I've done is combine a lot of different attacks that Google desperately tries to prevent." On Wednesday researcher Christopher Soghoian showed how a man-in-the-middle attack could be used to install malicious software on computers that used a variety of popular Firefox add-ons, including the toolbars from Google, Yahoo, and AOL. Hansen has posted a video showing how this attack could be used to launch Windows HyperTerminal. But it could be used to launch virtually any application that has already been installed on the PC, he said. This isÂ not the first bug in Google Desktop. In February, engineers at WatchfireÂ showed how a flaw in the program's Advanced Search Feature could be used to gain access to data or even run unauthorized software on a victim's computer. Two days after the Watchfire bug was disclosed, Hansen himself showed how attackers couldÂ steal information from Google Desktop usersÂ using what is called an anti-DNS (Domain Name System) pinning attack. Google was not immediately available to comment for this story. Â