Google mends security flaw in Desktop Search
121305
A handful of researchers at Rice University uncovered a security flaw in Google&#39;s Desktop Search offering that could allow attackers to view small portions of personal search results.
462478
A flaw in Google&#39;s desktop search program was revealed on Monday by a team of computer researchers. They showed it could be used to capture valuable personal information from a remote user&#39;s computer.
524116
(InfoWorld) - Google's PC search software is vulnerable to a variation on a little-known Web-based attack called anti-DNSÂ pinning that could give an attacker access to any data indexed by Google Desktop, security researchers said this week. This is the second security problem reported this week for the software. On Wednesday, researchers at Watchfire saidÂ they'd found a flaw that could allow attackers to read files or run unauthorized softwareÂ on systems running Google Desktop. As with Watchfire's bug, attackers would first need to exploit a cross-site scripting flaw in the Google.com Web site for this latest attack to work, but the consequences could be serious, according to Robert Hansen, the independent security researcher who first reported the attack. "All of the data on a Google desktop can now be siphoned off to an attacker's machine," he said. Cross-site scripting flaws are common Web server vulnerabilities that can be exploited to run unauthorized code within the victim's browser. Hansen, who is CEO of Sectheory.com, did not post proof of concept code for his attack, but he said that he has "tested every component of it, and it works." He has posted some details of how Google Desktop data could be compromised on his blog. Google said it was investigating Hansen's findings. "In addition, we recently added another layer of security checks to the latest version of Google Desktop to protect users from vulnerabilities related to Web search integration in the future," the company said in a prepared statement. Anti-DNS pinning is an emerging area of security research, understood by just a handful of researchers, said Jeremiah Grossman, CTO at WhiteHat Security. The variation of this attack described by Hansen manipulates the way the browser works with the Internet's DNS in order to trick the browser into sending information to an attacker's computer. "Once you can re-point Google to another IP address, instead of Google getting the traffic, the bad guy does," he said. Because this type of attack is so difficult to pull off and is poorly understood, it is unlikely to be used by the criminals any time soon, Grossman said. But anti-DNS pinning shouldn't be ignored, he added. "We should keep our eyes on it in case the bad guys shift gears." News of the attack comes as Google is trying to enter the desktop productivity market. On Thursday, Google launched a suite of Web-based collaboration software, called the Google Apps Premier Edition, that analysts sayÂ could become a competitor to Microsoft Office. The troubling thing about the attack Hanson identified, which he calls anti-anti-anti-DNS pinning, is that there is very little that can be done to avoid it short of eliminating cross-site scripting vulnerabilities on the Web. "This is really just fundamentally about how browsers work," he said. "If you allow a Web site to have access to your drive -- to modify, to change things, to integrate, or whatever -- you're relying on that Web site to be secure." Hansen and Grossman say that Google is not the only company vulnerable to a growing category of Web-based attacks. For instance, MySpace.com was hit when a fast-moving worm spread through the MySpace community in early December, stealing MySpace log-in credentials and promoting adware Web sites. "A lot of these new attack techniques are going to require the browsers to improve," Grossman said. "The users really have very little ability to protect themselves against these attacks" he said. "It's very bad. Even the experts are afraid to click on each other's links anymore." Â
172241
John Markoff in the New York Times reports that a computer science professor and two of his students have discovered a &quot;composition flaw&quot; in Google&#39;s desktop search application.
363703
Google&#39;s new Desktop Search software is a muscle car among search engines, racing through personal data stored inside your computer to instantly find things you can&#39;t easily locate.
375793
A potentially devastating hole in Google Inc.'s prevalent desktop search product could have exposed personal files on users' computers to data thieves. Google fixed the defect within weeks of being informed about it and says it has no evidence the vulnerability was exploited.
755302
InfoWorld - Google quickly patched what security researchers identified Wednesday was a potentially serious cross-site scripting flaw in its popular desktop search and widget application that could leave users vulnerable to outside attack.
283333
Google has patched a potentially dangerous vulnerability in its Google Desktop software that security experts say could have put the sensitive information of millions of users at risk.
727130
A potential security flaw has been found in Google&#39;s Desktop Search by a Rice University professor and two of his students. A hacker could use the glitch to search the content of someone&#39;s computer via the internet.
141049
(InfoWorld) - Just one day after a security researcher showed how Google'sÂ Firefox toolbar could be exploitedÂ in an online attack, a similar flaw has been discovered in the Google Desktop. On Thursday, Google hacker Robert Hansen posted proof of concept details showing how attackers could use Google Desktop to launch software that had already been installed on the victim's computer. The attack is hard to pull off and could not necessarily be used to install unauthorized software on the victim's PC, but it does illustrate the kind of security issues that arise with Web-based applications, said Hansen, the CEO of Web security consultancy Sectheory.com, and a contributor to the Ha.ckers.org Web site. "When you have third parties writing code that interacts with your browser, it inherently breaks the browser security model," he said. To exploit Hansen's Google Desktop vulnerability, an attacker would first have to launch a successful "man-in-the-middle" attack, somehow placing himself between the victim and Google's servers. This could by done by tricking the victim into logging onto a malicious wireless network, Hansen said. Once this was done, the hacker could launch Hansen's attack by changing the Web pages being delivered to the victim's PC. By returning Web pages that have been doctored with new JavaScript code, the victim could be tricked into clicking onto a malicious link, Hansen said. "When they actually click that mouse button, they're not clicking on the Web page, they're clicking on a link to Google Desktop that actually runs code, " he said. The steps Hansen took to pull off the attack are complex because of the security features that Google has built into its software, he added. "What I've done is combine a lot of different attacks that Google desperately tries to prevent." On Wednesday researcher Christopher Soghoian showed how a man-in-the-middle attack could be used to install malicious software on computers that used a variety of popular Firefox add-ons, including the toolbars from Google, Yahoo, and AOL. Hansen has posted a video showing how this attack could be used to launch Windows HyperTerminal. But it could be used to launch virtually any application that has already been installed on the PC, he said. This isÂ not the first bug in Google Desktop. In February, engineers at WatchfireÂ showed how a flaw in the program's Advanced Search Feature could be used to gain access to data or even run unauthorized software on a victim's computer. Two days after the Watchfire bug was disclosed, Hansen himself showed how attackers couldÂ steal information from Google Desktop usersÂ using what is called an anti-DNS (Domain Name System) pinning attack. Google was not immediately available to comment for this story. Â
624470
If you use shared or public computers, you have a new privacy risk to consider: Google Desktop Search.
339078
Researchers at Rice University have discovered what they say is a flaw in the beta version of Google's Desktop Search product that could allow third parties to access users' search result summaries, providing a sneak peek at part of the content of personal files.
679280
InfoWorld - Security researchers have discovered a serious flaw in Google&#39;s desktop software that could be used to wreak havoc on a victim&#39;s computer.
527646
Integrated attack Google has fixed a security flaw in its desktop search software that created a means for hackers to rifle through personal files on users' PCs.â¦
358859
Copernic Desktop Search does the work without Google's security flaws.
571638
(Article Central) A glitch was discovered in Google Desktop that could allow an attacker to access the contents of a PC from the Internet, according to a report in The New York Times.
555338
Security researchers have discovered a serious flaw in Google Inc.'s desktop software that could be used to wreak havoc on a victim's computer.