Google mends security flaw in Desktop Search
121305
A handful of researchers at Rice University uncovered a security flaw in Google&#39;s Desktop Search offering that could allow attackers to view small portions of personal search results.
262500
The glitch, which could permit an attacker to secretly search the contents of a personal computer via the Internet, is the kind of flaw that emerges when separate components interact.
182979
Google Desktop is vulnerable to a Web-based attack that could give an attacker access to data indexed by the software, say security researchers.
330204
SEATTLE - The latest search engine from Google could turn out to be a privacy nightmare! Once installed in a computer running Windows XP or Windows 2000 (with Service Pack 3 or higher), the Google Desktop
228672
A pair of phishing vulnerabilities this week targeted at Google Inc. point to the kind of new threat Web companies can face as they expand their services into desktop applications, security experts say.
466718
Google fixed a flaw in its beta desktop search tool that could have given hackers access to users&#39; local searches, officials said Monday.
692964
Richard Stiennon, Webroot vice president of threat research, said the increasing number of desktop search tools -- now coming out from Google, Yahoo, MSN and others -- may also be leveraged by attackers.
40526
Google's PC search software is vulnerable to a variation on a little-known Web-based attack called anti-DNS (Domain Name System) pinning, that could give an attacker access to any data indexed by Google Desktop, security researchers said this week.
555338
Security researchers have discovered a serious flaw in Google Inc.'s desktop software that could be used to wreak havoc on a victim's computer.
755302
InfoWorld - Google quickly patched what security researchers identified Wednesday was a potentially serious cross-site scripting flaw in its popular desktop search and widget application that could leave users vulnerable to outside attack.
411669
Security researchers say that Google Desktop is vulnerable to a new type of attack -- the second such disclosure this week.
266945
SAN FRANCISCO A university computer scientist and two of his students have discovered a potentially serious security flaw in the desktop search tool for personal computers that was recently distributed by Google.
524
(InfoWorld) - Security researchers have discovered a serious flaw in Google's desktop software that could be used to wreak havoc on a victim's computer. The bug, which was made public Wednesday by Watchfire, has now been fixed. While Google is automatically delivering a patch, Google Desktop users who want to be sure they are running the latest version of the software can download it here. Users should be running version 5.0.701.30540 or later, said Google Spokesman Barry Schnitt. Google was first notified of the problem on Jan. 4 and produced its fix on Feb. 1, a Watchfire spokesman said Wednesday. In addition to its bug fix, Google has added, "another layer of security checks to the latest version of Google Desktop to protect users from similar vulnerabilities in the future," Schnitt said. "We have received no reports that this vulnerability was exploited," he added. Watchfire's research underscores the danger of integrating Web-based applications with the desktop, the company said in a white paper published Wednesday. The flaw lies in a search parameter used by Google Desktop's Advanced Search feature, which could be used to execute malicious JavaScript code, according to Watchfire. For this attack to work, the criminal would have to first go through a number of steps, including hacking Google.com to find a cross site scripting vulnerability on the Web site -- something that has been done several times in the past year, according to Watchfire. If successful, however, the attack would be devastating. A criminal could search for anything on the computer or even take over the victim's computer by tricking Google desktop into running malicious software stored on another computer, Watchfire claims.
363703
Google&#39;s new Desktop Search software is a muscle car among search engines, racing through personal data stored inside your computer to instantly find things you can&#39;t easily locate.
551906
A Rice University computer scientist and two of his students discovered a potentially serious security flaw in the desktop search tool recently distributed by Google, a newspaper report said Monday.
524116
(InfoWorld) - Google's PC search software is vulnerable to a variation on a little-known Web-based attack called anti-DNSÂ pinning that could give an attacker access to any data indexed by Google Desktop, security researchers said this week. This is the second security problem reported this week for the software. On Wednesday, researchers at Watchfire saidÂ they'd found a flaw that could allow attackers to read files or run unauthorized softwareÂ on systems running Google Desktop. As with Watchfire's bug, attackers would first need to exploit a cross-site scripting flaw in the Google.com Web site for this latest attack to work, but the consequences could be serious, according to Robert Hansen, the independent security researcher who first reported the attack. "All of the data on a Google desktop can now be siphoned off to an attacker's machine," he said. Cross-site scripting flaws are common Web server vulnerabilities that can be exploited to run unauthorized code within the victim's browser. Hansen, who is CEO of Sectheory.com, did not post proof of concept code for his attack, but he said that he has "tested every component of it, and it works." He has posted some details of how Google Desktop data could be compromised on his blog. Google said it was investigating Hansen's findings. "In addition, we recently added another layer of security checks to the latest version of Google Desktop to protect users from vulnerabilities related to Web search integration in the future," the company said in a prepared statement. Anti-DNS pinning is an emerging area of security research, understood by just a handful of researchers, said Jeremiah Grossman, CTO at WhiteHat Security. The variation of this attack described by Hansen manipulates the way the browser works with the Internet's DNS in order to trick the browser into sending information to an attacker's computer. "Once you can re-point Google to another IP address, instead of Google getting the traffic, the bad guy does," he said. Because this type of attack is so difficult to pull off and is poorly understood, it is unlikely to be used by the criminals any time soon, Grossman said. But anti-DNS pinning shouldn't be ignored, he added. "We should keep our eyes on it in case the bad guys shift gears." News of the attack comes as Google is trying to enter the desktop productivity market. On Thursday, Google launched a suite of Web-based collaboration software, called the Google Apps Premier Edition, that analysts sayÂ could become a competitor to Microsoft Office. The troubling thing about the attack Hanson identified, which he calls anti-anti-anti-DNS pinning, is that there is very little that can be done to avoid it short of eliminating cross-site scripting vulnerabilities on the Web. "This is really just fundamentally about how browsers work," he said. "If you allow a Web site to have access to your drive -- to modify, to change things, to integrate, or whatever -- you're relying on that Web site to be secure." Hansen and Grossman say that Google is not the only company vulnerable to a growing category of Web-based attacks. For instance, MySpace.com was hit when a fast-moving worm spread through the MySpace community in early December, stealing MySpace log-in credentials and promoting adware Web sites. "A lot of these new attack techniques are going to require the browsers to improve," Grossman said. "The users really have very little ability to protect themselves against these attacks" he said. "It's very bad. Even the experts are afraid to click on each other's links anymore." Â
358859
Copernic Desktop Search does the work without Google's security flaws.