Feeds

Google finally fixes Desktop security vuln

Staff: 'Gone phishing'

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

The first flaw in Google's Desktop Search product has been discovered, and now fixed, according to the giant ad broker. The JavaScript vulnerability allowed third party websites to view the results of searches made on your local hard drive. It took Google four days to address the problem, and according to the Javascript expert who raised the alarm, it still hasn't been adequately patched.

Software developer Jim Ley, who maintains the comp.lang.javascript FAQ, announced the flaw on Monday on his weblog. But nobody noticed. Ley's email message to security@google.com bounced. He looked in vain for a security hotline number.

On Tuesday he demonstrated an ingenious potential application of the bug: a phishing exploit that announced that Google was becoming a subscription service, and invited the victim to enter their credit card details. Still no response.

Google finally sat up and took notice after the vulnerability was posted on the Security Focus BugTraq mailing list. Google couldn't explain why it didn't have a working email or phone contact for security alerts, but according to Jim, seemed anxious that he remove the phishing example.

In fact as he points out, the vulnerability is over two years old.

"Hopefully Google will get in touch explain what went wrong with the communication of the issue, hopefully Google will realise that a phone number of the security team on the web would also help," he writes.

"The fix they put in place is still flawed, it relies on special casing the vbscript, javascript and perlscript strings, meaning other language protocols are still at risk in IE with its multiple scripting language capability."

It's good to know Google takes security as seriously as it takes privacy. ®

Related Links

Jim's weblog
Bugtraq alert

Related stories

Gates: PC will replace TV, TV will become a giant Google
Talented flunkeys unite against phishing
Google Desktop privacy branded 'unacceptable'
Google's Gmail: spook heaven?
Google's Ethics Committee revealed
Google decides banner ads, skyscrapers are not evil
Google values its own privacy. How does it value yours?
Google revives discredited Microsoft privacy policy for Friendster clone

Choosing a cloud hosting partner with confidence

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.