Feeds

Google finally fixes Desktop security vuln

Staff: 'Gone phishing'

  • alert
  • submit to reddit

Providing a secure and efficient Helpdesk

The first flaw in Google's Desktop Search product has been discovered, and now fixed, according to the giant ad broker. The JavaScript vulnerability allowed third party websites to view the results of searches made on your local hard drive. It took Google four days to address the problem, and according to the Javascript expert who raised the alarm, it still hasn't been adequately patched.

Software developer Jim Ley, who maintains the comp.lang.javascript FAQ, announced the flaw on Monday on his weblog. But nobody noticed. Ley's email message to security@google.com bounced. He looked in vain for a security hotline number.

On Tuesday he demonstrated an ingenious potential application of the bug: a phishing exploit that announced that Google was becoming a subscription service, and invited the victim to enter their credit card details. Still no response.

Google finally sat up and took notice after the vulnerability was posted on the Security Focus BugTraq mailing list. Google couldn't explain why it didn't have a working email or phone contact for security alerts, but according to Jim, seemed anxious that he remove the phishing example.

In fact as he points out, the vulnerability is over two years old.

"Hopefully Google will get in touch explain what went wrong with the communication of the issue, hopefully Google will realise that a phone number of the security team on the web would also help," he writes.

"The fix they put in place is still flawed, it relies on special casing the vbscript, javascript and perlscript strings, meaning other language protocols are still at risk in IE with its multiple scripting language capability."

It's good to know Google takes security as seriously as it takes privacy. ®

Related Links

Jim's weblog
Bugtraq alert

Related stories

Gates: PC will replace TV, TV will become a giant Google
Talented flunkeys unite against phishing
Google Desktop privacy branded 'unacceptable'
Google's Gmail: spook heaven?
Google's Ethics Committee revealed
Google decides banner ads, skyscrapers are not evil
Google values its own privacy. How does it value yours?
Google revives discredited Microsoft privacy policy for Friendster clone

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.