It's nice to see Microsoft and Google's respective technologies working in tandem - but not so nice to see it used to expose data on your own hard disk to a malicious website operator.

Security researcher Matan Gillon has published (http://www.hacker.co.il/security/ie/css_import.html) a proof-of-concept flaw that exploits Google Desktop, the search software that runs on a local PC, and Internet Explorer 6.

The principal culprit, once again, is Microsoft's lax and inconsistent implementation of Cascading Style Sheets (CSS) in Internet Explorer. A web site can inject code into a page which allows it to execute on a remote machine.

"All an attacker has to do is lure a user to a malicious web page. Thousands of web sites can be exploited and there isn't a simple solution against this attack at least until IE is fixed. That means millions of IE users are affected by this design flaw," writes Gillon.

Opera and FireFox users are safe.

However this particular flaw wouldn't have been possible without careless programming by Google, which amazingly, fails to obey the Google Desktop security model on its own site.

Gillon discovered that on certain pages, such as Google News, it was easy to extract the security key that the local copy of Google Desktop needs to permit queries to be executed.

"This feature has been in IE at least since IE 6 came out," writes a sarcastic Slashdot member.

"That means Microsoft is again leading the field when it comes to AJAX and Web2.0 products."

The weight of responsibility for this flaw falls on Microsoft. But Google shares some blame too, for failing to take the integrity of your personal data seriously. ®

Related stories

Google patches critical desktop flaw (21 February 2007)
http://www.theregister.co.uk/2007/02/21/google_desktop_search_bug/
Google blacklist sheds light on phishing tactics (5 January 2007)
http://www.theregister.co.uk/2007/01/05/google_phishing_blacklist/
Phishing with Rachna Dhamija (21 June 2006)
http://www.theregister.co.uk/2006/06/21/phishing_with_rachna_dhamija/
Why phishing catches punters (7 June 2006)
http://www.theregister.co.uk/2006/06/07/why_phishing_works/
Phishing fraudsters aim to outpace site shutdowns (8 March 2006)
http://www.theregister.co.uk/2006/03/08/smart_redirect_phish_attack/
EFF issues Google Desktop warning (10 February 2006)
http://www.theregister.co.uk/2006/02/10/google_desktop_privacy_kerfuffle/
Google AdSense Trojan prowls cyberspace (30 December 2005)
http://www.theregister.co.uk/2005/12/30/google_adsense_trojan/
Google Base awash with smut (24 November 2005)
http://www.theregister.co.uk/2005/11/24/google_base/
Spam map Googles junk mail proxies (20 September 2005)
http://www.theregister.co.uk/2005/09/20/spam_map/
Google snubs press in privacy fury (6 August 2005)
http://www.theregister.co.uk/2005/08/06/google_privacy_snub/
Google puts the brake on Web Accelerator (13 May 2005)
http://www.theregister.co.uk/2005/05/13/google_accelerator_suspended/
Hacking Google for fun and profit (4 April 2005)
http://www.theregister.co.uk/2005/04/04/google_hacking/
Google AutoLink: enemy of the people? (3 March 2005)
http://www.theregister.co.uk/2005/03/03/google_autolink/
Google plugs brace of GMail security flaws (17 January 2005)
http://www.theregister.co.uk/2005/01/17/google_security_bugs/
Major flaw found in Google Desktop (20 December 2004)
http://www.theregister.co.uk/2004/12/20/google_desktop_flaw/
Don't use Google desktop search in your business, warns Gartner (15 December 2004)
http://www.theregister.co.uk/2004/12/15/google_gartner_desktop_search/
Google blocks Gmail exploit (1 November 2004)
http://www.theregister.co.uk/2004/11/01/gmail_bug_fixed/
Google finally fixes Desktop security vuln (21 October 2004)
http://www.theregister.co.uk/2004/10/21/google_desktop_security_vuln/
Google's Gmail: spook heaven? (15 June 2004)
http://www.theregister.co.uk/2004/06/15/gmail_spook_heaven/
Avoid Friendster and its clones, warns security expert (10 February 2004)
http://www.theregister.co.uk/2004/02/10/avoid_friendster_and_its_clones/
Google revives discredited Microsoft privacy policy for Friendster clone (5 February 2004)
http://www.theregister.co.uk/2004/02/05/google_revives_discredited_microsoft_privacy/