A new research project aims to harness search engine Google to find security flaws in open source code. Bugle (http://www.cipher.org.uk/index.php?p=projects/bugle.project) identifies common vulns using a (thus far) limited set of Google queries. So far the search queries look for cross-site scripting, SQL injection and buffer overflow flaws, for example.

Emmanouel Kellinis, the brains behind the project, a side-line to his regular job as a penetration tester with KPMG, is careful to describe Bugle as limited. Source code review is a complicated process and Bugle should be viewed as helping to give helpful pointer rather than an alternative to more comprehensive analysis, he advises

The release of Bugle comes a week after H D Moore published a Google-based malware search tool. ®

Related stories

• Google's Lemon squeezes out web app bugs (18 July 2007)

  http://www.theregister.co.uk/2007/07/18/google_lemon/

• Google security vulnerabilties stack up (3 June 2007)

  http://www.theregister.co.uk/2007/06/03/google_vulns_stack_up/

• Cookie monster menaces Google (18 January 2007)

  http://www.theregister.co.uk/2007/01/18/google_patches_cookie_bugs/

• Google Code Search peers into programs' flaws (8 October 2006)

  http://www.theregister.co.uk/2006/10/08/google_code_search_peers_into_program_flaws/

• Google bundles software apps (29 August 2006)

  http://www.theregister.co.uk/2006/08/29/google_bundles_software/

• Google offers malware warnings (7 August 2006)

  http://www.theregister.co.uk/2006/08/07/google_malware_warning/

• Trojan poses as Google Toolbar (20 July 2006)

  http://www.theregister.co.uk/2006/07/20/google_toolbar_trojan/

• Google-based malware search tool surfaces (18 July 2006)

  http://www.theregister.co.uk/2006/07/18/malware_search/

• Search results lead to malicious sites (16 May 2006)

  http://www.theregister.co.uk/2006/05/16/mcafee_search_risks_survey/

• Botnet implicated in click fraud scam (15 May 2006)

  http://www.theregister.co.uk/2006/05/15/google_adword_scam/

• Google concedes desktop security risk (21 February 2006)

  http://www.theregister.co.uk/2006/02/21/google_desktop_risk/

• Google AdSense Trojan prowls cyberspace (30 December 2005)

  http://www.theregister.co.uk/2005/12/30/google_adsense_trojan/

• Desktop search and malware: friend or foe? (13 October 2005)

  http://www.theregister.co.uk/2005/10/13/desktop_search_malware_risk/

• Hacking Google for fun and profit (4 April 2005)

  http://www.theregister.co.uk/2005/04/04/google_hacking/