Feeds

Researcher crosses swords with Google over XSS 'flaw'

Bug or feature?

Build a business case: developing custom apps

Google has crossed swords with an independent security researcher who claims that the domain used by Google module applications provides a potential "safe haven" for phishing fraudsters.

Google modules are small web apps (widgets) designed for functions such as displaying weather forecasts or sports scores on a third-party website.

Security researcher Robert Hansen warned Google that fraudsters might be able to create a phishing site on the gmodules domain because a cross site scripting flaw allows the injection of JavaScript.

Because the gmodules domain (gmodules.com) is trusted by phishing filters the flaw poses a greater risk than it might on other domains.

In its response, Google said JavaScript is a supported part of Google modules. Cross-domain protection stops sites on gmodules from been used to steal Google-specific cookies, it adds. "On further review, it turns out that this is not a bug, but instead the expected behavior of this domain," Google's security staffers told Hansen.

Hansen, a critic of Google's security response in general, argues that the search engine giant has missed the point. He posted a demo of cross-site scripting of the gmodules domain to illustrate his concern that Google ought to be worried about risks beyond simple credential (cookie) theft.

The exchange between Hansen and Google has sparked a lively debate on the ha.ckers.otg forum with participants weighing in on both sides of the debate. Some point out that Google has at least mitigated the risk by running modules from the gmodules domain, while others argue that the security policies at the ad brokering giant leave a lot to be desired. ®

The essential guide to IT transformation

More from The Register

next story
Rupert Murdoch says Google is worse than the NSA
Mr Burns vs. The Chocolate Factory, round three!
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Know what Ferguson city needs right now? It's not Anonymous doxing random people
U-turn on vow to identify killer cop after fingering wrong bloke
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.