June 3rd, 2007
Google services still have many security holes
The Register reports that there have been several security vulnerabilities discovered by determined attackers over the past week — these range from a hole in Google Desktop that lets a malicious attacker execute any file on a users computer to an XSS vulnerability in Gmail letting an attacker access or delete a users email.
The person who discovered the Google Desktop vulnerability posted the details of this attack here — it is a man in the middle (MITM) attack injecting code that forces a user to click on a “Google Desktop result”.
An XSS attack on Gmail was also discovered this week — in my opinion, it is actually a bit more serious than the Google Desktop one. An attacker could hijack your Gmail session by getting you to visit a malicious website. Fortunately Google promptly fixed this one after it was posted.
The most interesting hole discovered this week though was found in a tool that webmasters can use to request removal of pages. Anyone could traverse up the directory tree to see files on Google’s servers that should be hidden from view. For example, 0×000000 was able to find a root password for one of Google’s databases by simply downloading a file — woops!
Garett Rogers is employed as a programmer for iQmetrix, which specializes in retail management software for the wireless industry.
See his full profile and disclosure of his industry affiliations.
Subscribe to Googling Google via Email alerts or RSS.
