<?xml version="1.0" encoding="UTF-8"?><?xml-stylesheet title="XSL_formatting" type="text/xsl" href="rss_style.xsl" ?><rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:dc="http://purl.org/dc/elements/1.1/">
<channel>
        <title>ZDNet Blogs</title>
        <link>http://blogs.zdnet.com</link>
        <description>ZDNet Blogs Focus: Google Security</description>
<item>
<title>Google hires browser hacking guru</title>
<link>http://blogs.zdnet.com/security/?p=410</link>
<pubDate>Mon, 30 Jul 2007 03:01:20 -0700</pubDate>
<dc:creator>Ryan Naraine</dc:creator>
<guid>http://blogs.zdnet.com/security/?p=410</guid>
<description><![CDATA[Google has snapped up one of the sharpest minds in the hacker community, luring Michal Zalewski to help lock down its long list of Internet facing products.    Zalewski, a 26-year-old computer security whiz from Poland, joined the search engine giant about a week ago to work as an Information Security Engineer.    He confirmed the move via e-mail but declined to discuss specifics about the new gig.    [SEE: Google   s anti-malware team comes out of the shadows ]      The Zalewski hire is significant on several fronts.  It adds a brand-name hacker to Google's security team (the company has been looking for talent at hacker cons) at a time when it is struggling to cope with gaping holes in its line of products and, ... ]]>
</description></item>
<item>
<title>Google's $625 million security splash</title>
<link>http://blogs.zdnet.com/security/?p=360</link>
<pubDate>Mon, 09 Jul 2007 08:50:00 -0700</pubDate>
<dc:creator>Ryan Naraine</dc:creator>
<guid>http://blogs.zdnet.com/security/?p=360</guid>
<description><![CDATA[Google has announced its second acquisition in the computer security space, shelling out a whopping $625 million in cash to snap up enterprise e-mail security vendor Postini.    The deal,  which follows May's purchase of GreenBorder Technologies, confirms Google's big push into a lucrative security compliance marketplace and gives the search marketing giant its own technology to harden the Google Apps suite.  Like Google Apps, Postini's services are entirely hosted, eliminating the need to install any hardware or software. A leader in its field, Postini serves more than 35,000 businesses and 10 million users, and was one of our first partners for Google Apps. Their email and IM management services include inbound and outbound policy management, spam and virus protection, content filtering, ... ]]>
</description></item>
<item>
<title>Beware of that man between you and your Google Desktop </title>
<link>http://blogs.zdnet.com/security/?p=253</link>
<pubDate>Fri, 01 Jun 2007 08:32:55 -0700</pubDate>
<dc:creator>Ryan Naraine</dc:creator>
<guid>http://blogs.zdnet.com/security/?p=253</guid>
<description><![CDATA[Last month, I wrote a piece about Robert Hansen's Mr-T (Master Recon-Tool), a powerful tool that harvests data leaking out of Web browsers.  In the post, I talked about how these types of reconnaissance tools could be combined with sniffers and information from vulnerability databases to lay the groundwork for super-targeted attacks.    (SEE: Do you know what   s leaking out of your browser?)    Now, Hansen is taking the concept a step further with a scary demo of a zero-day vulnerability (video) in the Google Desktop search application, proving that information leaking out of your machine makes it easier for a hacker to prepare a sophisticated attack.    Hansen, a Web application security specialist known who uses the hacker name RSnake, has figured out a ... ]]>
</description></item>
<item>
<title>Unprotected Google directory spills database data</title>
<link>http://blogs.zdnet.com/security/?p=251</link>
<pubDate>Thu, 31 May 2007 09:06:05 -0700</pubDate>
<dc:creator>Ryan Naraine</dc:creator>
<guid>http://blogs.zdnet.com/security/?p=251</guid>
<description><![CDATA[Google has hurriedly fixed a gaping hole in its Web page removal request tool after outsiders discovered they could traverse up the directory root, browse folders and find weak database passwords.        The flaw, first reported by Earl of Grey's blog, exposed an unprotected internal Google directory.   The Hacker Webzine poked around and found some fun stuff:    Apparently it is a simple directory that wasn't protected, so we can traverse up their directory root and browse folders. A study gave me the impression this hole is unique, legit and not a honey pot. Now it can happen the best of the best that a directory becomes readable. But, one must never, ever, not in a million years, store your database connection ... ]]>
</description></item>
<item>
<title>(Updated) Remote vulnerability in high-profile Firefox extensions</title>
<link>http://blogs.zdnet.com/security/?p=245</link>
<pubDate>Wed, 30 May 2007 09:36:33 -0700</pubDate>
<dc:creator>Ryan Naraine</dc:creator>
<guid>http://blogs.zdnet.com/security/?p=245</guid>
<description><![CDATA[Today is Firefox Patch Day but even after you install the latest security updates from Mozilla, those browser extensions you use and love could put you at risk of code execution attacks.    According to independent researcher Christopher Soghoian (of boarding pass hacker fame), there's a remote vulnerability in the upgrade mechanism used by a number of commercial Firefox extensions that let an attacker covertly install malware that run within the Firefox browser.    In a detailed advisory, Soghoian lists the following high-profile add-ons as vulnerable:     Google Toolbar   Google Browser Sync    Yahoo Toolbar   Del.icio.us Extension   Facebook Toolbar   AOL Toolbar   Ask.com Toolbar   LinkedIn Browser Toolbar   Netcraft Anti-Phishing Toolbar   PhishTank SiteChecker    The vast majority of add-ons hosted at Mozilla's official repository (https://addons.mozilla.org) are not vulnerable but because those extension upgrades listed above are done from sites ... ]]>
</description></item>
<item>
<title>Google buys anti-malware browser virtualization startup</title>
<link>http://blogs.zdnet.com/security/?p=241</link>
<pubDate>Tue, 29 May 2007 08:07:32 -0700</pubDate>
<dc:creator>Ryan Naraine</dc:creator>
<guid>http://blogs.zdnet.com/security/?p=241</guid>
<description><![CDATA[Google has quietly made its first anti-malware acquisition, snapping up GreenBorder Technologies, a venture-backed company that sells browser virtualization security software.    The acquisition gives the search engine a key piece of technology to block Web-based exploits that prey on flaws in the two most widely used browsers -- Microsoft's Internet Explorer and Mozilla's Firefox.    (Also see: Google's anti-malware team comes out the shadows)    GreenBorder's software creates an "impenetrable protective barrier" that keeps all interactions with a Web site and its associated content and programs away from the internal parts of a Windows machine.    It essentially creates a DMZ (demilitarized zone) between the Windows desktop and programs downloaded from Web pages or opened from e-mail messages in Microsoft Outlook.    The company sold two versions of the ... ]]>
</description></item>
<item>
<title>Google's anti-malware team comes out of the shadows</title>
<link>http://blogs.zdnet.com/security/?p=229</link>
<pubDate>Tue, 22 May 2007 09:38:17 -0700</pubDate>
<dc:creator>Ryan Naraine</dc:creator>
<guid>http://blogs.zdnet.com/security/?p=229</guid>
<description><![CDATA[Google's anti-malware team has emerged from the shadows with a new blog, a widely discussed research paper (.pdf) and a few clues about its ambitious drive to put a roadblock between dirty Web sites and end users.     Over the last year, Google has quietly invested in several efforts to flag malicious sites that appear in its search results.  Last month, at the HotBots '07 conference in Boston, these efforts came to light when staff engineer Niels Provos (left) released the "Ghost in the Browser" paper with hard numbers on the extent of the malware-on-the-web problem.    In the analysis, Provos and the Google anti-malware team investigated about 12 million suspicious URLs and found that about 1 million of those sites were ... ]]>
</description></item>
</channel>
</rss>
