Slashdot Mirror
Flaw in Google's New Desktop Tool [Update: Fixed!]
silassewell writes "A Rice University computer scientist and two of his students have discovered a potentially serious security flaw [Sell your soul to the NYTimes to Read] in the desktop search tool for personal computers that was recently distributed by Google." Update: 12/21 03:15 GMT by T : An anonymous reader writes "It's being reported that the security problem in Google's Desktop Search has been plugged."
Here's a reg free link for those of us who have already sold our souls for other devious purposes ;)
Here is the no-subscriber link via Google News, for all that self-referential goodness...
At least they don't bury the bad news...
"When you put them together, out jumps a security flaw." What is this, magic?
Your website goes here
Google deploys their search tool
All is exploited
Tech, life, family, faith: Give me a visit
http://news.com.com/Google+Weve+fixed+desktop+sear ch+tool+flaw/2100-1002_3-5497885.html?tag=nefd.top
You can all, soon, download M$'s search tool - and we all know this will invade your privacy --- on purpose that is... :D
Programs like these (i.e. Gator password program) are the reason why I am a minimalist. I keep on my computer exactly what I need (pr0n included) and nothing else. Anything that potentially interfaces w/the web is a no-no with me (I use zone alarm, so I can see any program trying to access the net).
I mod down so you can mod up. Your welcome.
You have two components, which act as intended. However, the way they are merged into a product (i.e. the glue code) is flawed. If you want to be more technical, it is the kind of flaw you do not find through unit tests, only through system tests. So going from two components with no security flaws, you have a product with a security flaw. The quote is somewhat melodramatic, but accurate.
Kjella
Live today, because you never know what tomorrow brings
Google has already fixed the problem, and if you are using GDS, you should have the updated version since GDS updates automatically without user intervention. If you neeed to check, your version number should be 121,004 (or above). I verified from my firewall that my version was updated yesterday. (Apparently Google has been rolling out the updates since December 10)
"When the only tool you own is a hammer, every problem begins to resemble a nail." - Abraham Maslow (1908-1970)
From the researchers themselves, rather than the NYT's garbled take on it.
The article seemed a little vague, but i started investigating this when google desktop first came out.
GDS runs a webserver on your computer which any local application can query, including any java or activex app with outgoing http priviledges.
Google stop this by requiring that some sort of random ID as a key to access the page. This ID is generated as part of the url when you double click on the GDS icon in the taskbar.
It's also embedded into any results page that comes back from google, and you can exploit this by having the java applet first request www.google.com, find the link to GDS, then run a GDS search, then return those results via another web request to a remote host.
But it sounds like it's fixed, so that's good.
Was this flaw enough to gain a passing grade, unlike DJB's students
--Joe
Not only did you get a -1 redundant, but you also got it on a 1st Post!
This elusive prize is given by sharp moderators who rate your posts on the basis of what future posts might contain!
Do break your paragraphs next time.
If you don't know what AltaVista is (was), get off my lawn.
The Rice group was able to create a Java program that makes network connections back to the computer from where it was downloaded and then make it appear as if it were asking for a search at Google.com. That was enough to fool the Google desktop software into providing the user's search information. The program was able to do anything with the results, including transmitting them back to the attacking site.
So let me get this straight, after successfully fooling a user that the site they are seeing is legit when it's actually spoofed, then they can get the results of local search queries, potentially seeing parts of a file. Don't get me wrong, that kind of stinks and all, but if you have already fooled someone into believing the sites they are looking at are legit, why bother with this? Show them a gmail login, or a yahoo mail login, or if you know a bit about them, their internet banking login.
This security flaw doesn't seem like that big of a deal and if anything, it highlights that Google is being proactive about such things; addressing the issue and releasing fixed software in a reasonable amount of time. Kudos.
Admittedly the NYT article is extremely light on details (and those details don't show up until the end of the article), but from what it sounds like, the Google search tool sends a brief chunk of each search result, whether of local or network origin, to Google, so Google can display some ads.
These guys tricked the google search tool into sending that information somewhere else.
So, we have a "composition flaw", between two components; Google's search tool, and... uh... a Java attack script. Hmm...
The "flaw" here is that Google's search tool sends personal information to an external host, plain and simple. If I don't want a third party attacker seeing arbitrary parts of my hard drive's contents, I probably don't want Google seeing them either.
A web page on the attack is http://seclab.cs.rice.edu/ which also links to a technical report.
The way it works is actually pretty simple. What happens normally is that the toolbar watches your outgoing and incoming web connections. When you make a Google query, it detects that and does a local search of its index of your disk. When the results come back from Google, it mixes in the results from the web with the results from your disk. This design is to protect your privacy.
The attack is for a malicious site to download a Java applet to your system. This applet does a Google query (via the malicious site as a proxy, to defeat applet sandboxing), and then reads the results which come back. When the results get back to the applet they have gone through the Google toolbar and gotten the local disk results integrated. The applet then sends the data to the malicious site, and presto, it knows a lot about the contents of your disk.
Then again, I'm sure someone will find an exploit in Calculator or Freecell given time.
--- Ban humanity.
you had me worried for a sec. I thought there might have been a secret button that pops up that says, "find your husband's porn".
Stop the press! Bug in beta app! "Oh no!" Waves hands in the air, and runs around in circles. "Who will save us now? Who will save us?!!"
Get your own free personal location tracker
This is unnecessary. You can disable the integration option, which is a minor feature anyway. Check our webpage
Here is how the attack works.
This is based on Wired's much more clear and coherent description.
Desktop search installs an object that the browser instantiates on Google web pages to render local results along side of google results. No data is sent in this process.
The attack involves the fact that this data is present on the web page itself, and is added to the DOM. An attacker using JavaScript can traverse the DOM and read the exerpts of files shown on the search page.
It cannot follow this to the document itself in the cache, and it can see nothing other than the quoted excerpt.
It's beta software, bound to be problems. This particular problem is because the object isn't "locked to the page."
The vulnerability doesn't effect any other desktop search tool that is currently available, because none of them use an object in the browser to integrate search results with their web page. All the other tools are either search your desktop or search the web, not search both at once.
Using FireFox, without the object, you won't get the integrated search results, so you won't have the problem.
If your code is acting bloated, and is running rather slow, it's likely and predicted that some loops you will unroll.
Check out our webpage . The tone of the article is not Dan's doing. He has been more than generous with the credit, and was involved with our project and of invaluable assistance the entire time.
Which, by the way, reminds me of the time a friend asked me to fix his computer, and while running a virus scan, the progress window soon started running through his porn directories flashing some pretty embarassing filenames.
And that went on for a good 10 minutes or so.
All i could say was "Well, we do need to do the virus scan."