Slashdot Mirror
A Second Google Desktop Vulnerability
zakkie writes "According to InfoWorld, Google's Desktop indexing engine is vulnerable to an exploit (the second such flaw to be found) that could allow crackers to read files or execute code. By exploiting a cross-site scripting vulnerability on google.com, an attacker can grab all the data off a Google Desktop. Google is said to be investigating. A security researcher is quoted: 'The users really have very little ability to protect themselves against these attacks. It's very bad. Even the experts are afraid to click on each other's links anymore.'"
What's all the fuss about ?
I'd RTFA but I'm afraid of what will happen if I do.
Wanna fight ? Bend over, stick your head up your ass, and fight for air.
In hindsight I'm glad I never installed Google Desktop.
IMAGE VERIFICATION IS EVIL!
Even the experts are afraid to click on each other's links anymore.
Does anyone else think that was tremendously funny in a sixth-grade-humor sort of way? Maybe I just am up too early.
"Even the experts are afraid to click on each other's links anymore."
Umm.. Google desktop runs on Windows.. Seriously, how many "security experts" do you know running Windows?
A security researcher is quoted: 'The users really have very little ability to protect themselves against these attacks. It's very bad. Even the experts are afraid to click on each other's links anymore.'"
That's all those "security experts" out there who use Google Desktop (yeeesh).
There are shills on slashdot. Apparently, I'm one of them.
5 bucks that google won't get the /. microsoft treatment.
Not sure if you consider he as a security expert but Joanna Rutkowska uses Windows Vista. She was running Windows XP 64 bit before Vista was released IIRC.
n ning-vista-every-day.html
http://theinvisiblethings.blogspot.com/2007/02/ru
I wonder how many more exploits would be found if Google Desktop ended up on 90% of desktop computers?
Google Desktop says that it automatically updates itself, but that doesn't work, and there's no 'force an update' feature as with Firefox.
.PST file. So I frequently find an email, then try to open it in Outlook, then find I can't and have to find it manually by date/time. Same issue with files that are renamed or moved. Many people have complained about this, but the Google Desktop team ignored this, and instead spent their time producing the incredibly useless widgets, rather than *making the search features really work well*.
More infuriatingly, Google Desktop also doesn't understand that emails that it indexes in my Outlook Inbox won't stay there forever due to restrictions on server mailbox size, and doesn't re-index them when they move to an offline
Google Desktop still doesn't support the use of '-' to join two words, i.e. "foo bar" can be written as foo-bar. And the Google Desktop results within Outlook are still not a proper Outlook result list (as with Outlook Find), so you can't just drag items into a new email as attachments - no, you have to open up the email (if it can find it...), use Outlook to copy it to a temp folder, then drag from that folder into the new email.
Google Desktop is simply too annoying to use any more, even though I've used it from version 1, and is actually a very un-Google-like product. Unlike the core Google.com search, which has been quietly optimised over the years to add stemming, proximity, spelling correction, etc, Google Desktop is actually a rather mediocre and barely usable desktop search tool whose primary benefit is that it integrates well with Google Toolbar.
I noticed a while ago that Google Desktop was preloaded on the Dells we buy. These Dells can wind up in areas that might access patient information. Since this is a major research hospital/medical school, I brought my concerns to the security group (HIPAA laws mandate privacy for patient information). Dell/Google assured us that this was a non-issue.
The end result was that not much happened.
My take? I still uninstall it whenever I see it.
"Let us raise a standard to which the wise and honest can repair" - George Washington
You could use windows desktop search:f ault.mspx
http://www.microsoft.com/windows/desktopsearch/de
I've been using it recently and works quite well.
I realise there are many other people who see Web 1.0 as too limited for all the usual reasons, e.g. because they want interactivity features, or Flash movies, or proper CSS support for different display devices, etc, all of which are good reasons for them and do require the use of Javascript / AJAX. I don't need any of that, however, so I disable Javascript. I have yet to find a website with textual information that could not have been written or read by me based on good old HTML. Another reason I prefer websites that avoid relying heavily upon Javascript, even to make simple links between webpages, is that they can be properly indexed by search engines.
Scroogle
Vulnerabilities exist and will continue to exist. As long as it is fixed within a short period of time it is ok. Saying that, If I was a manager in a commercial organization, I would never allow Google Desktop on my employees computers as online security is still in its infancy.
Visit http://www.kaizenlog.com
People keep complaining about my sig. But they should just learn.
Browsers suck. javascript is unsafe and most sites/webapps don't sign url/form parameters. So learn to think before you click.
And if you are thinking of clicking on some strange stuff, open a pristine VM, and use a clean browser there (you can even "sort of" put the VM on a different network from your computer - get two NICs).
I tried google desktop... consumed 10gb of disk space, had a process that ran 100% cpu eating nearly 700MB of ram, and kept indexing usb devices so you couldn't eject them. All this and it couldn't tell when you moved a file from one directory to another... or deleted it entirely! Hell the Windows XP "Search" can at least find a file if you know the name of it.
I caught wind of the first explot found, but I didn't bother checking out what it was all about. And now, yet another exploit in a matter of days. I KNEW this would happen. I knew that having a desktop search engine connected to the web was a bad idea and I never tried it.
WDS doesn't index Thunderbird/mozilla/firefox. Complete waste of time.
It seems to me Google urgently needs to hire some people that really understand software security and give them real influence on design decision. Making it work only does not cut it today, not if you are a high-profile target....
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
They seem to be having some issues with auto updating in general. Google Talk on my home computer lags behind the one on my work computer, and no amount of manually clicking "Check for updates now" will update it.
I asked Google about it, and they told me to uninstall, download new version, install. Which I did. But that was a few versions ago and I'm now lagging behind again. Not impressed.
U TROLLING = BAD.
What is with these surreal troll posts? Every topic gets one or two. Is this Al Quaeda's new way of communicating with George W. Bush? Are they command and control messages for a botnet? An early release of a new movie, compressed by a very lossy algorithm?
Or are they just written by crackheads who think that not making sense is always funny?
Netcraft confirms it - GNAA is dying!
This doesn't appear to affect all Google Desktop users. The article talks about data being intercepted as it is sent to Google. IOW, this is only applicable for users who are storing a complete index of their hard drive on Google's servers. As if that wasn't an obvious security threat!
Simple solution: make sure you disable the "feature" allowing you to index your hard drive on Google's servers. IMHO, a terrible feature that has caused Google far more harm than good. Many companies have banned Google Desktop because of this capability. It was even more inexcusable when it was enabled by default.
Moral of the story: even if they aim to "do no evil," Google's self-assuredness often leaves the user paying the price for Google's mistakes.
I've said it before and I'll say it again. Snort signatures available here
Your sig(k) has been stolen. There is a puff of smoke!
Well, Well. Seems the vaunted Google hiring mechanism; you know the one that selects only the creme of the crop is broken. Or, maybe it never worked to begin with. Come to think of it, Google hasn't done ANYTHING technically since the Pagerank Algo stuff. If you downloaded Google desktop you are an idiot! You actually believed that "First do no evil" B.S. marketing schtick didn't you? Didn't you know the first rule of corporations, all corporations is "First, make money".
To add to your list: GDS doesn't index Outlook/email attachments even if they are in a format that it does know how to index. Like you mention, it doesn't deal well with documents moving from one location to another (not just within Outlook, anywhere in the filesystem). And the bug you mention about email is much worse than just not able to locate a moved email: it means that spam that gets moved by a client-filter to a folder you've told GDS not to index, will still be in the GDS index because it usually indexes it before the spam filter gets to move it. So, your index eventually gets clogged up with spam too.
It gets worse: GDS actually "forgets" about documents it has previously indexed (so results get *worse* over time, not better). And its index keeps growing (yes, even though its results are getting worse). And as the parent mentions, it doesn't have a "re-index now" option, so you are forced to uninstall and re-install.
The only good thing about GDS is its integration with google.com (who's embracing and extending now?). I am no MS apologist and I put up with GDS for over 1.5 years, but I switched to Windows Desktop Search and never looked back: WDS is head-and-shoulders above GDS (BTW, it can be downloaded into XP and is pretty much the same as the WDS in Vista): better results, better UI, way better integration with Windows, smaller index, ability to re-set the index whenever and faster to index the drive than GDS to begin with. WDS started life as Lookout, a third-party freeware app that was bought by MS, and it was better than GDS back then (oh what 4 years ago?).
If only developers would embrace WDS to fix some obvious shortcomings (no Firefox/Thunderbird indexing, no hotkeys like GDS). I doubt Microsoft has anything to fear from Google competing for the desktop if GDS is any indication...
It's called a controlled roll-out. It saves bandwidth and if a bug is found that breaks users, you can roll back or fix it without causing everyone to be broken all at once. It's a much better way of doing things than having "Patch Tuesday"
GDS does have a "re-index" now option. Options...Indexing...Re-Index.
In younger years, my friends and I dug a hole on a path by our fort. We covered it up, and then started yelling "Snake snake", so that by brother, a snake collector, would come a running and probably not notice the hole. He didn't. We laughed.
Grow Up.
and they want their internet back.
A good alternative to google desktop is AvaFind. It is shareware, but the features are just as good. And the best thing is that it indexes the whole disk in about half a minute.d /
Download link http://www.think-less-do-more.com/avafind/downloa
I am NOT a Google SHILL !!
Wow. I just read the white paper, and it appears that one way to exploit this security flaw is to enable "Search across computers," but it's not necessary for the attack. This is a giant hole. I use Google Desktop every day, and I have no choice except to disable it. I was a big Google Desktop booster, but there's no way I can use it now.
Any recommendations on a good, safe desktop search application?
WTF is "a Google Desktop"? That's like saying "a Mozilla" or "a Microsoft Word". Retards.
You work at Google and can vouch for that? Because the reply I got was quite clear that doing a "check for updates" should've done the trick.
Not to mention that I'm talking about weeks and weeks of lag here, not a few days. For example I was still at 1.0.0.100 when I wrote the original post, while 104 was released at the turn of the year.