Slashdot Mirror
Zero Day Hole In Google Desktop
40by40 writes "A Web application security specialist has figured out a way to launch man-in-the-middle attacks against a computer with a fully patched Google Desktop installed. With knowledge of the Google Desktop security model (a combination of one-time tokens, iFrames and JavaScript), hacker Robert Hansen figured out a way to sit between a target launching a Google search query and manipulate the search results to take control of other programs on the desktop. From the article: 'This should drive home the point that deep integration between the desktop and the web is not a good idea, without tremendous thought put into the security model. As Google's site is unencrypted, and they place their content that can run executables on their site, it can be subverted by an attacker," Hansen warns. Hansen's advisory comes just days after a Chris Soghoian's exposé of a similar man-in-the-middle attack scenario against a remote vulnerability in the upgrade mechanism used by a number of commercial Firefox extensions.'"
This should drive home the point that connections should flow over encrypted tunnels whenever possible, to reduce the ease of performing man in the middle attacks. If this session flowed over an SSL style connection, the man in the middle would first need to figure out how to get into that session. That strategy seriously reduces the places where malicious code can exist "in the middle". Don't throw the baby (rich client interaction with services in the cloud) out with the bathwater.
If you mod me down, I shall become more powerful than you could possibly imagine.
By now, everybody developing browser components should know that you do not provide functions which can execute arbitrary programs.
Usually, it's Microsoft doing this, with Outlook, IE, Office, etc. launching other applications. This is the source of most of the vulnerabilities involving web browsing. Now we have Google competing to offer similar security holes.
Yeah for sure, now that Apache runs 60% of the Web, all those crackers are finding tons of exploits for it everyday!
The more you know, the less you understand.
Once you are compromised this way the attack tries to take advantage of cross scripting vulnerabilities in a browser to run code in the compromised machine. I am not sure if there is anything unique to Google Desktop here. Could the same attack take advantage of the numerous ActiveX vulnerabilities?
Is the "security expert" trying to get more mileage by listing each exploitable hole of a man-in-the-middle attack as a separate discovery?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
"Tremendous thought" is a weaker notion than transparency, public scrutiny, or even rigorous proof, which are really what's required.
Everything else is just hope; hide and seek.
Hopefully Google can learn and set an example here.
There are no karma whores, only moderation johns
this is even more of a problem since more and more installers like Irfanview's or Adobe's include Google Desktop (and/or toolbar) and there is no way to skip them when doing automated installs... what a sick trend.
Did the industry and Google learn nothing from the mistakes Microsoft made?
Even MS has done a 180 and with Vista broke all the internal/external links that made XP/ActiveX/IE such a mess. So if MS is smart enough to learn from their mistakes you would thing a company like Google would not go out of their way to emulate the same bad security ideas.
Is it just me, or is Google racing to be the next big evil? Gmail scanning, search data compiling, Firefox reporting, desktop document reporting, and now making really stupid software design decisions?
I think the premise of the article is rather stupid in fact.
It is not Google's job to provide a secure channel.
I guess when I do a MITM attack to capture login prompts and transparently proxy that is google's problem also?
Or when I resolve DNS queries to my own box, that is likewise google at fault?
Lol.
Plan 9?
We'd better get used to Google becoming the butt of jokes usually aimed at ActiveX. Google Gears, Google Desktop, Google whatever. We now reaize that the developers that develop these technologies simply get traded between the big 3 (Google, MS, Yahoo) and others.
Are we all finally realizing that Google writes insecure apps just like ever other software development company that is made up of humans?
I think it would better to be based on Plan 9. But no one talks it anymore. Is development still continuing?
Semi-automatic amateur armchair Australian philosopher; conjecture ready at any moment...
Why on this Earth would Google want an OS?? They already have it - it is called "The Browser". That's what they use to make money. They may want to extend its usage, but I doubt that Google will ever want to deal with the "desktop" in the same way as Microsoft, Apple or Linux community.
Google is about control. They want to control your information for their own profit. They show it again and again. That's how they make money. The more targeted the ads, the more money they can make. The only competitor I think they may have here is Amazon, but that only deals with your book preferences. Google wants your wants so they can sell something from one of their customers.
Thus it is NOT in the interest of Google to make a desktop. They are not in the business of making software like MS or Apple or GNU or even IBM. They are in business to manage information about you and me. Their "free" solutions are just there so you can give them more info about yourself.
Hope that is clear enough.