We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Google Desktop open to hackers

Firefox hack also applies to Google Desktop

Just one day after a security researcher showed how Google's Firefox toolbar could be exploited in an online attack, a similar flaw has been discovered in the Google Desktop.

On Thursday, Google hacker Robert Hansen posted proof-of-concept details showing how attackers could use Google Desktop to launch software that had already been installed on the victim's computer.

The attack is hard to pull off and could not necessarily be used to install unauthorised software on the victim's PC, but it does illustrate the kind of security issues that arise with web-based applications, said Hansen, the CEO of web security consultancy Sectheory.com, and a contributor to the Ha.ckers.org website.

"When you have third parties writing code that interacts with your browser, it inherently breaks the browser security model," he said.

To exploit Hansen's Google Desktop vulnerability, an attacker would first have to launch a successful ‘man-in-the-middle’ attack, somehow placing himself between the victim and Google's servers. This could by done by tricking the victim into logging onto a malicious wireless network, Hansen said.

Once this was done, the hacker could launch Hansen's attack by changing the web pages being delivered to the victim's PC. By returning web pages that have been doctored with new JavaScript code, the victim could be tricked into clicking onto a malicious link, Hansen said. "When they actually click that mouse button, they're not clicking on the web page, they're clicking on a link to Google Desktop that actually runs code, " he said.

The steps Hansen took to pull off the attack are complex because of the security features that Google has built into its software, he added. "What I've done is combine a lot of different attacks that Google desperately tries to prevent."

On Wednesday researcher Christopher Soghoian showed how a man-in-the-middle attack could be used to install malicious software on computers that used a variety of popular Firefox add-ons, including the toolbars from Google, Yahoo and AOL.

Hansen has posted a video showing how this attack could be used to launch Windows HyperTerminal. But it could be used to launch virtually any application that has already been installed on the PC, he said.

This is not the first bug in Google Desktop. In February, engineers at Watchfire showed how a flaw in the program's Advanced Search Feature could be used to gain access to data or even run unauthorised software on a victim's computer.

Two days after the Watchfire bug was disclosed, Hansen himself showed how attackers could steal information from Google Desktop users using what is called an anti-DNS (Domain Name System) pinning attack.

Google was not immediately available to comment for this story.


IDG UK Sites

Exclusive: Samsung exits laptop market including Chromebooks

IDG UK Sites

Is Apple losing confidence in itself?

IDG UK Sites

How a London VFX studio is ditching desktop workstations for cloud-based creative power

IDG UK Sites

iOS 8 tips & tricks: Get to know iOS 8's handy new features