[Infowarrior] - Surfing Google may be harmful to your security

[Richard Forno]

Surfing Google may be harmful to your security
When gadgets attack
By Dan Goodin in Las Vegas → More by this author
Published Saturday 9th August 2008 13:02 GMT
http://www.theregister.co.uk/2008/08/09/google_gadget_threats/

Defcon A well-known researcher specializing in website security has  
strongly criticized safety on Google, arguing the world's biggest  
search engine needlessly puts its millions of users at risk.

"Google is and will be and always has been vulnerable," Robert Hansen,  
CEO of secTheory, told a standing-room-only audience at the Defcon  
security conference in Las Vegas. "They haven't been open with  
consumers. Ultimately, this all comes down the the fact that they just  
want to track you guys."

At issue is Google's policy of hosting untested third-party  
applications that users can automatically embed into personalized  
Google home pages. During a talk titled "Xploiting Google Gadgets:  
Gmalware & Beyond," Hansen and fellow researcher Tom Stracener laid  
out a variety of attacks that can be unleashed using the programs.

The most devastating is the ability of Google gadgets to immediately  
redirect victims who log into iGoogle.com to a page under the control  
of an attacker. This creates a phishing hazard, particularly for less  
tech-savvy users who don't know to check the browser bar. Even if they  
do, the bar shows up at gmodules.com, an address many mistakenly  
believe is safe because it is maintained by Google.

Hansen, who frequently goes by the moniker Rsnake, said he discussed  
the vulnerability with Google security engineers, and they told him  
the redirection was a feature rather than a flaw.

Google gadgets make other attacks possible, including: the ability to:

     * carry out port scanning on a victim's internal network to  
conduct surveillance

     * use cross-site request forgery techniques to force victim PCs  
to follow links to malicious sites (for instance, those that host  
child pornography) and

     * cause a victim's browser to access a home router and change  
domain name system server addresses or other sensitive settings.

Hansen and Stracener acknowledged that in-the-wild attacks that use  
Google gadgets are rare, but they said that's likely to change.

"Once money actually starts flowing through, once the financial  
incentive for malware exists, then you're going to start seeing more  
of this type of thing pop up," Stracener said.

Google representatives didn't respond to an email requesting comment  
for this story. They told the Associated Press that the company  
regularly scans gadgets for malicious code, and in the "very rare"  
occasions bad applications are found, they are immediately quarantined.

The speakers took strong exception to Google's claim. They've had  
several proof-of-concept gadgets hosted for months on Google, and so  
far they've never been removed, they said. ®