Google flaw provides in for phishing
- 29th Nov 2006
- Leave a Comment
wow. I was pointing out to a friend which Antivirus software i use, and saw there news section :
A security flaw in Google’s search appliances could expose Websites that use the products to information-stealing phishing attacks, ZDNet UK reports.
The Google Search Appliance and Google Mini are used by organisations including banks and universities to add search features to Websites. A flaw in the way the systems handle certain characters makes it possible to craft a Web link that looks like it points to a trusted site, but when clicked serves up content from a third, potentially malicious site.
“This vulnerability affects a lot of very large Websites. It basically allows a virtual defacement of a Website when following a malicious link,” a security expert said.
“We have notified all customers and provided them with clear instructions on how to protect their appliances,” a Google spokesperson said, adding that no Google Search Appliance or Google Mini users have reported any exploits of the flaw.
now that’s BAD news for google, when are they going to sort out these security issues .. I don’t want to say google checkout but that must be a prime target for teh Hackers
DaveN
5 Comments | Leave a comment »
I don’t pretend to understand how this stuff works, it’s not my area.
I am baffled that companies such as Google with all their highly skilled, and highly no doubt paid , manpower and resorces can not only release these flawed products but actually encourage others to use them.
Some spotty teenager in his bedroom somewhere has just pissed all over the work of a whole team of experts on 6 figure salaries I guess?
I originally saw this on ha.ckers.org … http://ha.ckers.org/blog/20061118/widespread-xss-for-google-search-appliance/ where Rsnake write about how maluc found the exploits.
Google sitemaps is also causing a security certificate error when you try to login…
Although after your previous post about Google sitemaps maybe I shouldn’t be trying to login?
’bout damn time they have something that will force them to better protect they data they collect from each and everyone of us… Like Andy Haggins and co said, protect yourself… http://www.linkbuildingblog.com/2006/11/competitive_web.html
a new security bug is founding at google mini.
here the link to the security paper:
http://secunia.com/advisories/23239/