Google says it has fixed a flaw that could have allowed hackers to search the contents of PCs running the company's desktop search tool.
According to a statement issued Monday by the Web search company, it has rolled out a fix for the vulnerability. The flaw in the tool was discovered in late November by a Rice University computer scientist and two of his students.
A Google representative said, "We were made aware of this vulnerability with the Google Desktop Search software and have since fixed the problem so that all current and future users are secure."
Dan Wallach, an assistant professor of computer science at Rice University, discovered the vulnerability while working with graduate students Seth Fogarty and Seth Nielson. Wallach describes it as a composition flaw--where a security weakness is caused by the interaction of several separate components.
According to The New York Times, which first reported the discovery of the flaw, Wallach, Fogarty and Nielson found that the Google desktop tool looks for traffic that appears to be going to Google.com and then inserts results from a user's hard disk for a particular search.
They managed to trick the Google desktop search program into inserting those results into other Web pages where an attacker could read them. This would only work after a user had visited an attacker's Web site, upon which a Java program (as created by the Rice group) would be able to fool the Google desktop software into providing the user's search information. The program was able to do anything with the results, including transmitting them back to the attacking site.
The disclosure of this flaw comes just days after research company Gartner warned businesses to steer clear of Google's desktop search tool until a more robust, enterprise-ready version is released.
Security experts have also warned that virus writers could use desktop search tools to make their malware more efficient.
Dan Ilett and Graeme Wearden of ZDNet UK reported from London.
Maybe Google is confident they have fixed this problem. But it sure is not obvious from their website whether the downloadable version is the one with the fix or not. It's as if they do not want to reveal that there has been a problem.
If you were to look into the past records of this site, I said that I was concerned about his very thing. I had commented on how dangerous this kind of thing could be.
Chinese authorities have reportedly taken iPads from a third-party retailer, a move apparently brought on by Apple's continued refusal to honor a trademark for the iPad name owned by a Chinese manufacturer.
NY professor believes that a word-based algorithm can help bring together those who believe, with one glimpse, that they have found and lost the love of their lives.
After a higher-than-expected fourth quarter, the video subscription service unburdens itself of a pending yearlong class action suit and settles for $9 million.
Along with green-lighting Google's buy of Motorola, the Justice Department today OKs an Apple-Microsoft-RIM partnership deal to buy Nortel patents, and Apple's plan to acquire Novell patents.
Chamtech's spray-on antenna uses a nano material to provide a low-power boost to antenna range. The wireless-in-a-can product may some day bring an end to unsightly cell towers.
This week, we pass around Sony's new PlayStation Vita for some hands-on testing, check out HP's newest Beats Audio laptop, and debate the best and worst Valentine's Day gadget gifts.
EnerG2 opens a plant to make an engineered carbon that will improve performance of energy storage devices and make storage for start-stop hybrid cars less expensive.
