Google Desktop vulnerability before the new attack

Just one day after security experts introduced the Google Toolbar vulnerability in Firefox, another similar vulnerability was found in Google Desktop.

On Thursday, Google "attacker" Robert Hansen showed detailed evidence that attackers could use Google Desktop to launch software that was definitely installed on the victim's computer.

The attack is difficult to implement and not necessarily used to install unauthorized software on the victim computer, but it illustrates a security concern generated by background applications. Web platform, Hansen - Sectheory.com's web security advisor and collaborator of website Ha.kers.org - said.

' When relying on third-party companies to have code that affects your browser, it actually ruins the browser security model itself ,' he said.

To exploit Hansen's Google Desktop vulnerability, the first attacker will launch a successful 'man-in-the-middle' attack, this way he will put himself between the victim computer and the computers. Google owner. This can be made even easier when the machine is attacked to access a malicious wireless network.

Once this happens, an attacker can start the attack by changing the site where the victim computer enters. By navigating to a fake website with a new JavaScript code, the victim computer could be tricked into clicking on a dangerous connection.

The steps that Hansen has taken are very complicated by the security features Google has integrated into their software.

On Wednesday, graduate student Christopher Soghoian also released a man-in-the-middle attack that can be used to install malware on computers that use some add-on tools. popular of Firefox, including Googe, Yahoo and AOL toolbar.

Hansen posted an image of this attack used to launch Windows HyperTerminal. But it can also be used to launch any virtual applications that are actually installed on the computer.

This is not the first error of Google Desktop. In last February, Watchfire Corp.'s engineers. has also released a flaw in the program's Advanced Search Feature, which can be used to access data or even run unauthorized software on a victim's computer.

Two days after the Watchfire vulnerability was discovered, Hansen himself showed how attackers could steal information from Google Desktop users.

Google has not directly commented on recent errors.

Hong Ngan