Google patches Desktop search flaw

gallery

A flaw in the Google Desktop search application that could allow hackers to take over a user's computer and run remote code on it, has been closed off by the company.

The cross-site scripting vulnerability was found by researchers working at security company Watchfire. Google has since issued a patch to fix the problem.

According to a whitepaper published by Watchfire, hackers could use the cross-site scripting flaw to get users to run code that in turn would allow an attacker full access to a user's computer.

"The malicious logic acts as a parasite, using JavaScript code to control Google Desktop functionality," said the authors. "The attacker covertly hijacks confidential information from the system, while evading current information protection systems, such as anti-virus software and firewalls."

The authors said the attack also emphasizes the danger of the integration between desktop applications and web applications, "as this opens an aperture for a malicious attacker to escalate their privileges by crossing from the web environment to the desktop application environment."

Cross-site scripting takes advantages of flaws in web pages to inject malicious code into legitimate websites and redirect them to other websites that can download further malicious content. The same method is also used in phishing attacks.

The company alerted Google over the problem on 4 January. Engineers at the search outfit worked on and released a patch that was automatically distributed to users of the desktop search application. Researchers at Watchfire confirmed that the patch appeared to fix the flaw.

Email to a friend

Print this page