Google flaw provides phishing hook

A security flaw in Google's search appliances could expose websites that use the products to information-stealing phishing attacks, experts warned Monday.

The Google Search Appliance and Google Mini are used by organisations including banks and universities to add search features to websites. A flaw in the way the systems handle certain characters makes it possible to craft a web link that looks like it points to a trusted site, but when clicked serves up content from a third, potentially malicious site.

"This vulnerability affects a lot of very large websites," John Herron, a security expert who maintains the NIST.org site, said in an email. "It basically allows a virtual defacement of a website when following a malicious link."

The vulnerability provides cybercrooks with a hook for phishing attacks, scams that try to trick people into giving up sensitive information such as credit card data and Social Security numbers. Phishing scams typically use spam email with a link to a fraudulent website.

Google found out about the problem last week, a spokesman for the company said in an email on Monday. "We have notified all customers and provided them with clear instructions on how to protect their appliances," he wrote, adding that no Google Search Appliance or Google Mini users have reported any exploits of the flaw.

Google sent an advisory to all customers on 22 November, the spokesman said. The vulnerability will also be addressed in the next release of the products, he said.

The cross-site scripting problem involves 7-bit Unicode Transformation Format (UTF) character encoding. "This particular vulnerability is clever because of the encoding hack," said Jeremiah Grossman, chief technology officer at WhiteHat Security, which specialises in web application flaws and protection.

One way internet users can protect themselves against attacks that attempt to exploit the flaw in the Google appliances is to inspect web links. The rigged links will be very long, according to security experts.

Users of the Google appliances who have not heard from Google should contact the company for a fix. "Website owners must be diligent about finding and fixing vulnerabilities, [since] even products supplied by well-known brands possess these extremely common issues," Grossman said.



Related Links:

• Go back to category Internet & Networks to read more reviews and articles.
• Go back to Software Magazine's main page.