New Google Desktop Flaw Uses Man-in-the-Middle Attack

Researchers have discovered a new flaw in Google Desktop that can allow attackers to insert malicious software. This vulnerability is only a proof-of-concept. But it projects security concerns about the increasing Web programs.

Robert Hansen, CEO of Internet security firm Sectheory.com explained that this recent Google Desktop flaw employs a "man-in-the-middle" attack where a hacker interferes between a user and the Google server. Techshout published this on June 4, 2007.

In the attacks when a user requests a search in Google desktop, the hacker intercepts the search. He inserts a JavaScript to create an iFrame that is not visible, on the intended web page. JavaScript also helps iFrame to track the movements of the user's mouse. The user does not realize all that happens. After this the attacker inserts more code to set a second search request within the mouse iFrame.

With the execution of the second search, the attacker injects a meta-refresh to reload the URL page and that makes the Google Desktop install any program the attacker wants. As soon as the user clicks on the evil Google search, the malicious program runs on the system.

Hansen, a regular contributor to Ha.ckers.org posted the proof-of-concept on it.

Hansen wrote on the site that the insertion act could be a mischief or something evil. The important thing is that such perfect state of mixing of the web and client software is actually dangerous as it cracks the security tools that the browsers have put in place. Techshout published this on June 4, 2007.

If the assault turns out successful then the hackers would be encouraged to present victims URLs that actually execute malicious code.

Hansen further wrote that the incident illustrates the fact that the close integration between the desktop and the Web should not be an acceptable idea as Google's site is not encrypted and is vulnerable to an attacker. But here Hansen points two caveats - first there should be a Google Desktop installed, and secondly the attacker needs to be advanced enough to attack the user as man-in-the-middle. News.com published this on June 4, 2007.

Related article: New Zealand Releases Code To Reduce Spam

» SPAMfighter News - 6/20/2007