• Total Members: 12780
  • Latest: eduard
  • Total Posts: 28039
  • Total Topics: 8052
  • Online Today: 777
  • Online Ever: 51419
  • (01. January 2010., 09:27:49)

Author Topic: Google Gadgets an Open Door for Attack  (Read 1599 times)

0 Members and 1 Guest are viewing this topic.


  • SCF Administrator
  • *****
  • Posts: 7152
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • - Samker's Computer Forum
Google Gadgets an Open Door for Attack
« on: 09. August 2008., 05:59:31 »

Gadget lovers were dealt a blow on Wednesday when two researchers outlined what they called a "hole" during a Black Hat presentation.

"The attacker can forcibly install Google Gadgets; they can read the victim's search history once a malicious gadget has been installed in some specific circumstances; they can attack other Google Gadgets; they can phish usernames and passwords from victims, and so on," said Robert Hansen, also known as RSnake, a founder of security consultancy SecTheory. "Really, the sky is the limit, once the browser is under the control of an attacker. And that point is exacerbated by the fact that people trust Google be a trustworthy domain, making the attacks even easier."

Hansen said that users who are most vulnerable to attack are those who use Google and specifically Gmail since the Web-based e-mail service requires them to be logged in. The attack relies on users intentionally adding modules themselves; a user may be tricked into adding malicious Google modules to his iGoogle homepages. "These users are almost all using JavaScript and normal Web browsers, making them easing pickings for many different classes of attack, he added.

Tom Stracener, a senior security analyst at Cenzic and co-presenter of the talk, outlined the threat:

Gadgets can attack other Gadgets: The potential impact of these attacks is through cookie theft, or theft of confidential and sensitive information from the Gadget or user.

Gadgets can attack the user: The type of attacks range from phishing to cross-site request forgery (when a user follows a link or clicks a form and unwittingly takes an action on a third party website that they did not intend to take).

Auto-adding a Gadget: A malicious webpage can add a Gadget to a user's iGoogle homepage without his knowledge and assist in the spread of gadget-based malware.

Logging into an alternate Google account: A Gadget can log a user into a different Google account and monitor search queries.

"While the business impact from Google Gadget malware is minimal at this time," Stracener says, "As the use of Google Gadgets moves from consumer to business use, the risks for business users will grow."

News Source: PC World

Samker's Computer Forum -

Google Gadgets an Open Door for Attack
« on: 09. August 2008., 05:59:31 »


With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters)

Enter your email address to receive daily email with ' - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising